CI for Automatic recon

Hi hackers and bugbounty hunters ๐Ÿ˜

CI/CD is a key topic in DevOps, DevSecOps. Iโ€™m also working on DevSecOps, so Iโ€™ve been thinking about it a lot and testing it. Meanwhile, I thought it would be okay to use CI concept in Recon. CI/CD๋Š” DevOps, DevSecOps์—์„œ ๊ฐ€์žฅ ํ•ต์‹ฌ์ ์ธ ์ฃผ์ œ๊ฐ€ ๋˜๋Š” ๋‚ด์šฉ์ž…๋‹ˆ๋‹ค. ์ € ๋˜ํ•œ ์ผ์ ์œผ๋ก  DevSecOps์— ๋Œ€ํ•œ ๋ถ€๋ถ„๋„ ํ•˜๊ณ  ์žˆ๊ธฐ ๋•Œ๋ฌธ์— ์ž์ฃผ ๊ณ ๋ฏผํ•˜๊ณ , ํ…Œ์ŠคํŠธํ•ด๋ณด๊ณ  ์žˆ๋Š”๋ฐ์š”. ๊ทธ๋Ÿฌ๋˜ ์ค‘ Recon์— CI ๊ฐœ๋…์„ ์‚ฌ์šฉํ•ด๋ด๋„ ๊ดœ์ฐฎ์„ ๊ฒƒ ๊ฐ™์€ ์ƒ๊ฐ์ด ๋“ค์—ˆ์Šต๋‹ˆ๋‹ค.

Todays, CI for Recon! ๊ทธ๋ž˜์„œ ์˜ค๋Š˜์€ Recon์—์„œ CI๋ฅผ ์ ์šฉํ–ˆ๋˜ ์ด์•ผ๊ธฐ์— ๋Œ€ํ•ด ๊ณต์œ ๋“œ๋ฆด๊นŒ ํ•ฉ๋‹ˆ๋‹ค.

What is CI(Continuous Integration)?

It literally means continuous integration. This refers to an automated process that periodically builds and integrates source code into testing, repo, etc. according to specific events, such as code changes and periodic settings. ์ด๋ฆ„ ๊ทธ๋Œ€๋กœ ์ง€์†์ ์ธ ํ†ตํ•ฉ์„ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค. ์ฝ”๋“œ ๋ณ€๊ฒฝ, ์ฃผ๊ธฐ์ ์ธ ์„ค์ • ๋“ฑ ํŠน์ • ์ด๋ฒคํŠธ์— ๋”ฐ๋ผ ์†Œ์Šค์ฝ”๋“œ๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ๋นŒ๋“œํ•˜๊ณ  ํ…Œ์ŠคํŠธ, Repo(git ๋“ฑ)์— ํ†ตํ•ฉํ•˜๋Š” ์ž๋™ํ™” ํ”„๋กœ์„ธ์Šค๋ฅผ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค.

Why CI?

Personally for BugBounty, make and use a lot of tools, and we accumulate data. In my case, I wanted to combine multiple devices and the results of the testing server and MacBookโ€™s different results.

So I used CI concept for continuous bugbounty data integration. ๊ฐœ์ธ์ ์œผ๋กœ ๋ฒ„๊ทธ๋ฐ”์šดํ‹ฐ๋ฅผ ์œ„ํ•ด์„œ(์ž์ฃผํ•˜์ง€๋Š” ์•Š์ง€๋งŒ) ์—ฌ๋Ÿฌ๊ฐ€์ง€ ๋„๊ตฌ๋ฅผ ๋งŒ๋“ค์–ด์„œ ์‚ฌ์šฉํ•˜๊ณ , ๋ฐ์ดํ„ฐ๋ฅผ ๋ˆ„์ ํ•˜๋Š”๋ฐ์š”. ์ €์˜ ๊ฒฝ์šฐ ์—ฌ๋Ÿฌ ๋””๋ฐ”์ด์Šค๋ฅผ ์‚ฌ์šฉํ•˜๊ณ  ํ…Œ์ŠคํŒ… ์„œ๋ฒ„์˜ ๊ฒฐ๊ณผ์™€ ๋งฅ๋ถ์— ๋‹ค๋ฅธ ๊ฒฐ๊ณผ๊ฐ€ ์žˆ์–ด์„œ ์ด๋ฅผ ํ†ตํ•ฉํ•˜๊ณ  ์‹ถ์€ ์ƒ๊ฐ์€ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค.

๊ทธ๋ž˜์„œ ์ง€์†์ ์ธ ๋ฒ„๊ทธ๋ฐ”์šดํ‹ฐ ๋ฐ์ดํ„ฐ ํ†ตํ•ฉ์„ ์œ„ํ•ด์„œ CI ๊ฐœ๋…์„ ๋ถ™์—ฌ๋ดค์Šต๋‹ˆ๋‹ค.

How to?

When triggered largely by a specific event(add new target, and weekly?), it has a structure that uses the existing Recon tool to analyze, add the results in github and tell me with Slack.

์šฐ์„  ์ €์˜ ๋‹ˆ์ฆˆ๋Š” ํ™•์‹คํ–ˆ๊ณ , ๊ธฐ์กด์— ์‚ฌ์šฉํ•˜๋˜ ๋„๊ตฌ์™€ pipeline์„ CI/CD ๋„๊ตฌ์— ์ด์‹ํ•˜๊ธฐ ์‹œ์ž‘ํ–ˆ์Šต๋‹ˆ๋‹ค. ๊ฐ€์žฅ ์ปค๋ฎค๋‹ˆํ‹ฐ๊ฐ€ ํ™œ๋ฐœํ•˜๊ณ  ๋งŽ์ด ์‚ฌ์šฉ๋˜๋Š” Jenkins๋ฅผ ํƒํ–ˆ๊ณ  ์ €ํฌ recon ๋„๊ตฌ์™€ slack๊นŒ์ง€ ์ด์–ด์ง€๋Š” ๊ทธ๋ฆผ์„ ๊ทธ๋ ธ์Šต๋‹ˆ๋‹ค.

Jenkins + My private app + Slack notify

ํฌ๊ฒŒ ํŠน์ • ์ด๋ฒคํŠธ์—์„œ ํŠธ๋ฆฌ๊ฑฐ๊ฐ€ ๋˜๋ฉด, ๊ธฐ์กด์— ์‚ฌ์šฉํ•˜๋˜ Recon ๋„๊ตฌ๋ฅผ ์ด์šฉํ•ด์„œ ๋ถ„์„ํ•˜๊ณ , ๊ฒฐ๊ณผ๋ฅผ github์— ๋ฐ˜์˜ ๋ฐ slack์œผ๋กœ ์•Œ๋ ค์ฃผ๋Š” ๊ตฌ์กฐ๋ฅผ ๊ฐ€์ง‘๋‹ˆ๋‹ค.

Make item template

First of all, we will create one item for each Recon, so make one item to use as a template. ์šฐ์„  ๋งค๋ฒˆ Recon ๋งˆ๋‹ค ํ•˜๋‚˜์˜ item์„ ๋งŒ๋“ค์–ด์ค„๊ฑฐ๋ผ Template๋กœ ์‚ฌ์šฉํ•  item์„ ํ•˜๋‚˜ ๋งŒ๋“ค์–ด์ค๋‹ˆ๋‹ค.

Connect git repo

Connect to Git repo for integration of Recon results. Recon ๊ฒฐ๊ณผ์˜ ํ†ตํ•ฉ์„ ์œ„ํ•ด์„œ Git repo๋ฅผ ์—ฐ๊ฒฐํ•ด์ค๋‹ˆ๋‹ค.

Execute Shell

Then run the Recon tool. I think you can put the shell script according to the tool you are using. At this time, the important thing is to use the git publisher to reflect the results to git, but it is said that the -am option should be given, such as git commit -am 'msg'.

๊ทธ๋‹ค์Œ Recon ๋„๊ตฌ๋ฅผ ์‹คํ–‰ํ•ด์ค๋‹ˆ๋‹ค. ์—ฌ๋Ÿฌ๋ถ„๋“ค์ด ์‚ฌ์šฉํ•˜์‹œ๋Š” ๋„๊ตฌ์— ๋งž๊ฒŒ Shell script๋ฅผ ๋„ฃ์–ด์ฃผ์‹œ๋ฉด ๋  ๊ฒƒ ๊ฐ™์Šต๋‹ˆ๋‹ค. ์ด ๋•Œ ์ค‘์š”ํ•œ๊ฑด ๊ฒฐ๊ณผ๋ฅผ git์— ๋ฐ˜์˜ํ•˜๊ธฐ ์œ„ํ•ด์„œ git publisher๋ฅผ ์‚ฌ์šฉํ•˜๋Š”๋ฐ git commit -am 'msg' ๊ฐ™์ด -am ์˜ต์…˜์„ ์ค˜์•ผํ•œ๋‹ค๊ณ  ํ•˜๋„ค์š”.

Set Git Publisher and Slack Notifications in Jenkins

Finally, the result is reflected on github through the Git publisher, and a plugin is applied to notify with Slack. ๋งˆ์ง€๋ง‰์œผ๋กœ Git publisher๋ฅผ ํ†ตํ•ด ๊ฒฐ๊ณผ๋ฅผ github์— ๋ฐ˜์˜ํ•˜๊ณ , Slack์œผ๋กœ notify ์ค„ ์ˆ˜ ์žˆ๋„๋ก ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์ ์šฉํ•ด์ค๋‹ˆ๋‹ค.

Running and Result


Finish notify



Honestly, it was a project I did for fun, but it was nice that the result was more satisfying than I thought. I think continually integrating analytical data can be of great help in finding better results.

์†”์งํžˆ ์žฌ๋ฏธ์‚ผ์•„ ํ•ด๋ณธ ํ”„๋กœ์ ํŠธ์ธ๋ฐ, ์ƒ๊ฐ๋ณด๋‹ค ๊ฒฐ๊ณผ๊ฐ€ ๋งŒ์กฑ์Šค๋Ÿฌ์›Œ์„œ ์ข‹์•˜์Šต๋‹ˆ๋‹ค. ์ง€์†์ ์œผ๋กœ ๋ถ„์„ ๋ฐ์ดํ„ฐ๋ฅผ ํ†ตํ•ฉ์‹œํ‚จ๋‹ค๋Š”๊ฒŒ, ์กฐ๊ธˆ ๋” ๋‚˜์€ ๊ฒฐ๊ณผ๋ฅผ ์ฐพ๋Š”๋ฐ ํฐ ๋„์›€์ด ๋  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์ƒ๊ฐํ•ฉ๋‹ˆ๋‹ค.

Later 1dayโ€ฆ

I added parameter options and integrated them into one project. It can be used like a scanner. ๋‚˜์ค‘์—๋Š” ๋งค๊ฐœ๋ณ€์ˆ˜ ์˜ต์…˜์„ ์ถ”๊ฐ€ํ•˜๊ณ , ํ•œ๊ฐœ์˜ ํ”„๋กœ์ ํŠธ๋กœ ํ†ตํ•ฉ์‹œ์ผฐ์Šต๋‹ˆ๋‹ค. ์ด๋กœ์จ ์Šค์บ๋„ˆ์ฒ˜๋Ÿผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„ค์š”.


if [ ! -d bugbounty/$TARGET; ]; then
    mkdir bugbounty/$TARGET;
cd bugbounty/$TARGET;
export PATH=$PATH:/var/lib/jenkins/go/bin;
~/go/bin/D.E.V.I init;
touch s_target.txt
touch w_target.txt
if [ -n $STARGET ] ; then
  echo "$STARGET" > s_target.txt
if [ -n $WTARGET ] ; then
  echo "$WTARGET" > w_target.txt
~/go/bin/D.E.V.I recon;
git add --all;
git commit -am "update";

Later 2weekโ€ฆ

And two weeks later, I changed the structure to Pipeline using Jenkinsfile. (Because itโ€™s easier to control the entire flow with shell pipeline and groovy script than logic of go app)