José Manuel Ortega

NodeJS is one of the fastest growing platforms nowdays and from a security point of view is necessary to know all posibilities that the platform offers to developers.This is a talk that explains some of the most common problems in NodeJS applications and how using frequently used tools it is possible to exploit such vulnerabilities.Also I will show what are the main vulnerabilities we can found and how we can fix them in our applications.

These could be the talking points:

-Node.js security packages

I will comment how to protect express applications in terms of authentication, logging ,middleware and security best practices before put applications in production

-How to prevent OWASP TOP 10 in a NodeJS application In this point I will comment the OWASP NodeGoat project that provides an environment to learn OWASP Top 10 security risks. I will comment the main risks we can find in nodejs applications from a attacker perspective.

https://github.com/OWASP/NodeGoat

-Tools which will help to protect our node applications like NodeJSScan allow detecting vulnerabilities following some predefined rules

Security is important but not everyone cares about it until something bad happens. In this talk, I’ll speak about main tips for integrating Security into Containers.I will share my knowledge and experience and help people learn to focus more on Containers Security. In this talk I will review the state of the art of application security practices and talk about best security practices to create more secure containers. And we look at organizational, process, and technology innovations to secure applications in ways that incorporate, but go beyond, testing for vulnerabilities, by looking at what developers can do before checking in code and what application security looks like in production.

These could be the main talking points:

-How to Integrate security into iteration and pipeline application development.

Integrating security into the iteration and pipeline application development involves automating as many security tests as possible so that they run all other automated tests. These tests should be performed on every code commit, and even in the earliest stages of a software project.

-How to integrate preventive security controls into shared source code repositories and shared services.

Shared source code repositories allows anyone to discover and reuse the collective knowledge of the organization, not only for code, but also for toolchains, deployment pipeline and security. Security information should include mechanisms or tools for safeguarding applications and environments, such as specifc libraries for security support. Also, is important putting security artifacts into the version control system that Containers use for detecting vulnerablities in specific third party libraries.

-How to secure your development environments.

Is important ensure that all environments minimize security risk. This involves generating automated tests to ensure that all appropriate settings have been correctly applied for configuration hardening, database security, key lengths, and so on. It also involves using tests to scan environments using security vulnerablities scanner.I will show the main tools for detecting vulnerabilities within container images.

For developers, application logs are critical to figuring out what’s going on inside the apps we create. We tail them. We search them. We analyze and graph them.In this talk I will show Graylog as an open source log management tool, providing central storage, processing, and analysis of log messages powered by Java,MongoDB and ElasticSearch

These could be the talking points:

1.GrayLog architecture

The Graylog log server is based on Java and offers a means for combining several server nodes in a cluster for high availability and scalability. Graylog uses Elasticsearch as database for the log messages as well as MongoDB for application data.

2.Searching and analyzing: Graylog Web Interface

Graylog also has a web interface for searching and viewing Graylog messages. Filters can be applied and saved into logical “streams”, allowing you to look at a slice of your data.

3.Use case:Configure graylog in java projects with maven

As a standard for log events, Graylog promotes usage of the Graylog Extended Log Format (GELF) I will show a use case configuring graylog inside java project with the GELF appender.

4.Integrating GrayLog with LogStash

In order to create a full log solution it is suitable to combine Graylog with Logstash with a little modification of Logstash and a custom Graylog Plugin.

Footprinting is one of the most important techniques security auditing, since allows them gather information about the target we are analysing.

In the process to collect information about our target we can diferentiate two phases,the first one is where we obtain public information without interact with the objective and the second one is where we can use tools such as port scanning.

In the process to collect information about our target we can diferentiate two phases, the first one is the passive where we obtain public information about our target without interact with the objective and the second one is the phase where we can use tools such as port scanning or banner grabbing.

These could be the talking points:

1.Introduction to footprinting I will comment the main footprinting phases:

Passive Footprinting where we collect public information and building a map of the server or domain objective, without interacting directwith it.

Active Footprinting where there is an active target identification through and techniques such as port scanning, and different identifications of services, operating systems and server banners.

2.Footprinting tools

For applying footprinting techniques we can use tools for obtain domain information such as whois,apply inverse querys from DNS and name servers. Also we can use third services such as robtex and serversniff for obtain more information. We can use public information sources,between these tools we can highlight shodan,scans,zmap and censys

3.Port scanning with nmap

With nmap we can check ports open for a target ip or domain and with nmap scripts we can check vulnerabilities in open ports For example,if the mysql port is opened,check if the server has some vulnerability relationed with this service.I will show nmap scripts for checking this vulnerabilities.

The talk would aim about making an introduction to open source intelligence automation tools(OSINT) developed in Python, commenting the process we can follow to obtain, analyze and exploit public information in social networks and public servers.The final objective is obtain the maximum possible of knowledge in the context we are auditing.

The talking points could be:

-Introduction searching information from multiples sources with OSINT tools. -OSINT tools developed with python for extracting public information from servers and domains. -Advantages and limitations these tools from the user point of view. -Comment how these tools are developed and the main modules used in their development.

Some of the tools to comment are:

-Censys and Shodan Python API as search engine server information. -SpiderFoot and recon-ng as a tools for extracting information from multiple sources and automate the footprinting process. -the Harvester as Python script for extracting emails and hostnames in a particular domain. -Osrframework and Maltego OSINT visualisation tool -Libraries and modules for collecting information from Tor and ZeroNet networks -Tinfoleak and Tweepy as Python scripts for data extraction on twitter. -FullContact API for obtain social networks profiles associated with an email address.