Black Hat Bash: Bash Scripting for Hackers and Pentesters (Bonus: GraphQL and Drone hacking)

Key Takeaways

our goal with blackhead bash is to get somebody from zero shell scripting knowledge to I know how to put together scripts that can talk to each to one another you know pipe text from one to another or orchestrate tools to produce one result that is a compilation of multiple tools um and that's what our goal is in this book um along with the hacking stuff and and exploiting vulnerable services and so on and we wanted to write black hat bash to teach hackers how to live off of the land and for folks who may not know what living off the land is it's a type of technique for operating as a hacker within an environment that might be restricted that does not involve the use of tools because either you're in a restricted environment um or uh the tools themselves are not um not going to to to work within whatever environment you're you're in and you have to learn how to use the binaries that are on the actual uh endpoint itself and use bash to sort of glue all of this together into a sweet little automated script that will do things like reconnaissance lateral movement privilege escalation defense evasion and uh I think that's what sets apart um some of the the junior Hackers from some of the the great hackers are those who can really operate in a very limited environment uh with something like that specifically WordPress is interesting um because you know a plugin that can impact the core of word press is usually interesting vulnerability still Deni of service but uh it's very effective um but there are what's interesting about graph is that you have more than one way to Dos a server uh and take it down as I've said many times in the past if you want to learn to code I recommend that you start by learning python so many people that I've interviewed have also recommended that you start with python python python python python it would be python doesn't matter if you want to learn about AI or become an ethical hacker or a developer or a network engineer or what about a cyber security expert you need to learn python and a great way to start your programming journey is the programming with python course from brilliant this is a great course for both beginners as well as those who want to refresh their skills this course helps you become proficient in the world's most popular programming language which again is python your programming Journey starts with the basics like printing text to the screen and what I love about Brilliance course is that it's very interactive and shows you right from the beginning what happens when you introduce errors in your code of course then transitions into you writing your very first Python scripts you'll learn about numbers variables and type conversions in Python this sets the foundation for the coding challenges that come later in the course as you progress through the course you'll delve into Loops solving the Intriguing Fibonacci Challenge and navigate through conditionals with the collap challenge but if you're more creatively inclined you'll learn to draw in Python and turn your code into visual art Brilliance curriculum is designed to build your confidence and skills step by step you'll explore the power of bolt-in functions learn the secrets of for Loops delve into string functions substrings and The Versatile replace function each lesson is a building block that helps you become more proficient in Python by the end of your Learning Journey you'll be crafting custom functions utilizing the range function and enhancing your code with functions that use arguments this course is more than just learning the mechanics of python it helps you develop a passion for programming problem solving and Innovation you can sign up today at brilliant.org David Bumble and start your journey into the world of Python Programming don't just learn to code code to learn create and solve problems your future in programming begins now use the link below to sign up I really want to thank brilliant for providing not only fantastic courses but also for supporting my channel and helping me help you learn more about cyber security networking programming and AI hey everyone it's David Bumble back with two very special guests DV and Nick welcome hey David thank you so much for having us hey David thank you guys really excited to have you here you are busy writing this book so I've got like a pre-release black hat bash really excited about this this one I didn't know so much about black hat graphql this has been out for a while now but perhaps you guys can tell me you know writing books I'm sure it takes about 5 minutes right writing books is hard this is why I don't do it tell us about the journey or how how did it come about that you guys wrote These two books so so for me writing a book was always some kind of a goal that I wanted to achieve and I never really knew if I will ever be able to write one and about what there's like so many books on so many topics and I was always under the impression that writing a book requires like so much research and understanding of the topic and just that alone is hard then you have the actual writing which is another difficult aspect as well um and I always wanted to write a book to be honest and um I wasn't exactly sure on what specifically and both Nick and I we worked at a fintech company um that is heavily invested in graphql graft go an API technology like such like an alternative to rest apis um and we got a lot of exposure there from a security perspective to what graphql is how to defend it uh how can it be attacked as an example and at some point you know we developed some tools developed uh some TR um learning platforms for graphql and I thought at that point that you know we accumulated so much knowledge and and tools perhaps it's a good Baseline for writing a book and at the time there was no hacking book or any security book on graph gall all the graphql books were around like learning graphql uh for example full stack development with graphql um getting started with graphql things like that uh but nothing on security um you know and I I was like hey let's write a graphql security book at the time it was like an idea where we can write a book about attacking and defending graphql uh and I you know I pitched the idea to Nick hey you want to you know team up and write a book together uh we both never we've never done that before and we you know reached out to noarch with the idea uh we put together a proposal uh initially it was a book about like I said attacking and defending graph and then after some conversations with no starch uh they wanted to focus the book on the pentesting side um and then it became good choice well done both sorry and then it became uh you know initially it was I think offensive graph or something like that and then he changed to blackhead graph qall when we started we realized that we're going to be focusing on on the red team aspect it um and you know we put together a good prop proposal um which uh served as the the blueprint for the actual book eventually um and we got the contract and started writing I love it I mean I was going to say we we're talking offline what I really love about both your books and um just for everyone who's watching we're going to cover bash and grath but this is the lab for bash I love what you guys have done it's really practical right I love that style of learning and Nick you were telling telling me Offline that that's the kind of way you learn I think yeah yeah for sure um taking thingsart and figuring out how it works I think that's the essence of of true hacking and in both books black hack fql and black hat bash we've curated a lab environment that's intentionally vulnerable with uh Dam a vulnerable graphql application we've built in a number of attack scenarios and walk the users through ways in which they can actually penetrate into the API and uh steal information from from from the API cause it to crash and a number of other different attack scenarios with black hat bash the story of how we we sort of came across uh writing right this book is in the midst of writing black ey graphql we get an email while we're at the sector uh Toronto security conference and do and I are sitting right next to each other and it's it's an email from noart saying hey do you guys know of anyone who'd be interested in writing a hacking book on about bash and Bash scripting and DOL and I just looked at each other and we said we got this let's let's put in a proposal and uh and then we got the we got the green light to to write the black half bash book and we wanted to take the exact same approach we wanted to give folks really Hands-On uh hacking environment uh based out of doctor um where we've got two different networks sort of an internal Network and then more of like a publicly exposed Network the lab environment is based off of like a an acne hosting company they've got like some of their uh hosting customer websites that you can try to break into using using some of the bash techniques that we describ in the book and then from there laterally move into some of the more internal juicy parts of this of this hosting company I love it I mean it's I think for a lot of people who want to study it's much more fun to do the offensive side so I'm glad that that's what you focused on rather than defensive I mean if you can see the problems then you can then it like makes you wake up to you know why it needs to be protected right yeah 100% uh and I think uh the other things that we want to sort of talk about is when it comes to offensive security uh we find that a lot of hackers these days are very tool Centric they like to bring their tools everywhere they go and some of these tools are very large they're very loud they're very clunky and we really wanted to write black hat bash to teach hackers how to live off of the land and for folks who may not know what living off the land is it's a type of technique for operating as a hacker within an environment that might be restricted that does not involve the use of tools because either you're in a restricted environment um or uh the tools themselves are not U not going to to to work within whatever environment you're you're in and you have to learn how to use the binaries that are on the actual uh endpoint itself and use bash to sort of glue all of this together into a sweet little automated script that will do things like reconnaissance lateral movement privilege escalation defense evasion and uh I think that's what sets a part um uh some of the the junior Hackers from some of the the great hackers are those who can really operate in a very limited environment uh with something like bash I really want to get into the book but before we do that can you tell us more about the experience of writing the book yeah for me there are a couple of challenges with writing a book you don't know who's going to be who's going to be reading it you have people who are just starting you know in the field you have season developers season engineers in General Security Engineers so you kind of have to tailor the content to all of them um which is a very difficult task and you also have to when you build a lab you have to keep in mind that you know you may have people that have like you know slower computers and you want to make sure that they're also included and can actually uh participate in in building that lab and and tailor the lab in a way or build a lab in a way that doesn't break um Technologies change uh tools change installation uh procedures change um so for us to build something that is going to have a pretty long life is something that we had to you know design and keep that in mind um you know from building the lab automatically to testing it to reporting it to us if something breaks in in in the process just like any software development uh process um basically needs to be so so writing also is as a is challenging in in the sense that you have to keep in mind that when tools change some some tools may just be may just disappear for example from GitHub we we had that case we had a tool that just was gone uh I think it was walizer or something a well-known tool actually just disappeared from GitHub and and we relied on it for certain parts of the book not not a big chunk of the book so it was we could easily swap it um but that happens as well so there's a lot of unpredictable things that happen that are outside of your control um another thing that is important when writing a book is writing a book that will not um go out of date quickly um tools change you know especially technical technical books um get outdated or become outdated very very quickly um yeah I think with bash it's a little different because bash has been around around for such a long time and it hasn't really changed that much um but the tools that we use there um you know they can change potentially um so we had to rely on tools that are you know pretty mature have been around for a while as well as more like recent tools we because we don't want to only introduce tools that have been around for a while right um yeah the the interesting thing about this book and I was actually surprised when noar reached out to us about this book because I I know of a lot of bash books but there was as far as I know there are no there there's maybe one book from packed I believe pack publishing that is more on the offensive side using bash but it's pretty Limited and there aren't many security oriented bash programming books um and that actually surprised me um and and so it was fun to be you know to have that opportunity to write such a book and be have that be part of the black hat series of books which I actually really like like black hat Python and the black hat go I always admired that those kinds of books um and being able to introduce two more to the to this series I think is a is a great opportunity definitely feeling blessed but yeah I mean that we we had to build a lab that lasts for a while everybody can run doesn't require a lot of resources not overly complex um so things don't go wrong and you know at the end of the day people when you build a lab people are going to run into problems so we also wanted to automate that part as as efficiently as possible so people can get up and running quickly although we do encourage people to install the lab step by step so they can they actually what they're doing or get a get insight into what the lab consists of um and that's also how they can practice their bash but yeah it's it's a process it's it's definitely a process and just like any book you'll have people that are going to be satisfied with it some people may not necessarily be satisfied with it you you know people have different opinions but at the end of the day I uh I think our goal with black hat bash is to get somebody from zero shell scripting knowledge to I know how to put together scripts that can talk talk to each to one another you know pipe text from one to another or orchestrate tools to produce one result that is a compilation of multiple tools um and that's what our goal is in this book um along with the hacking stuff and and exploiting vulnerable services and so on I think another thing that uh is really important for for folks who are looking at writing a book themselves is working working with with the right team the right publisher yeah do and I have had the utmost honor to have Cory ball author of hacking apis be our technical editor for black hat graphql uh Corey is an absolute rock star and helped us really put quite the uh the book out there for for black hat graphql and for black hat bash we are working with Casey dony a a Toronto cyber security researcher and Legend and he has really helped helped us push the uh the lab to be as tight and as crisp as possible for for our readers and our and our users so um yeah working with the right technical editors and also co-authors and Publishers these are all things that really uh folks need to take into consideration if they're looking at writing writing a book based off of their own research I remember when we when I reached out to um Corey so the the the funny thing the funny story about Cory is that before we even had a contract uh for black graphql uh Corey released his book hacking apis and hacking apis I think one of the last chapters covers grafal um and he uses the D vulnerable graph application as part of the lab and he posted on LinkedIn hey you know my book is now out there um and I commented there like hey congratulations and he put a comment there totally not knowing that we're were talking to no star at the same time I will leave the graph hacking book hacking book to you guys and it was funny because it was I think those days were just you know doing the the entire like contract work with noarch to actually produce that book and he didn't know so it's funny looking at looking you know kind of thinking about it uh and I remember that we wanted Corey to do the technical review and he told me something along the lines of like I'm not going to go easy on you so my goal is to produce the best hacking book not the one that goes out the fastest to the market and I'm like oh man I'm going he's going to tear us apart so uh but he was he was great um and we're able to produce that book and Corey really helped his his uh experience authoring a book was very good for us um again a book that discusses apis in general there there couldn't be a better person to do that technical review for us other than Corey um so that was a funny story with Corey I love that Nick did you want to say more I you guys could just keep on talking I was I'm going to throw questions at you uh no no I think I think when it comes to yeah writing writing a book The the team is really you know really important and then like do of and I had a lot of like back and forth where we really want to continue to raise the bar remember you know uh graph has a lot of different elements to it and uh there's this one sort of part of like subscriptions you know sort of like the third you know Core group of operations within within graphql that's really not talked about or used um but but uh I was talking to like we really need to build in some like subscription support with with dvga and and talk about it in the book and do was like you know what that that's that's absolutely right like this would not be the graphql hacking book if we didn't include the uh uh subscriptions element so I think being able to push each other and really U put out the best possible effort on on a on a hacking book is is also super super important having someone like that's a good friend or a colleague or you know co-researcher is is is a true honor to work on on a Timeless piece not it's a book I love it I mean the nose starch books are fantastic they're great hacking books um I'm so glad that they you know they have this whole part of like proper hacking books to help people learn because some people you know you learn from YouTube or you learn from videos but I personally love reading books and um you know the books are fantastic you know it's funny I before we before I wrote the book I always told myself like I have like imposter syndrome I always think I'm not good enough and I'm like if I ever write a book and I actually manage to like release it I that will take that whole impostor Synder away no no no it actually gets worse it doesn't get better so for for those who are uh listening um it's okay to have imposter syndrome it actually makes you better but it's not going to go away it's part of the it's part of the deal we didn't talk about your experience let's let's raise it here because how long you guys been doing this for well I'm mean I'm in this space for like 14 years I would say 15 years at this point um graph just recent just more recent years three years um but bash has been probably one of the first things I've learned uh when I started how long you for myself um yeah I've been been hacking for for over a decade some of the things that uh that I have been uh really dabbling in is more of the physical lockpicking smart building network wireless and uh just recently getting into API hacking um as part of like graphql in fact my exposure to graphql was as as Joel mentioned really limited before we really started to adopt it as part of the the fintech that we both worked at and uh I'd say one of the best ways to learn a technology is to agree to write a book about it that's a really strong forcing function to get you to say all right you know what let's let's roll up our sleeves and let's write a book as we learn and you know some of the some of the chapters like uh the the graph attack surface going into all the different nuances of the the type uh the types and the language inside of graphql you're really going into how we've learned and uncovered all the n- greeden details about the graphql spec and I've put that right there on on on paper for for everyone to to review and when you take this sort of really almost like methodological approach to writing a book you're also evaluating the technology itself from all these different angles so we've broken out the book into into 10 different chapters and uh the chapter around authentication and authorization bypasses that particular chapter as we were writing it we came up with the with the tool crack ql as a result of literally learning about how implementations of graphql either get it right or get it wrong when it comes to implementing authentication and authorization and crackl just sort of came out of the the spur of us writing the book where we found a a way to use Alias batching as a way to send a whole bunch of requests to a graphql API where we can do things like stuffing OTP tokens or stuffing username and and password combinations with just one HTTP request so you can imagine you know how powerful a tool like that that is for for for pentesters yeah I think that as you write a book The the level of depth that folks expect you to go into when when you agree to to write a book almost forces you to really look under every single Rock nook and cranny for vulnerability or a tool that will be really insightful for a penetration tester we really wanted the book I know Dov is a different reader than I am I'm more of a reference type reader so I will go to a chapter when I need it as I need it and Dove is more of like a cover to cover type reader and so we we we hope that both books will satisfy both types of types of I also say that I think uh the nice thing and interesting thing about graph space in general is it was untapped at the time that we started writing the book if you look at like offensive Security in general there's like tool there are tools for everything multiple tools for everything for pretty much every aspect uh Port scanning like you know there's dozens of of portan tools you know web scraping things like that um and in graphql there weren't tools specifically for graphql and some tools actually carry over or like transfer really well from like rest testing to graph but other tools not so much graph has a very unique way of communicating between a client and a server so you have to make sure that the tools support that um and I remember uh some person reached out to me on LinkedIn asking me hey I have this graph Q all is is there a way to know what graphql server implementation is behind a graphql API I'm like no there's no possible there's no way to know that I mean it's just an API it will return whatever comes back and that's it how will you know what's running behind it and then I was like what if there is a way to know what's what technology is actually running the the graph qall server and there's a web application firewall fingerprinting tool called Waf wolf which basically sends malicious payloads at web application firewalls looks at the responses and determines which web application F wall is behind that that we and I was like maybe that could actually translate to graphql and it actually did we developed a tool called graph wolf that's cool and graph wolf sends like a mix of benign and not benign um queries at a graph API and based on the responses it will be able to determine if it's like a Java graphql or a python graphql or a rust graphql um and that was actually quite nice because there wasn't a way to actually fingerprint graphical apis at the time uh so having that ability to write a book but also develop new tools that that don't exist didn't exist at the time was a a really great combination and experience because we were able to not just contribute the book as a learning resource but the actual offensive security tools so most of the tools in the book were actually written by us um and a bunch of others that were not not like nmap for example um so that was a really cool experience in my opinion has this opened up more doors for you I mean your visibility in the community has been raised a lot by what writing these books I would say so yeah especially companies that have started uh developing like graph qall tools uh either came for like a to consult with uh on like security matters or even like meetups that wanted us to come and and talk uh on on the graph security topic so short answer is yes one of the best things um that i' I've personally experienced after after writing the book are is having you know bug Bounty researchers or just Junior hackers reach out and say like oh my God this book like paid for itself and some thank you so much for for for writing a book that sort of helped me get a bunch of bounties on on hacker one and Bug crowd it other platforms and so getting getting just like one person was really like one of the number one goals of like writing a book is just helping one person but to see the the tremendous amount of uh support and love I think trip wire recently did a a book club review on the book and uh they seem to really like it and uh they're excited for for the second one black hat bash um yeah we just want to we we both do and I firmly believe that the more hackers that you have in a community the safer those digital systems are going to be um and so when we can really promotee a a hacker mindset through through our books we know that inevitably that's going to trickle down into more secure systems because at the end of the day hackers are are the immunity to a lot of these these problems that we have so guys graphql is not as well known as bash I think for a lot of people out there like who developed this and you cover this stuff in the in in in the introduction to the book but you know just for for everyone who's watching you know who developed it why was it developed why do I care basically uh graphql what is it who made it so graphql is a query language that was originally developed by Facebook and uh you it's a carea language primarily for for apis and most folks are familiar with like soap or rest based uh API Technologies and what graph was developed for was primarily to solve the problem with under fetching and over fetching with with like rest apis and that's when you've got multiple different end points and you want to structure a UI element on your front ends and maybe you have to make a couple of requests in order to get the the user profiles and the location information or even some of the pet information with rest you have to make maybe three or four calls and some of the API endpoints might return a lot more data than you actually need whereas with graphql you can just make one request to the graphql endpoint and structure your query in a way that gives you all the information that you want the way you want it and with one request you get everything that you need populating information about the user the pets or the locational information that you need for your UI one of the things that I also want to talk about is how graphql has put a lot of power in the hands of the client or the API consumer and this amount of flexibility and enablement is really great for developers especially like front-end developers looking to interact with an API that's why a lot of development shops and a lot of big companies like atlassian GitHub and PayPal have all been really adopting graphql recently because it's helped speed up a lot of the performance and some of the development time for interacting with their apis but this power that graph gives to its consumers and its clients are really what leads to a lot of these security weaknesses and downfalls and that's what the book really talks about in in detail are all the different ways you can structure a client or request to an API to cause Havoc at that API server level okay I'll just say that some of the design decisions behind how graph queries a server uh really introduces a lot of security issues and new things that we haven't dealt with before there's like a single endpoint to quore graphql server um there's no like you know API V1 user or API V1 accounts or something like that it's all typically a single endpoint and the intent of the client is all based in on the payload that is sent which changes a lot of things uh for example application firewalls like rate limiting and things like that don't really typically look at at at these types of things um they tend to look at like the for example the method the HTP method that you use uh if it's a get maybe somebody's just requesting data if it's a post maybe somebody's you know updating data or adding data um and graphql changes that perspective uh so it's like mostly post and a single endpoint so how do you know what a client is actually doing if you look at access logs as an example all you will see is like a bunch of posts and the the path is going to be SLG graphql so how do you know what the client is doing so you have to really inspect the actual payload that's coming in to know what the client is actually trying to do um and Nick mentioned that you can actually request or built a single HP request containing multiple ques that's also not something that is very resty as an example so a lot of these fundamental changes really introduces new security gaps in tools not just offensive tools but also defensive tools um so that really is a big difference in between like gr and graphql yeah one other thing that I wanted to jump in and and share as well which is what do and I were able to do a lot of research into is that there's many different implementations of graphql so Facebook wrote the specification on uh you know how a graphql API should work and then they also released uh the graphql JS sort of uh implementation Library as as a part of it but there's no you know particular language you don't have to use JavaScript to write a graphql API server they just wrote a specification that says if you follow this then you've pretty much built a graphql API well as a part of one of uh the projects that we talked about in the book the graphql threat Matrix we've actually stack pranked all the different graphql implementations and how good or bad they are in regards to some of their um compliance with the spec and what validations they may have enabled which ones they don't and this can lead to a lot of really interesting attack vectors as well so some folks follow the spec very closely others don't and that's something that we also talk about in the book is uh some of those implementation issues that that you might uncover uh when you do sniff out and fingerprint a particular graphql server it was developed like to by in Facebook by two in was it in your book you said 2012 right and then 20 was it 2015 was released as open source so is it only in the last few years that this has really taken off for I would say starting from 2000 I would say 2020 I started to see more of it and we started getting more pentesters coming and asking questions about graphql and it was you know for pentest it's really bizarre to see a graphical API because it's not anything it's not like anything they've ever seen before um and some people are you know kind of thrown off by it because it's new and they have no idea what they're seeing um which was interesting because when we talk to pentesters they do say hey yeah we're running to more graphql apis for example Hecker one is all graphql for the most part whatever populistic di is mostly graphql uh GitHub gitlab um Shopify a lot of well-known you know platforms uh Magento for example as well um so you started seeing it more and more and typically in the industry when you see the big players doing something or choosing a specific technology you see a lot of other companies starting to wonder oh maybe they know something that we don't maybe we should pick that up and and it will make us better I'm sure you know um so we do see that more and more I'm not entirely sure that it's going to be as popular as the rest though I do think that it has specific use cases but it also has a lot of challenges I'm not sure that it's going to be you know become suddenly more popular but you will see it more and more so I'm just thinking for someone who wants to learn this do they have to read Cory's book first hacking apis or can they go straight to this is it better you know what's the PA no I don't think that they need to read um uh hacking apis however it would be a great uh book to to read to get a good foundational understanding of how apis work and the different tools that are available but we wrote a black hat graphql in a way that really takes someone from zero knowledge of what graphql is all the way up to full expert mode where you can fingerprint a graphql server and find particular weaknesses and know exactly how graphql works and how to structure its query as a result of it so no need to uh to go back but I will say that it's a great sort of foundational um resource for for folks who really want to learn more about API hacking in general he has the book that Cory wrote I highly recommend this book and I've got links below where I interviewed Cory as well um the one thing I did notice when I read your book is that you guys do refer to the differences between graphql and rest so I'm assuming you have to at least have some kind of foundational knowledge about rest before you get you right I think it makes sense to have some rest knowledge um I think picking up graph kill as the first API uh to learn I wouldn't necessarily do that I think as a person that is starting you want to learn things that are very known and popular so it transfers as well to whatever you're trying to do uh if it's a job that you want to you know you want to find it's very likely that they will use rest over graph unless you're looking at jobs at you know I don't know Shopify or gitlab or something uh but I do think that Cory's book starting with Cory's book makes sense you don't have to but it does make sense um it will also really highlight the differences between attacking a rest API versus attacking and graphql API we do give a lot of examples and try to compare the two uh in the book so but I think it it it will make it easier for the reader if they come with some rest API knowledge but from like a jobs point of view there's a lot of lot of opportunities right because apis are everywhere A lot of them are vulnerable I mean as if if you were starting today would you like seriously look at apis as a as a place to start in pen testing absolutely yes um 100% I think every single mod modern uh technology out there uses some form of an API either directly or indirectly and and uh as Corey sort of mentions uh apis are are the sort of the the crown jewels of of an organization it's where all the um the data lives it's where all the core functionality tends to to to also live as well for for some of these web applications and SAS providers so apis are probably one of the best places for a junior penetration tester or bug Bounty researcher to really uh hone in their craft and figure out how an API works what to expect what the status codes uh mean you know versus a 200 or or 4 43 um how to authenticate how to authorize uh to to an API how to use things like Postman and I know as part of uh your your session uh last time with with Corey Corey went through a fantastic demo of how to break into the uh gotta get you guys back for demos yeah we're we're definitely going to do a I think doing a demo of the dam vulnerable graph chol application and I think you know showing off like how with a single request you can cause an entire server to crash will will really resonate with folks about like the power that they wield by being an API client uh with graphql so I think I think it would be a really great great demo D live I saw one of your videos on YouTube where you were demonstrating it's quite an older one I think but where you're using a WordPress site and you were just like nesting queries or something and it just it like whacked killed Sequel and word it's it's actually like a specifically WordPress is interesting um because you know a plug-in that can impact the core of Wordpress is usually interesting vulnerability still Deni of service but uh it's very effective um but there are what's interesting about graph G is that you have more than one way to Dos a server uh and take it down uh because the queries that you compose can be very complex that translates to very complex SQL queries so if you you know if you're running on a single server or something and you don't have a lot of resources it's going to be very easy to take it down um it's interesting and funny because when Nick and I were were in the midst of writing a book we also had like a kind of a bug Bounty session together to try and see how many like vulnerable graph kill servers out there to a particular vulnerability that we found and is covered in the book um and I think that funded half of Nick's wedding or something that was that was a fun experiment so so the the vulnerability that that that do have mentioned uh is uh directive overloading and it it in fact is a zero day vulnerability that that that that we had found in the graph CU specification itself this is where you append a lot of directives which is a fancy way for another sort of um request that you send to a graphql API to modify how the graphql server responds to it so for instance if I send in a request like uh get me my full name and uh full name comes back and uh it's sort of Nick Alex but capital n and a capital A for first and last name but if I wanted to have the server respond and have everything capitalized um sometimes with rest you would have to do that on the front end to capitalize all the data that you get back from the API but you can actually append a directive that says like capitalize and put that next to like the full name field and then you get back from the server in all caps Nick Alex now this concept of a directive um you can append a lot of those directives over and over and over and over and over again on a particular field and the way that graphql handles multiple different directives isn't very graceful and some of the uh controls uh you know rate limiting controls that that uh that graph K puts in place uh don't actually prevent and attack like this from taking down a server so this one particular zero day vulnerability that that we found in the graphql spec impacts every single implementation of graphql so we just had to go out there and and do a couple of bug Dy Hunts on on folks who are using remember when we wanted to dis disclose this um we had some interesting conversations with maintainers of different like implementations of graphql and some of them were like that's on the user to that's on them to protect themselves uh as opposed to like let's fix it on the server side um which was an interesting take um and a lot of the graph vulnerabilities um are not something that you typically get you would get protections for on the server side it would be expected that you run some kind of a w or Gateway that will protect you from that um but you know for a small shop that is using graph they're not going to you know bother with it but it was an interesting conversation to have um where they're like that's on the client that's not on us um and in fact like the actual graph specification which is sort of an RFC doesn't even mention security because security is not part of what it's what it's about it's more like if you want to build a graphql server these are the things you want to validate for these are the things you want to support there's no like how do you protect against certain things um which is which is interesting in general but yeah I mean it was a great great experience overall um and we're happy to start a new new chapter uh with the blackhead bash now um which is completely different to graph qall it's not a niche and it's has been around for so long as opposed to graph all it's a niche and it's new um so that that's definitely a a new new experience but let me just let me see if I got this right you guys started writing the book during the writing of the book you discovered a zero day you use bug bounty to fund your wedding neck or part of your wedding is that right yep that's correct so what what a good reason to write a book right yep weddings are definitely not cheap I love that so I mean I think this so you know you guys are talking about this it makes me worry that um there there's a lot of vulnerabilities in graphql but I mean I'm assuming that the advantages of it outweighs the disadvantages yes yes I think I think that for the most part if you run graph G at scale it's going to be very hard to cause the of service for example which is probably if not the most popular second most popular vulnerability in graphql authorization being probably the first the authorization part is actually interesting it's you can Implement authorization in many different ways um and since graphs can be very complex um the authorization can get complex as well so I wouldn't say that the security issues are so bad that you shouldn't use it I'm just I think that you should just be aware that denal service and authorization are two very very common problems um you should just make sure that you know how to deal with them we've worked like like I said we worked at a f company and they were all over it they were super invested in it um everybody had to learn it um and they have no as far as I know no plans to move away from it uh but typically you would have it's not only graph or rest sometimes they work together it's very common like design pattern to have a graphql server or like a graphql API being the first kind of interface and it's actually um interacting with rest apis internally so it's a graph and combination of rest apis so it's also common to have to have like a hybrid model of graph and rest together but I love what you I mean what you guys are saying because if I'm a pentester um or I'm doing bug Bonny it seems to be a lot of opportunities here yes uh especially uh since pentesters see it and they're not really sure what they're looking at when they first see like a graphical API um I do think that there is still a lot of uh uncovered vulnerabilities in the in the um bug Bounty space in the bug Bounty pro programs once you find a niche in general in Buck Bounty and you dive into it there you increase your chances to find vulnerabilities as a opposed to doing like mile wide inch deep type of scanning and attacks uh once you dive into a particular area you will have more chances because most people are not going to go that deep um and graph is is is an example of that I think and and we saw that uh once we found something that is wasn't super known wasn't known at all actually we then kind of did this sweep across all like the the common bug boundy programs that run graph QR and we started reporting it uh that night and you know for example uh Adobe which I think acquired Magento Magento is an e-commerce platform P us for example GitHub betas um I think there's a bunch ofas um even I'm not sure if jir and Confluence use uh graphql but atlassian in general use graphql I think they have parts of in their e ecosystem that uses graphql um and I think a bunch of other companies also paid some you know denal service is actually a one of those vulnerability categories that is not paid high amount of Bounties in general in bu Bounty programs but since in graph Gill it's so easy to take a server down or at least exhaust it yeah maybe it's it's more severe than just like a rest type of Deni of service I love that because I mean I was just going to ask you guys what are the two places to focus and if I remember correctly it would be Deni of service and authentication right those are the authorization yeah authorization yeah mainly because of how the graph in graphql Works you've got different nodes and edges um a node is sort of similar to like a property or an object and an edge is a relationship and so let's say you have access to um you know query all of the pets in a pet store API uh but you can't really query you know the the users you can maybe only query your your own user account the way that the relationship between pets and and and users in the platform might be related to a point where a user can have a bunch of pets associated with them but if you have access to VI all the pets you can maybe even run a query for who is person's owner and indirectly get access to that user's um uh data within the graphql API so there's uh there's definitely a lot of authorization issues now I think graphql um recommends that authentication and authorization not be dealt within the graphql layer they they sort of mention do authentication before graphql and then do authorization at your business logic layer but uh not not a lot of uh folks will will sort of read that understand it or or implement it properly and they'll do authentication and authorization within your graphql layer and so if you're a bug Bounty researcher or pen tester and you see things like authentication or authorization logic living within the graphql layer itself um pay close attention to it because there's probably going to be some issues there so I wanted to ask you if I read read this book as let's say I'm interested now and I read this book I think you've mentioned it Nick I the people who have read this book and then gone out there have made much more money the the RO ey on this has been amazing right because um you know if I spend the time I I study this there's a lot of opportunities to make money from this right yes yeah 100% I think the combination of the book being really handson it teaches you what Gra graphql is from Zero to Hero and the fact that graphql security isn't well understood or adopted uh currently uh in the industry and a lot of organizations are adopting graphql to be sort of their primary API interface that combination uh should provide folks with an amazing amount of bounties uh if they're able to find um graphql apis as a part of some of their bug Bounty programs that they're a part of I'm very confident that uh this book will will help you find some and bounties yeah I also I'll just mention that uh I think a Defcon uh a pretty young guy reached out to us and I think uh talked about how the book helped him get a serious Bounty I'm not sure if I remember the amount maybe Nick you know but um he was really happy because that book gave him the edge over others to find that vulnerability I think it was part of like um one of those hacker one type of uh um hacking sessions I'm not sure Nick will probably be able to correct me on that but he I he reached out to us because it made him a lot of money yeah so he he goes by uh zerox loopin on on X when he found out that we were at Defcon he's like Nick we I I just need to meet you I need you to get to sign sign the book for me because uh I think it was like you know over $50,000 that that he was able to to get in Bounties in just a short period of time just by looking at at the book and and using it uh as a part of his his bug bounties that that he's a part of he's also taken a step forward I think he's also doing some additional graphql security research and I think that's giving him some additional bounties as well uh so shout out to to Lupin for continuing to do a huge investment in graph F security research and by all means like the book is probably not uh going to find all the different vulnerabilities and zero days and ways for you to break into a graph F API but it should give you a good Baseline uh foundation for the common vulnerabilities you would find how to use and interact with graph and from there you could potentially find a couple of other zero days that that definitely impact the spec and uh make a pretty pretty coin after that I'm amazed you guys are talking like about zero days as if they common because I think in other Technologies it's very hard right yeah I mean the more eyes on a specific technology the more likely it's going to be robust but there are exceptions to it I mean in bash a vulnerability was found and Bash is I don't know maybe older than me at this point yeah um probably older than me so the fact that they lot of eyes on technology does not mean necessarily that there's not going to be loopholes there um shell shock in 2014 for example so I mean it just increases the chances and I think since graph is a niche technology um there's just higher chances of of you finding something there we do see um pentesting firms that specialize in like Advanced web application pentesting using the book to provide more value to their customers um because they see that more of their customers are running graphql and their knowledge is more focused on rest we've seen that in with many uh pentesting firms including ones that are based out of Toronto for example um so that was an interesting one as well uh I also heard of a firm that uses the the book as a giveaway for candidates who interview with them uh and and they need to go through some kind of interview lab they give that as a as a as a gift for somebody who's interviewing with them as a way to you know say thank you for being part of the process um so we've seen a different use of the book which is kind of fun maybe the like a little little bit of advice for for folks uh looking to find like a loophole or zero day in graphql or any technology really and you might have like limited knowledge in coding or or hacking is to just simply read some of these specification files or rfc's and this will just allow you to a get a good understanding of how the technology works and as you read these specification files or rfc's always keep in the back of your mind questions of like what if so specification says Hey ensure that uh fragments uh can't uh relate to each other or cannot uh reference one another um because if you do you can get into a fragment cycle Doos attack and if you ask the question okay well what if they could and what if some implementations don't actually check for that that's exactly how you would find cve as you sort of check certain implementations of of graphql I think that's a really great way of finding novel vulnerabilities in Technologies is just reference the specification read through it I know it might be a really boring read but you can find some really good golden gems and Nuggets in there um that could really be a huge return on investment I think I think the key um key sentenced from what Nick said here is if you say tell if you say to yourself what if this will work will typically challenge what you're trying to do and challenge the application and you may be surprised that what you thought may not work will actually work um so I think that's the key to pen testing and research in general just ask yourself what if what I'll TR try to do here will actually end up working for me because you always assume that somebody has tested this you know it's right there so if I if I operate in like a program of like GitHub and there's like a thousand researchers that spoke you know poke holes in gitlab or GitHub every every month maybe more you assume that the things that are just popping out right away people somebody may have tested it already so I'm just not going to bother and move on to the next thing so that's a lot of like vulnerabilities were found that way like the the things that you would expect somebody to would have picked up already um nobody actually looked at it or maybe it it has changed at some point and it was tested yesterday was fine a change was made and now the the that functionality is no longer working correctly uh that's also uh part of pentesting right The Continuous pentesting aspect where you know things change people you know companies deploy changes multiple times a day so whatever was tested yesterday May no longer be relevant today so that automation piece is also critical um if you can automate your tests against against programs you already have an edge over other people that don't necessarily know how to automate things and they mostly rely on manual tests um which we're hoping that bash will help people put together tools uh in order to scan things um without knowing a lot of programming in general just knowing basic like scripting and how to kind of tie tools together to produce the desired result yeah um maybe like one other thing like piece of advice for uh bug Bounty researchers or pentesters looking to really make a splash is after you've found sort of like uh this juicy nugget of a vulnerability uh as as do mentioned like automating the detection piece in the continuous testing is like really great to really scale your your your Bounty returns and so looking at uh tools like nuclei from from Project Discovery if you can write a nuclei template that you can use to sort of scan all of the bug Bounty uh programs that you're a part of that's one really great way to uh to figure out which uh uh bounties are potentially out there for uh for reward by just having one little yaml file that you develop that's been custom researched and developed by yourself um that's that's a really great way to like maximize your your return rather than having to manually go and and and run these checks um and that's a that's also a great segue do live over to the blackout B piece I just had to mention nuclei because it's such a great tool for for for codifying that protection fees you guys have mentioned the labs in the books and I mean both of them are very practical allow you to to do Labs question is always what do I need to run the labs do I need a very powerful laptop do how how the lab set up is it a VM um Docker how does it work yeah so for the black ey graphql one is actually very simple um it's a you can run it on Docker or you can run it just like a python like any python application on your your machine we packaged it in a way that is very easy to deploy you don't really have to do a whole lot you just need to have Docker and you run the single command and you know it pull the image and it deploys it and the application is then running what's interest what's nice about uh the Dem vulnerable graph application is that if you managed to create some kind of a bug there and it's no longer working it has a like a built-in mechanism to restore itself like restore to last known good type of thing uh and that's really helpful because when you start injecting things you may kind of mess up the UI in certain way ways or you may put like a JavaScript there that will execute like crossy scripting or like alert boxes all the time you can just click on restore and it will restore everything back uh to the original state so that was really helpful in the so you don't need a like a a powerful machine for this at all at all especially the graph qall one uh in the black hat bash book we have we wanted to create uh as Nick mentioned like a uh almost like a network of a hosting company how would a hosting company networks look like they probably have some databases they probably have some applications they may have some monitoring tools maybe some caching mechanisms like reddis um but at the same time we had to sort of balance that with what if we have somebody with a very old laptop who wants to run this so we had to keep it pretty lean so when you deploy the lab um and you follow the book you have two paths essentially you can install it you know command by command manually so you can kind of get experience how to run those commands see what what's going to be installed try for yourself and then you have the fast track or the shortcut where you just run a script that does all the provisioning for you you don't need a powerful machine for that either we're running I think seven containers um and those seven containers are pretty slim in general um you just need a fair internet connection so you can do that timely and not take forever to download all these images but in general in terms of memory and disk not so much um we also wanted to simplify the complexity there as much as possible because things tend to break operating systems change um packages are removed by default sometimes uh default packages that you expect to have suddenly are not no longer there so we did want to rely on technologies that are less likely to change over time so you don't need a powerful machine for either of them um we do recommend to run everything in a VM as opposed to your own machine yeah we typically rely on Cali is like the base operating system I was going to say I was going to you've got call both them right we typically recommend to run Cali just because it's like well known and you can use other tools there maybe that you feel like during uh your experiments with the book uh but you can Mo most certainly run it on your computer as well um so your base operating system would be some VM it could be obuntu could be Debian Cali whatever and then we will deploy or help you deploy the lab uh using Docker compose with a bunch of containers um and the the book both books will actually guide you exactly you know how to open the browser to open up the the the specific machines that you're going to be attacking which IP addresses um what those IP addresses are what services are running there so that the lab really guides you through the lab the structure of it how are the two networks kind of relate to one another we wanted to give the feel that you're testing a company or like a hosting company from like an external perspective and then you have like internal machines that are not really exposed to you until you actually take over one of those machines that are publicly facing essentially um so we wanted to do all of that with as little complexity as possible one of the I'm assuming one of the reasons you're using Docker is these are self-contained containers so if something does get removed from like the Ki repository it doesn't affect the lab that I'm using correct yes we also you know as a as a kind of a safety mechanism we have a pipeline that actually tests our lab uh every few days if something breaks we will know um the book uses the gitlab reposit sorry GitHub repository a public repositories if something does break we will always be able to fix it so we will try to maintain that lab for as long as possible um but inevitably Technologies change things change books don't last years um but we did try our best to make sure that they do last for a little while I'm glad you've done that because the biggest one of the biggest hurdles I think for a lot of people studying is if the lab doesn't work and it's such a struggle so I mean I'm glad you guys have spent so much time doing that because you know I want to spend time learning the technology not troubleshooting the lab and and that's a that's a a really important point because and and that's where you kind of have to balance I mean you don't want readers to start troubleshooting and deploying everything themselves you want to do it for them but that's where you introduce that risk of automating it for them yeah um whereas as you could go on a different path where you just give them the link to the technology they will go and start installing it manually based on the latest upto-date instructions but that means they'll have to do those extra steps and maybe struggle there so it's really two paths each one has you know their pros and cons um but we did try to kind of balance that in the Middle where you have a script that if you want to use it and take that shortcut but we also give you the manual steps and if something changes we can always update the script and then that script will work if the manual steps are no longer working right because that get once that's printed it's done um if that link changes if some step is removed or added then that book at least that page in the book is no longer accurate so we did want to leave that opportunity or have that opportunity to introduce a fix I'm assuming the book's for beginners I mean so you correct me if I'm wrong but if I'm a beginner I want to you know stuff like that can really throw you in your studies so like first question is the book for beginners what kind of prerequisite knowledge do I have uh for the for the bash book yeah the book the book is definitely curated for beginners now some of the the number one books that that I see that that are recommended are like black at python um you know and and that that book is is is really great and it's been written in in a way that allows for folks to really understand how to how to hack into systems and as part of black hat bash we wanted to really make this a beginner friendly book so everything from the start we teach you about what bash is how to get comfortable inside of a A bash cell um how to write some particular scripts such as you know loops and use variables and really give you the basics of how to how to do some some automated uh shell scripting from there uh you know we we built out seven different containers with all different uh uh variations of vulnerabilities and ways to pop a shell inside of these environments a everything from really uh you know basic web shells that that you would use uh or a reverse shell or particular vulnerability that that you can exploit and scan for using bash um so we really wrote this book for those folks who are junior penetration testers who want to get a good foundation when it comes to hacking and Bash is one of those amazing scripting languages that most folks who are you know operating in this field will touch a Linux operating system and will inevitably see a bash script here or there and so getting really comfortable with your bash fu skills uh is I think a really core competency in this in this space in this industry and black bash I think uh hopefully does a really good job with giving giving folks especially uh junior penetration testers uh security Engineers sis ad men's a a really great sort of introductionary introductionary course to how bash can be used to break into into systems I love that because the you know the problem with learning like a language python or bash or whatever is I'm not learning that for the sake of learning that I'm learning that to accomplish a goal and there's no better way to learn like bash or whatever than to have something exciting like this where you can you know break into something yeah we also um in in the in the black at bash book uh we put together scripts but we go about that uh in phases where you like Nick mentioned we teach the the the real Basics uh the fundamentals the loops the variables and so on and then we kind of describe a scenar a scenario or objective that we want to achieve for example discovering when a new host is suddenly online on some internal Network so you write some tool that keeps probing the network once the host was found you know it will send an email or something but it won't send it twice for example so building or teaching the reader that that knowledge or the basics to think like a programmer like how would you build something iFit efficiently and with as less tools as possible but at the same time bash also relies on you know calling some external tools for example so we do highlight when you actually need to call some additional tools for example um but we do try to stress the importance of living off the land so for example if you want to run if config or you know IP space a to see the network interface maybe those tools don't exist how do you know what the IP addresses are so we actually highlight specific files in the file system that will'll give you that information so that you can actually know the the the basic information without those tools um and we try to do that where wherever possible and one thing that is really exciting about the book is that it has I think almost 30 different exercises Hands-On exercises and each exercise has like a sort of a pattern like for example we want you to go search the internet for something or pull some some information parse it and then do it something with it so we walk you through like the general thought process around building going about building something like this and also provide the actual solution and of course the solution can be written in more than one way so we highlight that hey you can get the full solution here if you want it just to get like a you know a shortcut to to see how that program would look like but we guide them how to run that things basically build that thing and run that thing themselves um and we try to come up with various scenarios uh that basically ended up with almost 30 different exercises in the book which is really exciting um and I think that bu kind of working on that planning how to plan for writing a script is very important because it's like a thought process that you have to learn and I really think that this book really stresses that importance as well um so I'm really hopeful that this book will not just be relevant and interesting to newcomers but will also help maybe more advanced pentesters who want to learn a little bit about more the the internal Linux stuff uh so there's something for everybody I'm glad you highlighted that I mean what it I always said with people like yourselves who are very experienced there's a difference between someone who can just use a tool and someone who can write their own tools yeah 100% and one thing that we did in blackhead graph youall as well as bash is what when we ask them to use some tool we try to highlight what the tool is actually doing and how it's doing it so that they understand the concepts of it so for example if a tool is written in Ruby or something or even Pearl what is the tool actually doing how does it come up with this output in the first first place um and we try to highlight those areas where you know the tool is like enumerating like packages in the in the file system for example or enumerating the available diss or files with certain loose permissions and things like that um so we do try to teach them how the tool is actually working and not just to guide them to just blindly run the tool yeah yeah i' I'd say that um for folks who are like uh picking up the copy of the book and and going through it um the same way that the lab is deployed we kind of have the the step-by-step process of how to do it and that'll really teach you how to deploy the lab but at the very end we give you sort of like the answer which is just run this script to do so that approaches also with each of the exercises that that that do have mentioned so I I highly stress that folks don't just go to the end of that particular exercise and read through the the script and then just like copy and paste it and then pop the shell and you know continue really Maybe cover that P page and and do your best to like write your write your script as best as possible to really accomplish the the task at hand um so try to not go right to those spoilers um I know with like you know for for instance with dvga you can go off and like you know look at a solution for a particular Challenge and just follow through and that's one way to learn but I think when you really stretch yourself and pressure test yourself you'll actually be surprised at you know maybe how close you were to the actual uh bash script at the end at the end of the chapter so um some of the other things that I wanted to talk about as well is that the the book and the lab for for black hat bash is incremental so as you slowly learn uh about bash and some of the scripts that you can write to do some reconnaissance maybe uh do some vulnerability scanning get some initial access and pop some initial shells into some of these containers you'll notice that oh I'm not a root uh account in in this particular their environment I'm very low privileged account I can't really do much and so if you follow the book it's very much like a a really graceful story line of how some of the biggest compromises and breaches in in cyber security have happened and uh I think that that that exhilaration that most hackers have when they first pop a shell in an environment is something that we want to give these readers who who do deploy the book and the lab and can really feel that exhilaration of Landing a a shell in an environment that that is not your own computer and and being able to do that in a safe and contained and isolated environment that you run yourself will really give you that experience and that and that confidence with being able to do uh you know Enterprise level penetration tests in environments that are going to be very similar in in a sense to some of these containers where they will be locked down where you won't have all the the tools that you would potentially have at your disposal in in some of your playground or with your other sandbox environments I love that I mean I think it's I'm glad you highlighted that it's not just for beginners like when I saw the introductory I just skim through that because it's stuff I know already so someone who knows more can just go to the more advanced stuff later in the book right yep you can use the book like a a reference guide or you can use it as like a you know a cover to cover read uh for those folks who are getting you know just into hacking and imp penetration testing I'd highly recommend that you read the book cover to cover and follow all the exercises along the way but if you are more of an advanced penetration tester and a hacker you really want to hone in on some of your skills whether it's defense evasion or privilege escalation using just things like bash and some of the binaries that live on on some of these Linux systems then go to those chapters find those scripts maybe add those scripts to your own little red teamer repository of of of useful bash scripts there's a lot of like information Discovery uh and data collection scripts that are there that I know for a fact will be useful so the next time you pop a shell in an environment check out the repository take a look at the book and maybe some of these scripts will help automate some of those mundane manual tasks that that you you often run on on a continuous basis with some of your penetration tests yeah so uh one thing for me is I think other than the hacking part of the book one thing that is I think people will take uh after reading the book is how to customize their environment to their liking I think one one thing that sets apart more advanced pentesters is how some of them at least have very like highly customized Advanced processes um and workflows that can give them that edge to find things faster than others they may run the same tools but in order to you know run enumeration scan get like dns's and then scan those dns's and then all of that requires all sorts of tools and one problem that we have in the offensive security side of things is that tools do not produce necessarily the same type of output whether it's format or some other and in order to tie them all back to one desired format requires a lot a lot of uh knowledge and and requires some the ability to actually produce that kind of uh unified view of all these tools together um and I think that as you progress and Advance as a penetration tester you'll have you'll be you'll be developing a more customized environment for yourself that really fits your your needs and I think after reading that book you'll be able to do that you know maybe setting aliases or writing a script that sources a bunch of other scripts that can call a variety of different scripts from one command and produce some result as an example as opposed to ad hoc running this tool and then that tool and then that tool and kind of analyzing the results uh separately and then putting it together and trying to make sense of it and I think all these tasks can be highly um uh automated and I think that this book will give that knowledge and I think that's the key well at least one of the keys uh to develop a really great process of of p pentesting in general I think if you learn to code right or you learn to script I mean scripting is a way to start if you like but coding just changes the your world totally 100% And I think that especially in the bug Bounty space take a million bug Bounty bug Bounty researchers not all of them can code so some of them may run like surface level tools and analyze the results maybe they'll do this once a day or twice a day depending how much time they they spend there but if you have a researcher that can actually automate it they will just open up their slack and wait for a notification when a vulnerability is found and their their tools will run all the time or they will the script will be intelligent enough to know when something has changed and then it will run the scan so you definitely get an edge when you start learning how to automate your processes and if you want to be really good at at this then I think learning bash is like the basics but you know then you can go on to Learn Python or go or rust um but I think bash is like the really the foundation so guys perhaps you can give us one or two of the attacks that you most enjoyed creating that's part of this book I can give one example in Vim the text editor there is like a little plugin that allows you to run commands as soon as a user saves a document so when you save a file there's some kind of a postcript that will run and there's a scenario in the book where you can sort of hijack or copy the content and do something with it as soon as the user Sav that text file uh which I found I found it to be pretty fun um and an interesting uh uh component in Vim that I Vim is like a is an ecosystem of things really it's super complex um in terms of like the plugins and the additions uh that you can add to it uh but I found that pretty fun uh one other thing that I thought was fun is that there's a an exercise where you hook basically essentially the terminal whenever a user hits enter there's going to be a post script that will run and give you the actual input of the user like what the user actually um typed and executed and then you can do something with it so for example there's a exercise where you have some logic that looks for credentials or looks for tools that tend to pass credentials in the parameters like my SQL for example um or reddis and it will look for patterns of of those uh tools to see if somebody passed the credentials and it will collect them and send them to some server uh which I found uh pretty fun as well that's great uh Nick you got to give us one the the exercise that I absolutely love because I'm sure a lot of pentesters and Bug Bounty researchers uh hate having to deal with with webshell so when you upload a webshell into a server and you are able to have some really crude web-based uh interface into a into an environment that formatting the encoding it's all kind of garbage usually and it's hard to really work in an environment like that so in one of the exercises after you've already uploaded a webshell you have this opportunity to write a little tiny bash script that'll continuously run interactively that will as you run a command like who am I or LS or cat particular files it will send a curl request to your webshell and bring back the sort of really nice encoded uh response back into your little you know bash shell environment so as you're running these commands you're really feeling like you're in that environment rather than having to interact with it through a web page and having to click a button to click submit Etc there are things like that that are really like great quality of life Improvement uh uh scripts that I think are great reference for for folks to use in like future uh pentests I love that you guys have obviously been doing this for a long time I'm assuming that you've taken like some of the best stuff that you've learned over these years and you've put it into this book so that people can sort of shortcut the system if you like not have to go through like the long audience journey and kind of like get a get a step up yes but I'm I'm a little bit torn on that I do feel that yeah people definitely need to learn the basics like it's okay to pick up a book and learn it and and you can definitely do that is one of the first thing that you you do when you start your career but I feel that learning networks and learning systems like just Linux basic Linux doesn't have to do anything with hacking for you know specific specifically is so important and can help you so much in your career by understanding how networks work uh same thing with like you know breaking applications if you are a pentester and test web apps and you've never really built one you won't appreciate how difficult it is to build something securely I feel like yes you can pick up a book and learn the gist of things but the basics are underrated and they are super important I love that answer Nick come on yeah give me an answer that refutes what I just said sorry go on yeah I I'd say that uh J and I have been been hacking for a really really long time and when we first you know decided to write this book uh we immediately wanted to lean back on some of the expert Frameworks out there that the two of us have been using for pretty much every single one of our pentest engagements and security audits which is things like the the miter attack framework and while we don't explicitly call it out as like a a a framework that that we use to like actually write the book from cover to cover in all the different ways to gain initial access escalate privileges understanding some of these like really core resources like the miter attack framework and other you know foundational elements is like super super important but the way that we've sort of injected our knowledge and how we wrote the book and some of the useful tips that every hacker should know um when secting some of these uh exercises throughout the attack kill chain while it's in there uh and folks you know who read the book will say like oh wow I'm looking at the miter attack from and it's very similar um I would still highly recommend that folks still you know always look at that because while you know it's bash right now you might be operating within a Powershell environment um and a Windows environment uh tomorrow so getting getting like a good breath in an exposure and base is going to be really really important and while do and I always try to educate young young hackers into how we approach targeting systems the ways that that we approach it are maybe eventually going to get old and and and not be relevant anymore while we always strive to make our tools our resources and books as Timeless as possible sometimes going back to the basics as I mentioned before like reading the specification file and and looking at documentation and how it's written is really how you find those really great novel zero day vulnerabilities I think those were great answers right because I think that's a problem a lot of people have give me the shortcut but I think all of us have been in this game for a while know that you have to put the work in 100% I think one of the nice thing about this is that we try to add like the newer type of tools like the nucle one and putting emphasis on how to template attacks how you can take a certain type of attack and then create a template out of it and then run it across a fleet of machines as an example um and how you can use a tool like that maybe not not avoiding the the sense that you don't want to learn it but it's a way to automate something without really knowing how to program you can just write like some some logic in the template that will do that for you um but we one thing that I found interesting is that everything that we did in the book had to have some bash flavor right had to have something to do with bash which is not an easy task right because a lot of tools are you know for example how do you like call make HTP requests in python maybe you would use like requests library or something like that right but in bash you would be using like some you will wrap some tool essentially right you will either call curl you can even make HP request with netcat as an example or ncat um and that I think that bash flavor was actually not trivial sometimes um so we had to use some tools eventually but in general I think that uh um there are a lot of scripting and automation done with the basic non security Focus tools that you can you'll typically find on a host as well as bringing you know external tools as well that you will typically have on Cali as an example so one thing that the book does is your Launchpad for tax is Cali the C the Cali VM that runs all these containers right that would be like a a pentester laptop with all the tools right but once you hack the environment that's when those tools are no longer available we don't assume that you can just upload your tools like right away we want to assume that you are not able to and you need to make do with what's available on on those hosts and I think that's the fun part because you do have that perspective where all the tools are available and the perspective that you have no tools available um and that was a a fun way of creating or architecting that this this lab in a way that gives you both perspectives I like that Nick sorry go on yeah yeah I think that uh the book does its best to like blend the new with the old and you know bash while being in a fairly old scripting language we we do reference you know a lot of newer Technologies like R scan which is a super fast Port scanner it's really super efficient and how you can interface that with bash to automate and orchestrate some of your your attacks is definitely in there and in in the book but uh as as DOL of mentioned a lot of pentest engagements and uh and red teaming scenarios typically go wrong when a big fat clunky tool gets you know either downloaded or put into an environment because then the blue team or some of the security monitors tend to go off and they say oh we we found something that's known malicious in this in this environment and then you know the the red team get saged because they got kicked off of the uh the host that they they were just about to you know extract all the juicy information from really trying to move away from the the tool Centric approach to hacking is is what DOL and I really wanted to to accomplish with with the book but still give folks a little bit of a tidbit of like the latest greatest U modern tools that that are out there like like nii R scan Etc but some of the really great hackers are able to make do and Meyer their way into into a network or into a different uh a neighboring server with just what they see around them so that living off the land approach is really like a very CTF way of of of hacking but then also doing so in a really stealthy and quiet way and so yeah this book has has something in it for for those folks who who want to go from being a really loud and Tool Centric uh hacker with some of the their sort of Brute Force attacks into a little more of a stealthy with a slash a little bit of Automation and orchestration element attached to it so yeah hopefully that that gives a good round summary of like what the book is about and why we why we wrote it I love what you guys have done because it's not just reading a book right it's actually labs and it's more like um there's a it's like a lab book almost is that right yes yeah the lab is the foundation of the book and it tells a story uh as Nick mentioned it's like a hosting company that um manages networks or manages applications and databases of some some customers as and those customers are at risk and their data is at risk because the hosting company did not apply certain security best practices and that's how we kind of find loopholes and you gain access to the their customer data essentially um and we try to tell that story in the book and also keep keeping in mind the actual path an attacker would take um Nick mentioned the The Miner attack framework um where there's like a pretty clear path what an attacker would do from start to end but sometimes you would go back and forth between stages um and the book also kind of highlights that like maybe you will Recon take over a machine and then you'll Recon again um so we also have that in mind like how would a reconnaissance look like when you're outside of a network versus when you're inside a network suddenly you're exposed to a new network as an example so we have containers that are dual H homeed as an example so once you take over that container suddenly you see an internal Network that wasn't exposed to you before so we try to uh explain to the reader that not everything that you see from the outside is necessarily going to be the same inside and some hosts are going to be exposed to new things and some hosts are more restricted and hardened While others are not I think that that's the fun part about the lab and and and like all good stories in this lab environment Dov and I have put in some uh some actual characters so there are there are like fake employee accounts uh littered across the the the environment and uh you'll come across certain uh uh names and you'll sort of get a sense of oh this person might be a system administrator or this person might be a developer and as you go into some of these new uh containers and these new servers you'll get a sense of oh what kind of commands have they run and let me check out their their history and see if I can get some of their credentials so you're not only just compromising the uh the containers per se but you're also using bash to like uh compromise the credentials that you're finding throughout this sort of story uh in this sort of environment that we that we've built guys my biggest disappointment and I think a lot of people watching this depending on when it goes live will be very disappointed because the book's not available yet so when is it going to be available um so the book is going to be sent to the printers on June 17th fingers crossed so I think we'll start we'll start seeing it in people's hands probably July uh the fun thing is when black had graph K came out the only when we figured out that it's out there when suddenly somebody uploaded on Twitter that they got the book before us they actually got the book before us so we didn't even know that it's already out there but that's the target date you know we wrapped up uh Early Access uh the Early Access stage that has been going on for quite some time the book is from from writing perspective it's mostly done um so we we really want to hold the book as well so we're just as eager I'm looking forward to that so just for everyone who's watching they can go and register on the noarch website right or perhaps on Amazon try and pre-order is that correct yes yep you can go on the noarch uh website and you pre-order the book you can get the physical heart copy shipped over to you and uh you can also get the the Early Access version uh which will give you a couple of chapters to play around with um and the entire repository is is available for folks to to download and play with if they kind of want to get a little bit of an early scoop into uh what the environment looks like but uh definitely hold off and and wait for for the book to come uh before you go a little bit too deep into that environment so guys tell me can people reach out to you and where where where can they get hold of you where's the best place is it Twitter X as a school these days LinkedIn where's a good place all of the above pretty much yep well all the above mainly yeah X and and Linkedin are best and then GitHub as well that's great I'll put those links below so for everyone who's watching I I've only got like some of the chapters what I've read is amazing I've obviously got uh that's bash I've obviously got the graphql book I was a bit nervous about this CU I was like oh this is really complicated something I don't know but I mean you guys have done a great job keeping it simple and I love what you did in that book in the beginning you kind of like gave the primer so people who were newed could really understand what it was about and I mean you guys have done that in this interview and I really appreciate you doing that I always say to young people jump on the new wave right get on the new technology you know that's how they can leap frog frog us who have been around for for a longer period of time so highly recommend that book highly recommend bash my biggest disappointment is that I can't get the book today but I look forward to it being available any last words guys before we wrap up uh I want to say uh you big thank you David uh this is a a true honor to to be a part of the show and and what you do is is really great um let's Inspire that next generation of hackers and uh just say DOL of and I have definitely caught the uh the book writing bug so expect more from us thank you so much uh any hints about what's coming no I'll just say thank you so much for me talk me kind of sitting here talking to you I'm like Star Struck almost so I to me to be here is absolute honor I really appreciate it guys but you now you've hinted about a book any can you kind of like give us hints what you thinking about it was that top secret so I'm I'm okay with with with with talking about it it okay there's no like book deal whatsoever um I obviously want to work with with no starch again but um I'm doing a lot of research right now into drone hacking and I'm currently working on a new project called Dam vulnerable drone this is a simulated drone hacking environment which will teach folks how to hack drones in a free and safe manner because right now drone hacking is a little too expensive expensive you could buy an actual drone and fly it around and then try hacking into it somehow and you you are successful and you operate it incorrectly you might actually damage someone's car or hurt someone so in a simulated environment um that teaches you all the different steps and techniques on how to break into a drone was something that I was like I I got to do it and so while I'm working on the damn vulnerable drone application right now and you can see it in my GitHub uh I am going to be looking at wrting a a book this in this space look for to that I'm gonna hold you to that on my end I do have a 2026 uh contract with no starch press um where I'll uh write the Practical Dev SEC Ops book with no starch right um still two years from now I'm going to be older the name today we'll see we'll see how I manage that um with two kids and everything but it'll happen yeah I mean it's like I've always Shi away from writing from writing books right because it's one of those things that feels like it's a lot of work and the returns are on always it's great as you know financially perhaps but I really appreciate you guys doing this because you know there's I wish more people would write books because it's it's such a good way to share knowledge yeah I I agree um it's super rewarding um being able to have a have a book out there that really puts a stamp on you know a time in your life where you put a lot of research and energy and focus towards and is helping other folks uh with their careers and their journey is such a a huge rewarding experience experience so I highly recommend for those uh senior security Engineers pentesters who have a lot of knowledge and experience in the space to really pick up you know the possibility of of writing a book now do and I have work with with no starts they have a really easy and clear way of how to put out a book proposal they have a very clear template on on their website you could fill out for that proposal process it sounds a lot more daunting than it really is I will say that it is extremely extremely rewarding when you have a a junior hacker or someone who comes up and and has nothing but really great things to say about your book and it's helped their careers grow and I think in an industry like ours where there is such a huge Talent shortage and a huge gap yeah being able to write these books and give out some of the tools uh uh to folks and helping them learn the the space is is so so important especially in the cyber security industry they of go for it yeah I think I I would totally encourage somebody to write a book if they have that in mind um you know if I think the best opportunities are those that you want you're looking for something online but it's not there so it means that you needed it there's a good chance somebody else needed it and that's how you get to create something that produces value I think in Cory Ball's example like he wrote hacking apis but it started all from like personal notes if I remember correctly when I talked to him it was all like personal notes he had like hundred and something you know pages of documentation on on apis and then I think at some point when he maybe when he started doing like API hacking he was looking for books but there weren't any and it's actually surprising that hacking apis was released like a year ago but apis have been around for a while I'm surprised that there was no book prior to that um so he really you know trailblazed the space uh with this book but I'm sure that there was going to be more opportunities in the future similar to graphql right it's a niche there's going to there're going to be other niches as well just find that Niche where there's not a lot of uh resources you see that it's starting to pick up that would be a good opportunity but I mean I'm glad you guys wrote black hat bash right because it's like when I saw that I said this should have been written a long time ago so I'm glad you guys did it yeah um it was really great to be able to write that if you have a second David I'm gonna just bring up the uh the damn vulnerable drone uh application here for you so I can like give you a little sneak peek uh demo of that environment so share screen okay this is it uh um this is the dam vulnerable drone application uh you can find it on my GitHub here yeah the application has a simulated virtual environment where you are a hacker um in this sort of Airfield and there is a drone right here um which is operated by this fellow right here who's at the ground control station and uh I wanted to give folks the ability to operate and fly through the different stages of a drone like initializing the boot and being able to see exactly how that firmware reacts in the in the environment so as you initialize the boot as you arm and take off the Drone as you sort of enable the autopilot this gives you the ability as as a as a hacker to then potentially run through exercises of you know can I inject some packets into that uh into that Network can I potentially go off and uh run some uh Network scans on the companion computer on that particular drone so in this environment um you know if you were to let's say take the the Drone and crash it you can just easily go here and reset your entire simulated environment there's a very simple and easy getting started guide very much like the damn vulnerable graphql application and uh it has a full featured architecture how it breaks down all the components from the flight controller the container computer The Ground Control station the simulator the different flight States how you should use it how you should not use it and then from the attack scenario perspective you can get a clear sense almost like a miter attack framework of like all the different ways you can hack into a drone so you've got the reconnaissance techniques the wireless attacking techniques protocol tampering malge service things like GPS jamming geoc squeezing um the entire uh framework is built off of the Rue pilot the common open source uh drone fir firmware that's out there and also the mavlink protocol which is used to uh control microair vehicles and uh yeah this environment allows you to essentially run through that entire uh stage and uh yeah I'm hoping that this will be a great Learning Resource and sort of gives folks some uh tips and tricks of things to do and things to look out for um I'm try to see if I can at least get the Drone up here and flying for you the demo God allow released next week this is this is going to be released as soon as possible um so if I can here hopefully if the Drone gets a GPS lock on so it does have a like a fake simulated GPS environment as well um yeah the whole world of drones is like a really fascinating one with a lot of different moving components yeah yeah so we're just getting the position locked right now and now the Drone should be taking off I could learn to hack a DJ I or some other well-known drone if I learned through the if I went through this right yeah so the the foundational Guides of like how you would approach hacking a drone is all within the within the virtual environment this one particularly focuses on the ardupilot and MAV link protocol but some manufacturers have their own proprietary communication protocol but this will this will teach you sort of the the techniques and tactics and how to how to approach that so here you can see I just enabled the autopilot flight mode and I want to be able to you know teach people how to potentially inject a wayo into that autopilot uh command and so you know while the Drone right now is flying in a circle as intended if you were on your Cali Linux machine you could potentially go into that Docker container of that drone and inject those commands so just like uh dvga just like uh the black hat bash uh environment it's fully built out in in a dockerized environment and uh yeah I'm hoping to um spread some light into the world of of of drone hacking in a safe and free way rather than having to have folks buy a really expensive drone and crash it and feel like they can't invest in in research in this area so guys I really want to thank you for you know writing these books and sharing your knowledge and not keeping to yourself I think that was always a problem with a lot of people in the past perhaps well some people in the past where they kept the knowledge to themselves really want to thank you for you know empowering the Next Generation for everyone who's watching put in the comments below we've discussed doing demos what demos would you like to see uh like specific hacking demos is it bash graphql I think bash would be really popular but for everyone who's watching please put your comments Below guys thanks so much for coming on and sharing really appreciate it thank you so much for having us thanks David