Wednesday, 2015-08-26

*** sdake_ has joined #openstack-security00:13
*** asd112z has joined #openstack-security00:14
*** sdake has quit IRC00:16
*** y_sawai has joined #openstack-security00:17
*** y_sawai has quit IRC00:18
*** salv-orlando has quit IRC00:30
*** openstack has joined #openstack-security00:34
*** sigmavirus24 is now known as sigmavirus24_awa00:46
*** sdake has joined #openstack-security00:56
*** sdake_ has quit IRC00:59
*** tmcpeak has quit IRC01:03
*** browne has quit IRC01:24
*** newradio has joined #openstack-security01:28
*** edmondsw has joined #openstack-security01:39
*** edmondsw has quit IRC01:39
*** newradio has quit IRC02:07
*** tmcpeak has joined #openstack-security02:13
*** dave-mccowan has quit IRC02:27
*** browne has joined #openstack-security03:02
*** austin987 has quit IRC04:40
*** austin987 has joined #openstack-security04:58
*** salv-orlando has joined #openstack-security05:16
*** salv-orlando has quit IRC05:21
*** asd112z has quit IRC05:35
*** tmcpeak has quit IRC06:13
*** shohel has joined #openstack-security06:18
*** alex_klimov has joined #openstack-security06:28
*** salv-orlando has joined #openstack-security06:38
*** b10n1k_ has quit IRC06:54
*** browne1 has joined #openstack-security07:48
*** browne has quit IRC07:49
*** browne1 has quit IRC08:08
*** shohel has quit IRC08:13
*** tjt263 has quit IRC08:38
*** tjt263 has joined #openstack-security09:08
*** yum has joined #openstack-security09:10
*** h00327910__ has joined #openstack-security09:13
yumCe ne suno09:14
openstackyum: Error: "start" is not a valid command.09:16
openstackyum: (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.09:16
openstackyum: Error: "comand" is not a valid command.09:16
openstackyum: Error: "command" is not a valid command.09:17
openstackyum: Error: "command" is not a valid command.09:18
*** daemontool_ has joined #openstack-security09:25
*** misc_ has joined #openstack-security09:27
*** misc has quit IRC09:28
*** daemontool__ has quit IRC09:28
*** goodygum has joined #openstack-security09:38
*** yum has quit IRC09:46
*** shohel has joined #openstack-security09:53
*** dave-mccowan has joined #openstack-security10:01
*** newradio has joined #openstack-security11:11
*** misc_ is now known as misc11:14
*** h00327910__ has quit IRC11:53
*** heron278 has joined #openstack-security12:34
*** edmondsw has joined #openstack-security12:40
*** tmcpeak has joined #openstack-security13:08
*** singlethink has joined #openstack-security13:30
*** bknudson has joined #openstack-security13:38
*** shohel has quit IRC13:39
*** browne has joined #openstack-security13:42
*** heron278 has left #openstack-security13:44
*** jmckind has joined #openstack-security14:00
*** sigmavirus24_awa is now known as sigmavirus2414:05
*** sicarie has joined #openstack-security14:10
*** browne has quit IRC14:27
*** browne has joined #openstack-security14:37
*** voodookid has joined #openstack-security14:39
*** jian5397 has joined #openstack-security14:40
*** mdelapp has joined #openstack-security14:41
*** yaya has joined #openstack-security14:51
*** singleth_ has joined #openstack-security14:58
*** sdake has quit IRC14:58
*** singlethink has quit IRC15:01
*** asd112z has joined #openstack-security15:02
*** yaya has quit IRC15:03
*** asd112z has quit IRC15:10
*** asd112z has joined #openstack-security15:11
*** alumno has joined #openstack-security15:11
*** alumno has quit IRC15:12
*** dwyde has joined #openstack-security15:16
*** yaya has joined #openstack-security15:19
*** ExpectxD has joined #openstack-security15:21
*** TheEnd has joined #openstack-security15:24
*** singlethink has joined #openstack-security15:25
*** ExpectxD has quit IRC15:28
*** ExpectxD has joined #openstack-security15:28
*** TheEnd has quit IRC15:28
*** ExpectxD has quit IRC15:28
*** singleth_ has quit IRC15:29
*** bucknerns has joined #openstack-security15:32
*** arithx has joined #openstack-security15:32
*** arithx has left #openstack-security15:34
*** jian5397 has quit IRC15:41
*** bucknerns has quit IRC15:47
*** jian5397 has joined #openstack-security15:48
*** yaya has quit IRC15:56
*** bucknerns has joined #openstack-security15:57
*** arithx has joined #openstack-security16:00
*** jian5397 has quit IRC16:00
*** mdong has joined #openstack-security16:05
*** bucknerns has quit IRC16:07
*** jian5397 has joined #openstack-security16:12
*** jian5397 is now known as michaelxin16:12
*** tjt263 has quit IRC16:12
*** bucknerns has joined #openstack-security16:14
michaelxinbucknerns: hi16:14
*** yaya has joined #openstack-security16:18
*** sdake has joined #openstack-security16:20
*** mvaldes has joined #openstack-security16:22
michaelxinhi, guys, as we mentioned in our last week's IRC meeting, we make our PoC for API fuzzing/security testing tool available.16:23
michaelxinYou can check it at
*** tjt263 has joined #openstack-security16:24
michaelxinAt this time, we have not added lots of security checks yet.16:24
michaelxinWe want the feedbacks from you all first16:24
michaelxinIf you have anything, please feel free to ping me, or nathan (bucknerns) or mvaldes16:25
michaelxinThanks bucknerns for his hard work on this PoC16:26
tmcpeakmichaelxin: awesome!16:28
tmcpeakbucknerns: sweet!16:28
*** jmckind has quit IRC16:29
bucknernsI'm most proud of the autocomplete16:31
michaelxintmcpeak: Thanks. It is still in early stage. We want the feedbacks from the community and contribution from the community. Together, we can make it a great tool.16:32
michaelxinbucknerns: I know you love autocomplete16:32
tmcpeakmichaelxin: yeah, awesome, I'm excited to check it out!16:33
*** alex_klimov has quit IRC16:36
tmcpeaknice touch:
bucknernsIn that example it would fuzz the domain ID and the headers including the auth token.  No body fuzzing since it doesn't have a body.16:40
*** snoggla has joined #openstack-security16:40
bucknernswhile fuzzing the headers the domain id would default to the string in the braces16:41
*** snoggla has left #openstack-security16:41
tmcpeakyeah for sure, makes sense16:42
bucknernsif for instance you didn't want to fuzz the auth token you could add ACTION_FIELD: in front of the key x-auth-token:16:44
tmcpeakcool - I've got to carve off an hour or so and give it a proper play16:44
bucknernsthe reason we went with this syntax instead of adopting something exactly like burp is because we are iterating through the body/header object recursively and fuzzing the values.  It makes for better fuzzing because an object like <tag a=5 /> can be fuzzed to <tag>some fuzz string</tag>16:47
tmcpeakmakes sense16:48
mvaldesdefinitely proxy it through Burp to get a good view of what it happening behind the scenes16:48
tmcpeaksomething that would be cool is request logging16:49
bucknernsI wouldn't mind input on the object fuzzing vs string replacement fuzzing sometime16:49
bucknernsthey are all logged16:49
tmcpeakoh cool16:49
mvaldesi forgot to include the logging details in the readme!16:50
michaelxinmvaldes: Please add it now16:50
michaelxinmvaldes: it is a cool feature16:50
*** dwyde has quit IRC16:53
mvaldesworking on it now :)16:53
tmcpeakmichaelxin, mvaldes, bucknerns: you guys going to midcycle?16:55
tmcpeakwould love to see a demo at midcycle and get some hacking on it16:55
michaelxintmcpeak: Sure16:55
michaelxintmcpeak: I will be there.16:56
bucknernsi made a gist of a run.  I did a keyboard break16:56
bucknernsbut I showed a log and an ls of the log dir there16:56
tmcpeakvery cool16:56
tmcpeakif you can drop a link to that output in readme or something?16:57
bucknernsI will do one with a demo user and a smaller run so we can see the output at the end of the run.  It prints the failures, unittest style.16:59
tristanCmichaelxin: great work :)17:04
michaelxintristanC: Thanks. bucknerns and mvaldes worked hard on this. I just do leg work and lip work.17:08
*** arithx has left #openstack-security17:09
tristanCwell thanks you guys for making this opensource17:09
michaelxinOh, I forgot arithx too17:10
michaelxinmy bad17:10
elmikomichaelxin, bucknerns, thanks!17:31
elmikotmcpeak: you missed some fun this morning,
tmcpeakbad link17:32
tmcpeakspammers again?17:32
elmikominoks chewing on the power cables again...17:33
tmcpeakit looks like they are trying to control a bot17:33
elmikoyea, or something17:33
michaelxinelmiko: Glad to help. Thank you.17:37
*** bucknerns has left #openstack-security17:42
*** dwyde has joined #openstack-security17:44
*** federico3 has joined #openstack-security17:49
*** mdong has quit IRC17:57
*** mcdong has joined #openstack-security18:02
*** mcdong_ has joined #openstack-security18:07
*** mcdong has quit IRC18:09
*** mcdong_ is now known as mcdong18:09
*** michaelxin has quit IRC18:14
*** openstackgerrit has quit IRC18:17
*** openstackgerrit has joined #openstack-security18:17
*** b10n1k_ has joined #openstack-security18:22
*** mvaldes has quit IRC18:35
*** yaya has quit IRC18:39
*** jian5397 has joined #openstack-security18:48
*** mcdong has quit IRC18:52
*** asd112z_ has joined #openstack-security18:52
*** singleth_ has joined #openstack-security18:55
*** asd112z has quit IRC18:56
*** jian5397 has quit IRC18:57
*** singlet__ has joined #openstack-security18:57
*** singlethink has quit IRC18:58
*** singleth_ has quit IRC19:01
*** jian5397 has joined #openstack-security19:08
*** jmckind has joined #openstack-security19:27
*** singlet__ has quit IRC19:31
*** singlethink has joined #openstack-security19:32
*** singlethink has quit IRC19:38
*** singlethink has joined #openstack-security19:39
*** y_sawai has joined #openstack-security19:59
*** y_sawai has quit IRC20:09
*** browne has quit IRC20:21
*** singleth_ has joined #openstack-security20:29
*** browne has joined #openstack-security20:30
*** singlethink has quit IRC20:31
*** y_sawai has joined #openstack-security20:35
*** y_sawai has quit IRC20:36
*** yaya has joined #openstack-security20:41
*** asd112z_ has quit IRC20:51
*** asd112z has joined #openstack-security20:52
*** asd112z has quit IRC20:52
*** asd112z has joined #openstack-security20:53
*** jian5397 has quit IRC21:00
*** openstackgerrit has quit IRC21:01
*** openstackgerrit has joined #openstack-security21:01
*** elo1 has joined #openstack-security21:21
*** elo1 has quit IRC21:22
*** elo1 has joined #openstack-security21:22
*** singlethink has joined #openstack-security21:25
*** profor has left #openstack-security21:25
*** singlet__ has joined #openstack-security21:27
*** singleth_ has quit IRC21:28
*** singlethink has quit IRC21:30
*** jamielennox has quit IRC21:36
*** timkennedy has quit IRC21:37
*** timkennedy has joined #openstack-security21:37
*** jamielennox has joined #openstack-security21:38
*** alejandrito has joined #openstack-security21:39
*** elo1 has quit IRC21:51
*** alejandrito has quit IRC21:51
*** edmondsw has quit IRC21:59
*** bknudson has quit IRC22:08
*** singlet__ has quit IRC22:09
*** sdake_ has joined #openstack-security22:15
*** sdake has quit IRC22:18
*** jmckind has quit IRC22:19
*** dwyde has quit IRC22:36
*** sdake_ is now known as sdake22:41
*** yaya has quit IRC22:42
*** markvoelker has quit IRC22:46
*** markvoelker has joined #openstack-security22:54
*** sicarie has quit IRC23:06
*** voodookid has quit IRC23:11
*** jian5397 has joined #openstack-security23:17
*** tmcpeak has quit IRC23:41
*** jian5397 has quit IRC23:57
*** asd112z has quit IRC23:57

Generated by 2.14.0 by Marius Gedminas - find it at!