Video for my LSCC presentation on: New Era of Software with modern Application Security

Skillsmatter has just published the video of the presentation I delivered last week at the LSSC (London Software Craftsmanship Community)

You can see it here:
https://skillsmatter.com/skillscasts/7582-new-era-of-software-with-modern-application-security

Gource Visualisation of "TeamMentor Git Development - 18 Months in 180 Seconds"

Here is a pretty cool video of 18 months of Git commits using the Gource tool which is a software version control visualization tool.

Try to see it in full screen and at 1024p HD quality:

Trying out SendGrid for cloud-based emailing (with nice intro video)

I need a solution to send emails (TeamCity build events, TeamMentor user’s activities, etc…),  which basically means that I need an SMTP server.

Looking around it looks like there are 4 solutions:

• build an manage an SMTP server
• use a google gmail account  (via smtp)
• use Amazon Simple Email Service Beta (Amazon SES) 
• use SendGrid

First PoC of TeamMentor integration with HubSpot

Here is a Video that shows a PoC of consuming and manipulating HubSpot user database (called Contacts) natively from inside TeamMentor:

First two 'official' TeamMentor 3.2 videos

Tom Bain from SI just published these two videos about TeamMentor which are part of the 3.2 release marketing efforts.

• What do you think?
• Do they make sense?
• Too much 'marketing'?
• Any spectacular BS comment that we should remove? :)
• How could we make them better?
• How could we make them worse? :)

Video #1: What is TeamMentor? 

Video #2: TeamMentor: For Compliance 

A must watch TED talk about GIT and democracy

Nudged by Dennis Groves, here is a really good presentation on the power of GIT outside programming:

Couple interesting notes:

• It's funny how he re-wrote the history of why Linus created Git
• see Tech Talk: Linus Torvalds on git and http://en.wikipedia.org/wiki/Git_(software) for a more accurate version
• If you are new to Git take a look at http://git-scm.com/about and https://help.github.com/
• I'm starting to think that Linus will be more famous and will put a bigger Dent in the Universe due to its creation of Git than with Linux
• In my head there are a lot of similarities between Linus strategy in developing Git and what I'm doing with O2 (we both are creating a tool to solve a hard problem that we have). I want to expand more on this topic, but I am really inspired by what happend (and is happening) with Git
• I really think that GIT will change a LOT of things, for example see the Design for Fork and the liquididy of OpenSource/Git post where I talk about using Git as the OS/File-System

Trillions from MAYA (see the video, buy the book)

The Trillions Video is one of the most important videos that I have seen over the last couple years and one that gave me a nice warm felling that I'm doing the right thing with my O2 Platform development strategy.

They have now released a book Trillions: Thriving in the Emerging Information Ecology which I have started to read (on IPad's Kindle) and if you want to understand what will happen next, you NEED to read it.

A key message in the video and book is that to deal with new paradigms and systems,  we need complete new strategies, approaches, tools and ideas.

And that is exactly what I'm doing with O2 Platform. Instead of doing what just about every other Security tools vendors is doing (i.e. 'trying to create a 'blackbox' solution with some customisation features on top'), I'm creating an environment/platform where Scripting and Customisation are first-class citizens. In fact most of the O2 Platform is already 'scripts' and the expectation is that when facing the target application/website, the question is not 'do we really need to customise our technology/tools/approach?' but 'how fast can we customise our technology/tools/approach so that it actually represents reality?'. 

It's the customisation-time-delta that matters, and of course that the faster that happens, the more we (Application Security Knowledge) will scale :)

Back to Trillions, I see Application Security (and its complexity) as they see Trillions. Each node (from source-code to app's behaviour) is something that needs to be analysed, modeled, managed, controlled and (sometimes) fixed.

In fact, a business model that still yet to take hold in our industry is 'Security Tools/Technologies/APIs Customisation Services' (with clients paying for it and service companies providing it)

Btw, MAYA company and research is simply amazing and their focus on Design is a great inspiration  (what a great place to work that must be). Checkout their other videos (http://vimeo.com/mayanmaya) and research (http://www.maya.com/practices/research).

Even their name is really powerful, since MAYA means Most Advanced Yet Acceptable.

Finally, if you want to explain what 'Is An API?' to a non-developer audience, point them to MAYA's latest video on Containerization (I would love to have videos like this to example how SAST, DAST and even O2 works :)  )

C# GUI to View Processes Open Handles (Files, RegKeys, etc...) just like SysInternal's ProcessExplorer

How many times have you tried to find which file was open in one of your currently open processes?

One of the few reasons I use SysInternals ProcessExplorer is to use it 'Find Handle' capabilities, which allows me to find the processes that are locking a particular file.

I always wanted to do this from C# (and O2), and this weekend, based on the code from the StackOverflow's what process lock a file answer, I was able to build an O2 script that collects information about all open handles in the processes the current user has access to (you will need admin privs to look at all running processes)

You can see the scripts created here, and below is a video that shows the Tool - View Open Handles for all Processes.h2 in action (note the ability to quickly search on all open file handles)

Note 1: this script was written in C# using a couple Win32 DLLImport methods and can be executed by non-admins on userland (somehow I was under the impression that this type of handle information was only available: a) via the kernel, or b) if we hook all processes and got the handle data from via 'dll injection-code-execution')

Note 2: If it hangs while getting the process' handles, sometimes it helps to kill the process (for example TGitCache.exe) that is causing trouble (see the last entry on the LogViewer)  There is also quite a lot of memory allocs going on in the conversion of unmanaged data into C# objects, so this script will leak a lot of memory (i.e. you will not be able to use that process for a long time :) )

Video: Using O2's Roslyn-based C# REPL Script environment

Roslyn is a new Microsoft's C# compiler written in C# (with also a VB flavour)

It is actually quite a spectacular piece of technology and in a way there is a LOT of similarities between the REPL environment I created in the O2 Platform and the one Roslyn is trying to do. In fact I'm thinking of moving some of O2's scripting capabilities from the current SharpDevelop parser to this new Roslyn one since their object model seems to be MUCH more powerful (of course that I'm bias, but I think that the O2's REPL environment as a couple killer features missing in current version of Roslyn REPL, so let's create the best-of-both-worlds REPL environment :) )

I've started using Roslyn in O2, and the first thing to do was to create an REPL environment which you can see in action in this video.

I am documenting the 'scripts evolution' (as drafts), and here are two I just created:

• Using Roslyn (first tests).rtf  (series of scripts that ended up with the Roslyn-based REPL enviroment shown above)
• Using Roslyn (consuming Static and Sematic data).rtf (execution of the scripts from the high-recommended Whitepaper: Roslyn Project Overview )

I think there is HUGE potential with this technology, and one area that I'm specially interested in is doing Security-focused Static Analysis, with integration with TeamMentor and Cat.NET (see Video: Injecting TeamMentor into Cat.Net running inside VisualStudio )

You can get Roslyn from O2 (it will install the package from NuGet), but if you want to try the visual studio integration you need to get the Microsoft “Roslyn” October 2011 CTP

If you want to comment this post or video, please use this reddit thread

Some Roslyn References and articles:

• http://msdn.microsoft.com/en-us/roslyn  (main site)
• http://social.msdn.microsoft.com/forums/en-us/roslyn (forums)
• Two draft docs published by Roslyn team 
• REPL and Code Semantics: http://tinyurl.com/3kprrlk
• Scripting APIs: http://tinyurl.com/3ezykda
• Channel 9 videos:
• The Roslyn Project - Meet the Design Team 
• Going Deeper with Project Roslyn: Exposing the C# and VB compiler’s code analysis 
• http://blogs.msdn.com/b/visualstudio/archive/2011/10/19/introducing-the-microsoft-roslyn-ctp.aspx
• http://blogs.msdn.com/b/csharpfaq/archive/2011/12/02/introduction-to-the-roslyn-scripting-api.aspx
• http://visualstudiomagazine.com/articles/2011/11/16/the-roslyn-scripting-api.aspx

Video: Injecting C# DLLs into Managed (C#) and Unmanaged (C++) processes

I was finally able to inject O2's REPL scripting environment into other processes (both managed and unmanaged)

Originally I was just trying to inject a managed dll into another .NET process, but the 4.0 .NET Framework will load up a CLR when it is not there, so this technique will also work on unmanaged (i.e. C++ based) applications.

Here is what happens in the video below:

• Inside O2,  run the Util - Inject O2 into other processes.h2 script (which will provide a nice 'Injection GUI')
• on the left there is a TreeView with a list of all current processes that have MainWindowHandle != 0 (a requirement at the moment)
• on the right there is a TreeView with a list of the loaded modules (i.e. dlls) from the selected process
• if you right-click on the process list you will be able: 
• bring the process window to front, 
• refresh the process list and 
• do the injection into the selected process
• Open LinqPad using the link from the 'Actions Panel' (on the top)
• After LinqPad opens, select it on the process list and click on the 'Inject O2 into Process' link (top left)
• An O2 REPL environment will apear. A number of scripts are dynamically created, showing that we now have complete control over the LinqPad GUI, by for example:
• injecting a new Tab with another O2 REPL Editor
• making the entire GUI pink or azure :)
• Close LinqPad and back in the Util - Inject O2 into other processes.h2 click on the 'Open Calc' link to open Calc.exe (an unmanaged windows app (i.e. no CLR))
• After Calc opens, select it on the process list and click on the 'Inject O2 into Process' link (top left)
• A come more scripts are written to show that we are indeed inside the Calc.exe process.

This open up a LOT of interesting integration possibilities, and it is a much more solid solution that the use used before which required O2 dlls to be copied into the target's application folder (see Injecting O2 into IBM Rational AppScan Standard and Creating a Pink version of IBM Rational AppScan Standard)

Related Posts:

• Video: Injecting compiled C# script into a Managed Process (using Snoop API) 
• Video of O2 Platform v4 Installer and quick demo of its scripting tools 
• Video: Installing O2's VisualStudio 2010 Add-In 
• Video: NodeJS O2 REPL environment (using node.exe) 

Video: Injecting compiled C# script into a Managed Process (using Snoop API)

Following from O2 Script to Inject Snoop into process with WPF control here is the next step where I was able to inject an O2 compiled dll into another .net Process.

Here is the video showing this in action (the script is already on O2's GitHub repository)

Video: O2 Script to Inject Snoop into process with WPF control

Here is a example of using the O2 Platform to consume other tools capabilities.

In this case we are going to use the powerful Snoop API to visualize and manipulate the WPF controls hosted on another process.

Snoop is very powerful and it uses a pretty sweet remote process injection to do its trick. The O2 Script you can see below invokes directly the process injection sequence (after starting a process with a WPF control)

Here is a video that show this in action:

And here is the script:
This next video was created when trying to use Snoop to find VisualStudio's TextEditor WPF control (see Snoop Tips & Tricks #1: Ctrl-Shift Mouse Over  for a much faster way to find an WPF child control):

Related Posts:

• Video: Injecting compiled C# script into a Manager Process (using Snoop API) 
• Video of O2 Platform v4 Installer and quick demo of its scripting tools 
• Video: Installing O2's VisualStudio 2010 Add-In 
• Video: NodeJS O2 REPL environment (using node.exe) 
• Visualizing TeamMentor Link's structure (with Graphs) 
• 39 O2 Platform videos with 12k YouTube views 
• Documenting how to test WebServices using scripts - the story so far 

Video: Injecting TeamMentor into Cat.Net running inside VisualStudio

Here is a pretty cool PoC where I used the O2 VisualStudio 2010 APIs to inject TeamMentor into Cat.NET.

To replicate this you will need:

• O2 AddIn installed (see how to install O2 in VisualStudio)
• CatNet Add-in installed (download Cat.Net installer from here)
• Local instance of TeamMentor with OWASP library (download it from here, or clone it from here)

Here is a video that shows the install process in action, and the extra functionality added to Cat.Net

Video: Running Chrome Natively in O2 and VisualStudio

UPDATE (Jan/13): See PoC - Selenium - Gui with 3 Hijacked Browser Windows.h2 post for a much better and powerful way to consume Chrome (and IE and Firefox) in another process

---

Following from Run Chrome inside O2  and Installing and running CefSharp (C# Chrome with WPF Browser) here is the full implementation of running Chrome as a Native C# WinForms and WPF control.

This is pretty powerful since Chrome is FAST. I also like the fact that I can easily embed Chrome in WinForm or WPF control with a couple lines. (take a look at these scripts)

Here is a video showing the PoCs in action (with the examples using WPF doing a 360 rotation, because they can :) )

Video: NodeJS O2 REPL environment (using node.exe)

NodeJS is pretty amazing, I was able to get the node.exe (from here) and run its REPL environment with only that exe (no other installation or dependencies needed!).

Since it was that easy, I added NodeJS support to the O2 Platform and created a couple REPL editor environments which make it easy to consume NodeJS.

Here is a video of these new O2 Scripts (note how easy it was to create an NodeJS webserver :)

Some NodeJS references:

• NodeJS main site: http://nodejs.org (with commercial support provided by Joyent)
• Installing and Running node.js applications within IIS on Windows - Are you mad? 
• Node.js vs. ASP.NET Web API css
• What is Node.js? 
• Node.js, Doctor’s Offices and Fast Food Restaurants – Understanding Event-driven Programming 
• What so different about Node.js's event-driven? Can't we do that in ASP.NET's HttpAsyncHandler? 
• How to pass command line arguments to node.js? 
• The secrets of Node's success radar.
• Projects, Applications, and Companies Using Node 
• Useful when starting using NodeJS
• Taking Baby Steps with Node.js
• Don't debug with JSON.Stringify
• JSON Round Trip with node.js 
• How to stop a node.js server without killing the process? 
• NodeJS tools
• Browser base debugger
• Running NodeJS on IIS:
• https://github.com/tjanczuk/iisnode
• Hosting node.js applications in IIS on Windows 
• Azure NodeJS developer center
• Azure NodeJS HelloWorld
• Debug node.js applications on Windows with iisnode integrated debugging 

Video: Installing and running CefSharp (C# Chrome with WPF Browser)

UPDATE (Jan/13): See PoC - Selenium - Gui with 3 Hijacked Browser Windows.h2 post for a much better and powerful way to consume Chrome (and IE and Firefox) in another process

---

After we were able to Run Chrome inside O2  here is O2's native support for the CefSharp API (note that the first time that API is used, the install files will be downloaded and unzipped locally (if 7zip is not installed locally, it also will be downloaded and installed)

Here is the video that shows the CefSharp (C# Chrome) WPF and Windows Browser Controls in action:

Related Posts:

• Running Chrome inside O2
• Video: Installing and running CefSharp (C# Chrome with WPF Browser)
• Video: Running Chrome Natively in O2 and VisualStudio 

Video: Installing O2's VisualStudio 2010 Add-In

Here is a video that shows the steps required to install O2's Visual Studio 2010 Add-in (also described in this post Running O2 REPL Script environment inside Visual Studio 2010)

Video: Under the hood of O2's REPL Script Environment

Here is a video that shows what happens under the hood when you write an O2 Script.

The concept is quite simple: Grab the code in the Editor and insert it inside a full blown C# method inside a class (using comments to indicate extra using and dll references).

This way we have the best of both worlds. Full C# 4.0 coding capabilities (like the new Dynamic objects) in a much nicer/simpler REPL scripting environment.

Here is a video that shows this in action:

Video: O2's DWR support (and two-way Javascript manipulation)

This is an oldie one, but I was talking with an O2 user about O2's ability to send and receive data from Javascript (via the IE object), and this DWR is a great example of that.

Note how in the video the data sent to the DWR test server is manipulated (on the client side) by the Javascript (shown on the left) that is injected into the browser:

Video: O2 Platform - Using FuzzDB on AltoroMutual for XSS and SQLi (with screenshot after payload)

Here is a video that shows a couple of O2 Scripts in action:

• View FuzzDB XSS Payloads (after a first-time-run installation)
• Fuzz AltoroMutual site with FuzzDB SQLi payloads, taking a screenshot after each request and colour coding the vulnerable status
• Fuzz AltoroMutual site with  FuzzDB XSS payloads, taking a screenshot after each request and colour coding the vulnerable status