Interview With Indrajith A.N - Security Researcher From India

Hello Readers, We Interview Indrajith A Security Researcher from India and he tell us about his Story into this field, A Girl said to him "I will ask my brothers who are working in the corporate to hack Your Facebook and Gmail Account". That's how things changed for Indrajith and got Fames from Top Companies listed but not limited to Apple, Google, Sony, HTC, Bugcrowd, AVG and others. He reveals alot of ideas on Security and also as Bug Bounty is concerned.

Also Read: Interview With Penetration Testers And Ethical Hackers From Around The World

indrajith

Hello, Indrajith Introduce Yourself To Our Readers


Well, I’m Indrajith.AN from India, currently pursuing Masters in Computer Application and Information System from Amrita University, India[Mysore Campus]. Mean while doing my research work on enhancing security in high performance in cluster computing environment and the same  research work got accepted by JATIT ( An International scientific research journal which is indexed in Elsevier SCOPUS). After the media published more about the Technology Hacks of "Anonymous" & other famous teams was so interested and wanted to know, how the things works and if it's really that much easy to hack a website/system, so it is just like i started it as my hobby. There after i gone crazy about this field, I got started in Web Application Security Research about 1.5 years ago by working with 70+multinational companies, internet leaders and biggies like Google, Microsoft, Apple, Oracle and etc.

When Did You Start Hacking And Tell Us About Your Experience?


I didn’t even dreamed about that I will be into this field, But that was a day one and half year back(i still remember) a Girl rebuked me saying that “I will ask my brothers who are working in the corporate to hack Your Facebook and Gmail Account” [The day which turned my life], i was like is are these things possible? Being the internet leaders, even these domains are so much easy and vulnerable to attackers? and started reading about those in the internet and ended up my days with installing Trojans & key-loggers and totally messed up with my PC where a funny batch script called fbhacker.bat shredded my entire 500GB hard disk. Later on i involved myself deep into some Black-Hat forums and YouTube Channels then i just got some flow in some basics of hacking and other stuffs like Rooting a Server, Uploading Shells, Symlink Bypass, Mass Deface etc and started hiding myself under some elite proxies and VPN's .The same continued for 8 more months.

How You Started The Journey As A Security Researcher?


NO!! I didn't dive into the Security Research directly and again no I'm not actually sure that I'm a "Researcher". If am not wrong, Researchers are the ones who does novel and work, writing their research papers in LaTeX. I wish i had planned to do the same one day :p but For now, I'm just a do-er and a Cracker, striking out largely the same bugs in different places, and I have tired to be a best at it that I can.
So it kind of started as a hobby and it was around mid of 2014 i just asked myself about "Am i getting anything if i hide myself under the proxies and defacing some D grade website?" So again it was on Aug 2014 that i just hit a U.S.A based email service provider with kick-ass SQL injection where i got the entire database with users, admin credentials and Credit card information's of millions of users but on that time i have never heard anything call Bug Bounty and Responsible Disclosure Programs. So just like trial and er i contacted the Dev Team of that email service provider and Reported them regarding my findings later i just forget about that since i did-not get any reply and a very fine day i got a mail asking my shipping address to send me t-shirt i was like Wow and thought that with reporting some bugs we can grab some (*_*) swags (*_*) and reported some more bugs to get some more swags but the super excitement thing was that i was asked to send my PayPal address for the token of USD-$450 i.e. around 30,000/- INR. So that was the time which turned my entire life to get deep into the web application security research. It feels awesome when companies acknowledge your works and efforts. Being a student, it has also offered a nice way to earn some money with fame, so after my first success i dived completely into the web application Security topics. Around those time, i came to know about BugCrowd, Hackerone and Crowdcurity(cobalt) and started to participate in different bug bounty programs and in 2015 i was ranked one of the top 90 security researcher among the competitive 19,890 security researchers from all over the Globe0. later, got some cash rewards and commendations from the companies like.

aknowldgement

Then I’ve recently started to take it more sternly and planned to spend more time in it.

How Did You Start Learning Hacking And Who Taught You?


None!! I neither depended on any one nor on any certifications, Cause I know they teach for their business and specially this is the area/domain which needs passion and complete involvement/dedication which will not come just by passing some D Grade Certifications. So I just started increasing network of people in this field and a year back I met a guy from Iran in some underground IRC group chat he helped me a lot when I stuck some where at last I came to know that he is taking to the wrong way by brainwashing me to involve with them by hacking banks and  targeting USA sites and I left them too. And Now I believe a teacher in me :)

Which Website/System Did You First Break Into?, What’s The Vulnerability?


I don't want to mention the site and the company that i pwnd first but it was an SQLI where i was able to dump the entire database into paste-bin with the fresh Credit card info's :p and also and Local File Inclusion attack where i can execute the shell remotely and i didn’t even dream that the server that am uploading a shell will contain 500+ domains where i can mass deface it with a single shot.

mass deface

Then SQL injection in ESET nod-32(world known antivirus) website where i was able to dump the license keys of million users and 107 reflected xss in one of the Microsoft's sub-domain.

What Advise Will You Give To Beginners Coming Into This Field?


First and for most thing i would like to suggest for the beginners not to depend on any certifications regarding Hacking/Pen-Testing, Instead believe in yourself, Believe a teacher in you, Engage yourself in the underground Black-Hat Forums and YouTube Channels. stuck with strange doubt?? no worries create a thread in a forums and start discussing about that. Meet other Bug Bounty and App Security People, Attend more security conferences. Find people to compete against and learn from. Follow Security Geeks on LinkedIn and Twitter.

Spend your precious time in participating some online/on-sight CTF Challenges and read the Old CTF Challenges Solutions, so that it will be a great way to learn more about Vulnerabilities and How To Exploit them, in a practical way. Playing CTF's with making a local teams in colleges is also a great way to make new connections in this field. Get in soon on new bug bounty programs, so you will be having less chance for duplication on the “Easier to find” bugs. Soon after that, Focus on improving the quality of your bugs and reports, Finally, for those who have not yet started on bug bounties: No worries just dive into the bounty pool, thank me later you will find bugs and it will be worth your time .When i talk to some App Sec people talking about the public BB programs which are not worth their time because “all most all the bugs have been already reported”. NO!! that is definitely not the case!

Before getting into the bug bounties, i suggest the beginners to have complete understanding about RFC2616 i.e Hyper Text Transfer Protocol HTTP--1.1 .Then You can start with the bug bounty by reading OWASP Top 10 and WASC 26 Classes, when it comes to practically learning the attacks you can practice it on the vulnerable environments like SVWA ,OWASP Mutillidea, DVWA, Hackme, Webgoat etc..
The straight forward suggestion is to have a well plan on how to approach a target system For example our methodology which You'll have to take a broad look at the target and get a feel for it. What functionality does it contain? How does the target system react to unpremeditated usage? How do Developers wants people to use their system/website and how is it not meant to be used actually? After these steps, you can go for low-hanging, most common flaws like XSS, SQLi, CSRF, and so on.

But that is not enough, since you want to get the juicy fruits which are at the top. You need to think of more complex vulnerabilities or critical exploitation chains. In the end, surely u will have all the fruits in your basket.
And specially for the beginners - stick to find the bugs which are white-listed in scope. It can be literally hard to think "because a bug is a bug and the bad guys don't have a scope" but you should still turn them to the scope .Also the disappointment of an out-of-scope rejection, the exasperation you'll cause the client for poking at what they didn't want poked, isn't worth it.

LinkedIn connections, groups, company's careers section and public mailing lists you should consider them as your friends. If you wish to understand what you are possible to encounter in a very given stack, see what variety of developers, QA and operations skill-sets a corporation is following or adopted. A quick explore for posts to public mailing lists from 'corporate' email addresses may also greatly facilitate your understanding of the tools an corporation has used to build / deploy their application.

Always Be Closing. Clients/BB program creators typically realize the complete impact of a bug or could take it through to a logical conclusion that you simply did not or could not dig through to, just in case they squash the bug while not considering its full impact, so its your responsibility to create it best-known. Code a bit of JavaScript that bypasses CSRF or leaks sensitive information from the DOM so they do not get snug with "Well our cookies are HttpOnly therefore XSS got nothing on us". Find some great way's to bypass their Content security policy[http://www.thespanner.co.uk/2009/11/23/bypassing-csp-for-fun-no-profit/]. Write a script that enumerates an IDOR if you are in a very testing sandbox and will not be touching sensitive customer data.

Once you have got the bug out, make a good Quality Report - do not let your great bug to go down . Make it shine. A very good bug reported poorly could be a poor submission. Give a shape to your report that will be shown to management as justification for the program's expenditure. Digging deep and reporting the same is fun, you will be happier with your own work, and you will typically be higher rewarded for it. And one more thing, i,e network! most of us mostly don't gain knowledge from others just to show their standards off, i mean Learn from others, blog, communicate on Twitter, teach others, grasp your tools, forever be learning, stay sharp and have fun! and finally! get additional sleep! If you are continuously working on a problem that you have been working on it for a few hours, take a nap and get back to it after you've had a moment to gather your thoughts.

What Methodology Do You Use When Participating In A Bug Bounty


Usually I follow the OWASP Testing Guide and Methodologies (OWASP TOP 10 ) in my daily hunting. By the time Bugcrowd Bounty started i was not having much time to follow any specific testing methodology because of too much competitions and moreover i don't seem to be alone testing the target system - All researcher around the Globe will be testing it.
So i will create my own check list together with the OWASP Top 10 and SANS Top 25 and find the low-hanging fruits within the list. I see most of the Pen-Testers believe on the results of Automated Tools like Acunetix, Netsparker etc however I think nothing can replace with manual Pen-Testing. I start by exploring the sub-domain or an acquisition because we can make our main door more secure than a window in the same kitchen. And also make Use of Google Hacking techniques to further narrow down the target for information gathering.

Do You Have A Specific  Area to Focus Or Specialty In Penetration Testing That You Tend To Spend Your Time On?


I usually Explore a WebAapp and picks off  CSRF, XSS, Session Management Issues, Access Controls, IDORS(simple but tragic) and more straightforward issues. Then I will go to figure out the working of features in that target app  with an assumption that there will be a security loop hole which hopefully pans out. I also spend a lot of time on logical issues in the web apps.

How Do You Keep Your Skills Fresh?


Oh, i don't think we need Ninja Skills right - Simply updating Acunetix/Netsparker to the latest version is enough, isn't it? ;) :v ?Just kidding - The best way is getting a glance of security e-Books, Blogs, Awareness about the Zero days and latest Threats and White papers. A lot of people share their knowledge about new attack vectors and their defense better to have a good read of it.

What Do You Think and What’s Your View On The Future Of Bug Bounties Programs?


I can see Bug Bounties as being complimentary to Modern Application Testing and also becoming much more predominant. This should also increase payouts as companies compete for their program to get more attention. I think the future is bright for all involved. Consumers will be secure and safer, Companies will get chance to learn about and mitigate the Bugs before they become embarrassing news stories, and Independent Security Experts are paid fairly enough for their efforts.
i just saw some Companies offering $1 and $2 for severe security issues and i can understand that those Companies don't have that much money to invest into Bug Bounties Programs but i personally suggest people will be more happy with a fancy T-shirt than $9 in their pocket. And before starting a bug bounty programs i would like to give a small suggestion to the companies like instead of considering First Come First Serve technique we can go like 50% for the FCFS basis reports and 50% for more qualitative reports, which is the methodology followed by keybase.io i pretty loved it.

There seems to be more companies running Bug Bounty Programs in some forms recently, which I see as a huge positive and profit for freelance researchers and the organizations themselves and as its result to their customers. I'd like to see more organizations to participate in Bug bounty, we'll see what’s going to happens..

Is Programming Language Really Important, Why? And Which Language To Learn


Often Appsec people give the advice to beginners to learn at-least one programming language when they first start (usually Python) and then they tell them to learn a few more MYSQL, JavaScript, PHP, HTML & CSS.So at this point there no longer a Script Kiddie, but they also will have close to no knowledge of Security either (have probably figured out how to exploit something here or there.)

Next try to learn about Ports and TCP/IP. So at this point they have a good knowledge of how the internet operates (TCP/IP and Ports.) and how the internet is built (HTML & CSS, JavaScript, PHP, MYSQL).Somewhere in that mix try learn about Linux. So now they know there way around a command line. Also may know a little about Linux System Administration.
Let me break down why you need to have at least a basic knowledge of all these languages:
Python --> Writing scripts to automate basic tasks
JavaScript -->When your scanner reports that there is a an XSS vulnerability and you don't have XSS tools to help you. Necessity will force you to learn it.
MYSQL --> Biggest vulnerability to a company == Credit cards stolen. Credit cards are stored in databases. Being able to work your way around databases leads to the big vulnerabilities. Need to know how to do SQL injections.
HTML & CSS --> Need to know how to read websites to find XSS and SQL inject vulnerabilities.
The same applies to PHP, HTML/CSS, C, TCP/IP and whatever else you might stumble upon.
The key here is what we in programming terms call lazy evaluation. There is little point of investing resources into something that might not be needed. So by doing it experience first you will gain Pentest Experience and argument it as required.
Sure you will not know every obscure MySQL command by heart but you will have proficient with the tools of Pen-testing. You will be able to hack stuff maybe not all the stuff you encounter and that is your spur.
The reason behind beginners to learn programming languages is so they will learn about how a computer operates. I cant say it is 100% mandatory to know all these languages it will be helpful if you do know them.

What Are The References/Best Resources To Get Started?

There is no end if i keep on giving references to learn cause it s endless but i would like to give a link where you can get 90% of the flow on all these below topics.
SQL Injection(Pics) [Highly Detailed]
Introduction to Burp Suite
XPath Injection Tutorial [Pics/Detailed]
Basic WAF Bypassing And Intrusion Detection
HR's Guide to XSS Shell & XSS Tunnel
Local File Inclusion Tutorials
Remote File Inclusion Tutorials
Rooting Tutorials & SymLinking Tutorials
Shelling Websites and Using Shells (Backdoors/etc)
Shell uploading and finding [TUTORIAL]

http://hackforums.net/showthread.php?tid=2008347 [Need registration to access the content]

The sites which i like and provides the most up-to-date information on a wide variety of cyber security news like emoticon
http://www.security-faqs.com
http://www.thehackernews.com
http://www.stopmalvertising.com
http://www.secmaniac.com
http://www.korben.info
http://www.sectechno.com
When it come to the Bug Bounty and Pentesting , i would like to suggest this book " The Web Application Hacker's Handbook " by Dafydd Stuttard and Marcus Pinto.

How People Can Reach You?


ping and roll

Catch me in some Security conferences and also tracer out me through,
Email:- [email protected]
Facebook:https://www.facebook.com/indrajith.cyberXdestroyer
LinkedIn:- https://in.linkedin.com/in/indrajith-an-2a9070b8
Website:- https://www/indrajithan.com/

Thanks For Your Time Indrajith. :)

 

No comments

Powered by Blogger.