APPSEC Cali 2018 - Hunter - Optimize your Pentesters Time

### Overview At AppSec California 2018, Karen Shirali discussed the challenges eBay faced managing a high volume of penetration testing requests for internal applications and how they optimized tester resources. eBay employs a hybrid model of internal staff and external consultants to handle fluctuating demand across numerous internal developer-built systems and third-party tools. However, roughly 20% to 25% of penetration test report findings were consistently composed of easily detectable, repetitive configuration issues—referred to as "true positive pentest noise"—such as deprecated TLS versions, weak ciphers, and missing or misconfigured security headers. Because documenting and retesting these low-hanging issues consumed valuable consultant time and budget, eBay developed an automated, lightweight pre-requisite tool named Hunter to filter them out before applications enter the pentest queue.

### Key Topics - **Internal vs. External Pentest Scoping**: External systems like eBay.com have robust context and secure SDLC controls, whereas internal applications vary widely in language and framework, often lack source code access (e.g., COTS software), and are scoped in 2–3 week engagements with external consultants. - **The True Positive Noise Problem**: Findings like SSL 3.0/TLS 1.0 support, missing cookie flags, or absent HSTS/CSP headers represent real vulnerabilities, but spending expensive consultant hours identifying and retesting them detracts from uncovering critical business logic flaws. - **Failure of Self-Certification Checklists**: An initial attempt to enforce a manual 10-to-15 item checklist with pre-canned configurations failed because engineering teams lacked security expertise, applied fixes incorrectly, or claimed compliance without effective verification. - **Pre-Engagement Gating with Hunter**: Developing a fast, simple self-service scanner that grades endpoints and enforces a strict prerequisite (e.g., requiring an 'A' grade before entering the queue) eliminated false claims of readiness.

### Technical Details - **Tool Architecture**: Hunter is a Python-based application using Django and Django REST Framework. The front end provides a minimal single-input interface where developers supply an HTTP endpoint and receive a letter grade (initially A to C) in under 30 seconds (often 3 to 5 seconds locally). - **Underlying Scanning Modules**: Hunter incorporates Alban Diquet's `sslyze` (from Data Theorem) alongside additional Python libraries to audit endpoints. - **Checks Performed**: - Protocol and encryption auditing: Flags SSL 3.0 (with heavy penalty deductions), discourages TLS 1.0/1.1, and verifies TLS 1.2 support alongside cipher evaluations against recommended lists. - Security headers: Evaluates Strict-Transport-Security (HSTS), Content Security Policy (specifically catching bypasses like `unsafe-eval`), and cookie security attributes. - **Scoring Engine**: Implements a weighted deduction model (e.g., SSL versions deduct 20–25% of the total score). Future roadmap items include decoupling scoring rules into an admin configuration, LDAP/SSO integration to persist scan histories, periodic automated re-checks, and internal CA/self-signed certificate verification.

### Takeaways Enforcing Hunter as a mandatory gate for internal systems dramatically reduced repetitive configuration findings by double-digit percentages. Filtering out this noise shortened pentest durations, minimized tedious retest and remediation loops, lowered external consulting costs, and allowed testers to focus their time and energy on complex business logic vulnerabilities.