Thomas Debize

### Overview In this talk, Thomas Debize presents an empirical study examining the landscape, lifecycle, and development practices of information security (InfoSec) tools over the past decade. While foundational utilities such as Nmap and THC Hydra have remained in active use since the late 1990s, the InfoSec community has seen a massive influx of modern tools driven by accessible Internet-wide scanning, social coding on platforms like GitHub, and growth in blue team defense and bug bounties. Debize evaluates thousands of tool publications and GitHub repositories to uncover hosting trends, maintenance lifespans, programming language preferences, dependency health, and vulnerabilities, concluding with a set of actionable recommendations for modern tool development.

### Key Topics - **Data Sources and Tool Publication:** Analysis of metadata from four major InfoSec tool repositories and publication sources: Packet Storm, ToolsWatch, KitPloit, and NoWhere (leveraging structured data from the norse-corp / feed source). Over time, KitPloit emerged as a primary aggregator, while overall tool creation has trended steadily upward since 2010. - **Hosting Dominance:** A review of hosting platforms (GitHub, Bitbucket, SourceForge, and Google Code) showing that around mid-2013, GitHub established overwhelming dominance as the single hosting platform for InfoSec software, raising minor concerns regarding platform dependency. - **Repository Metrics and Maintenance:** Analysis of approximately 23,000 InfoSec repositories on GitHub to measure stars, forks, watchers, releases, and issue resolution. The findings show that tools average approximately 2.5 years of active maintenance, with strong issue-closing engagement. - **Programming Languages and Dependency Ecosystems:** Identification of Python as the overwhelmingly dominant language, followed by shell, HTML, C, and JavaScript, with emerging growth in C#, Go, and Dockerfiles. A deeper dive into Python packages reveals heavy reliance on general libraries like `requests`, `beautifulsoup4`, and `lxml`, alongside security-specific modules like `scapy`. - **Security Hygiene and Vulnerabilities:** Assessment of Python dependencies against vulnerability databases (via PyUp.io), exposing frequent use of unmaintained libraries (such as `pycrypto`) and pinned, outdated versions of packages like `django` and `requests` with known CVEs.

### Technical Details - **Dataset Processing:** The study analyzed approximately 7,000 records from Packet Storm, 1,500 from ToolsWatch, 3,000 from KitPloit, and 1,000 from NoWhere using Dataiku (a French data platform) and automated GitHub API queries. - **Repository Statistics:** The average GitHub InfoSec tool repository accrued roughly 1,000 stars (median: 200), an average tool size of 15 MB (median: 1 MB), an average of 70 pull requests total, and an average maintenance duration of 2.5 years (though some mirrored legacy projects, such as `samplicator`, date back to 1999 commits via backdated imports). - **Top Repositories:** Leading repositories by stars and forks heavily feature offensive tools, including Metasploit, SecLists, Jadx, Ghidra, and mitmproxy, while high open issue counts frequently appear in defensive projects such as MISP. - **Crypto Library Deprecation:** About 30% of surveyed Python tools requiring cryptography still utilized `pycrypto`, which has been unmaintained since 2013 and carries known flaws; Debize emphasizes migrating to `pycryptodome` or `cryptography`. - **Version Pinning Risks:** Analysis indicated widespread strict pinning (`==`) in `requirements.txt` to vulnerable releases of `django` and `requests`, preventing security updates.

### Takeaways and Golden Rules for Modern Tools Debize outlines practical guidelines for authors to ensure their security tools remain scalable, usable, and maintainable: 1. **Standard Argument & Input Parsing:** Use standard libraries such as Python's `argparse` rather than deprecated modules, and support input files processing one entry per line rather than only single targets. 2. **Architecture & Formats:** Adopt modular architectures (similar to Recon-ng) to facilitate community plugins; output data in structured formats like JSON or CSV (avoiding Excel formats); and enforce UTF-8 character encoding. 3. **Concurrency:** Use `concurrent.futures`, choosing multithreading for I/O-bound tasks and multiprocessing for CPU-bound operations. 4. **Enterprise Compatibility:** Provide tiered verbosity (info, warning, debug), support corporate proxy traversal (HTTP and SOCKS), and support Windows corporate authentication (NTLM and Kerberos). 5. **Packaging and Delivery:** Avoid rigid dependency pinning, publish packages to PyPI, provide pre-built binaries or Docker containers to aid both red and blue teams, and ensure network communications are properly encrypted.