GitLab Security AMAs, 1 Jun 2022

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Live GitLab Ask a Hacker AMA with Johan Carlsson (@joaxcar) Bug Bounty / Security Researcher

Description

We chat with bug bounty hunter and web developer, Johan Carlsson (@joaxcar on HackerOne) about how he got his start in bug hunting, what his workflow looks like and his sources for continual learning.

* See the notes from this AMA: https://docs.google.com/document/d/1M_LQbo5LqNKTKdN88FBkK-gIyULe1-HvyQDFLqTi0kA/edit?usp=sharing
* See Johan on HackerOne: https://hackerone.com/joaxcar?type=user
* See our AMA playlist: https://www.youtube.com/playlist?list=PL05JrBw4t0Kqvvpk9PmRO6fZ0xmnKBp_s

A

We're just loading.

A

And we're in we're just loading.

B

All right cool uh welcome everyone to the gitlab security teams, hacker ama series, uh we're really excited to host johann carlson for today's ama johan is a web developer by day and within the last year he started bug bounty hunting and has already made his way quickly on our top 10 hacker hackers contributor list on hacker1 johann. Would you like to introduce yourself a little bit.

C

Yeah sure so my name is juwan coulson, I'm living in gothenburg in sweden and, as he said, I'm a web developer.

C

Also from like a year ago, I've been doing a lot of other stuff earlier in my adult life here and went back to computers and did some university here for three years and I started working last year and actually did my first interaction and connection with the gitlab and bugbantis. Through my.

C

I don't know what you call that, but my bachelor thesis uh from university, uh so that was my like first reports to you guys. uh What's uh during that time, and now I live with my family, I have three kids and having a hectic life.

B

That's fantastic! Thank you for the intro johann. Let's go ahead and dive into the questions we have for today for the first one heather. Would you like to vocalize your question.

A

Of course, I would but I'm over here um multi-talking about to post this link on to uh twitter. So let me find my question.

A

All right, oh yeah, so it's super impressive that you went from what you call having zero knowledge and bug bounty hunting to landing on our top ten. um What do you think has enabled you to be so successful or successful in my eyes and in the eyes of our program, and do you have any other tips for newcomers when it comes to diving into bug, bounty hunting.

C

Yeah, so I can begin with clarifying probably that zero knowledge is a a big statement when you have just finished like three years of university uh computer science. uh So I of course I knew stuff about uh computers and the web and everything, but I had no zero experience in bug, hunting and then didn't know that much about it, security or all these web related issues like cross-site, scripting and whatever. I didn't know uh anything about that.

C

uh I think that my what have worked for me is like a genuine interest. I guess and uh perseverance like just I kind of when I get into something I kind of start tinkering a lot with it and it becomes like my only focus and I go around and think about it during the days when I have some time over and stuff like that. So I think my my tip would probably be like to keep it interesting, uh because otherwise it's really hard. I guess, to to find anything or to be successful. Then.

A

Thank you hey. um I think you have the next question.

D

Yeah, the next two, even I see you, you have diversified a bit and now half of your hacker one reputation points come from other bug: bounty programs, congrats and have you seen anything fun in other programs that we should consider implementing on our own bug, binding program.

C

Yeah, so um I have been diversifying uh because I get a lot of invites, of course, on hack, one, that's kind of how it works. When you find something, then you start getting. These invites most of it.

C

I haven't had time to look at at all, but uh I have been using it to like learning and test out some more like simple or, as I call like off-the-shelf uh vulnerabilities that are not as present in in git lab and your program at the moment, but so finding some more more like basic csrf issues or cross-site scripting issues and stuff like that, but also some other, like really interesting things.

C

When I um get to use like all the like other tools and uh using burp a bit more and stuff like that, which I don't do on git really.

C

But what I have something that I've seen is, and that's probably because you're a big player on the hacker one, at least so you're. Not. I guess you don't have the time uh to be as personal on like every report as to like the small programs that maybe have like 15 reports or something.

C

um But I really like the the programs that do like a lot of like community things like special, time-bound promos, and that answers a lot and quick quickly in the reports.

D

Ooh yeah, that makes sense, um and this the other question I had was: uh how do you pick which part of gitlab you're going to dig into? Do you read a release post or do you look at old bugs or what do you do.

C

Yeah, so that my my process there, if I can call it that it's very like hazards, I I used to I kind of just stumble up upon things.

C

I do read like the release post every month and then I wait patiently for the security release, which is even more interesting, and I found a lot of most of the time. I find the areas of gitlab, which I haven't seen or noticed before, and it doesn't necessarily mean that I find a bug that is like really similar to the one, but it points me in some direction and I start digging that way. But I've also found issues by just like randomly clicking on issues on your issue.

C

Tracker that I find interesting like someone reporting a weird behavior and start digging into that and all of a sudden, you find a new way.

A

C

The program it's interesting.

D

Thank you is eduardo on the call for the next question you can can voice it I'll. Just read it. um Could you describe in more detail the business model of bug bounty? Do different companies offer different prices for the same type of bug.

C

Yeah, I guess that's it's a bit tricky question for me, because uh uh the business model, depending on, if you ask like the hacker or the the program- I guess um for me- I I really I I'm trying to push on like impact- should be rewarded. I guess, and also like thorough research and good reporting. That's what I try to push when I speak with programs and triage teams, and that also includes like, of course, a bug on one program like a cross-site. Scripting is a good example.

C

It can be like very critical on programs like gitlab, where you can access really sensitive information, and you can uh muck around with the company's uh ci cd flows and deployments and stuff, and on some programs like an xss is really nothing, so I actually think it should pay differently. Yes,.

D

I guess I'll keep reading, because the next person is probably asleep in amazing.

A

D

Now, uh what do you think about uh get that secure coding guidelines? Anything is missing. Have you looked at them.

C

Yeah, I've looked at them like browsed through it sometimes, but now I took a look at it when I I saw the question and uh it's really impressive. I need to dig into it more because I have some like hints for what I should look for. I guess, as I I'm I have never like written a single line of ruby. uh I haven't even like read it before.

C

I started digging into your code base, so it's been like a really confusing uh long, uphill battle there, navigating the code base, and so the the guidelines have some good tips for me. Yes, uh what I as a developer, I I guess it can be hard, even if you someone says like ssrf to you and they try to explain it. It's really hard to know like. Why is this even important, uh and you have to be like reminded again and again like what's the actually the problem here?

C

So what I I really like your like is cvss calculator that you have created and if I were a developer, I would like, like a calculator like that, like I've been developing a feature that I could just like. Click through these questions, and then I get some tips like you should really look into like this this and this part of this guidelines, because it's quite long and to read it through like every time, it's probably time consuming.

D

Oh great feedback and I'll keep going. Samantha is not present right now. um Are there any resources, books, courses, websites that you found really helpful when you started into this and you would recommend to a newcomer.

C

uh Yeah so my my main source of information was just the hackerone activity and especially then, the the git club activity feed of like disclosed reports. uh That was during my like the the bachelor thesis thing.

C

So I did actually like I scraped like the hundred the reports that you can get from hacka1 and red through them all and took notes and stuff like that, and that is kind of my main source of information other than that it's been like you know all over the place on the internet and some ports figure information, but the hackerone things are really great.

C

That's also why I try to disclose the reports that I send in that. I like myself, because I kind of want to give back and give other people the opportunity to learn from it.

D

That's awesome thanks thanks for doing that and from samantha again what is the most interesting bug or bug that you're most proud of that you uncovered, and how did you discover this bug.

C

So I'm I'm still kind of most proud of one of my. I think it was my second valid report uh and the third as well. It was like a multiple issues and I had this. I had this really really long discussion with andrew back and forth about this feature, which are like this project access tokens which were like implemented in a rather special way where you created this bot user, um and I it was a my the first time that I really like just found a bug by thinking about it.

C

I actually found it while shopping showing as uh before, going to sleep- and I just had this like revelation like. If I do this, then I probably can elevate my privilege and then it worked. It was a really really great feeling.

D

It's more like a logical bug that you created um is muhammad on the call. I don't think so.

D

All right continue hi johann. Do you have any tips for beginners, I'm currently studying system security? Can you share with us how to build a carrier in this in this course in security.

C

uh Yeah, so I guess my answer. That would be that I don't really know because I don't have a career in in it security. Yet um I'm uh like my tips, would probably it's just kind of the same with like how to like my first answer to heather there.

C

I guess like just to find some part of it that you find really interesting and and stay in that area uh if it generates like bug bounties or if it's in, like ctfs or hack, the box kind of things, uh at least as long as you find it interesting. I think it's a lot easier to to get somewhere, but then also like keeping a presence online like on twitter and linkedin, and so I guess you get contacted by people if you like start showing your work.

D

Good good tips, um we have another question from yuki osaki who's, not on the call right now. Well, what is your workflow to find a vulnerability? Do you run gitlab in your local environment, as opposed as to testing on gitlab.com.

C

Yeah, so I have kind of three environments. I guess I have a couple of accounts on gitlab.com, which I use regularly for testing, and then I also have this local installation from kind of source or like the arc. Linux thing it's a nightmare to keep it up to date, but I have my gitlab ultimate license in there. It's in a closet over here, which I use when I need to access like a feature that needs to. I need to be like admin on an ultimate box.

C

Otherwise I also use this docker like just spinning up local servers on my machine. If I need to test this like admin stuff without the ultimate license, um but other than that, my workflow is kind of just like browsing around trying to find new areas, doing it on my phone a lot of times like reading issues and stuff like that, and then when I find something I start like digging in reading source code trying so a lot of times.

C

I find like the source code for it, but I have no idea like how to get there in the application. So I have like find a way uh into that spot and then start uh trying to figure out if there is a vulnerability in there.

D

C

When I find a something, I start, that's the best part when you find like this entry point, and I you start like digging and trying to escalate it to something um something impactful. I guess, and sometimes it's succeed and sometimes it's just like a regular bug that doesn't affect anything.

D

And from uk again, do you have any sites? You refer to or tool library recommendations for finding vulnerabilities other than reading the gitlab issues, as you, as you mentioned,.

C

Yeah well, as a lot of people have often references like port swigger academy and portuguese, like cross-site scripting list for tips. There also like reaching out to some people on twitter.

C

If I know that someone is like really good at something, I can try to ask them, but I don't really have like this single source. Where I go to, I guess, except for yeah the the like resolved issues of the hacker one reports, but on your issue tracker, because then I can also read like how you tried to fix something or what your discussion and thoughts how they went and stuff like that and like related posts and it's a gold mine.

D

And a very serious question from me: uh do you have some sort of hacking, pre-game ritual, do you you have you set up at the same time of the day, do you drink the same thing eat the same thing you're on the couch.

C

No so my I have quite I don't have that much time to do this. Actually, it's usually just during evenings or late nights when um sitting in front in the sofa in front of the tv and then I kind of sneak my laptop up when the other family falling asleep, and then I poke around on some things and yeah. So that's that's it whenever I find the time to do it. I guess.

D

Sounds good? Stefan, I see your typing in question.

D

We can you're not muted, but we can't hear you.

D

All right, I can read the question.

D

We can't hear stefan sorry but.

B

I think maybe try now.

A

You know what thumb you just got you just. I.

D

Just muted myself.

D

Great great zooming, all right stephan asks uh having gone from being new to bug bounties to being as established as you are in our program. uh Is there something that you would go back and tell your past self to do better when you were new.

C

Well, I try not to think like that, because then you go on this like spiral downwards, like yeah, I could have started eight years ago or whatever so now I try to just look forward to try to be, or of course I should take notes that irritates me, like all the time when I I stumble up upon. Like the same thing, I have to google and look through and try to find this issue where someone mentioned how to do something, and I just have to find it again so taking notes.

C

I should have done that from the start, and- and I should begin now, but I'm just pushing it into the future.

A

I thought of a question that I didn't add, which kind of um might follow on to what you just said johann, but we discovered through twitter that there are some hackers that are that use gitlab issues to help to track and collaborate on their hack. Do you use gitlab at all for that, and maybe now that you want to start taking notes.

C

So I I don't really use git lab.

C

Should start, I guess uh no, I I I actually I've started the tinkering with that uh myself like because it's also great you can write like the markdown.

C

Like start writing your reports like, while researching and saving some time there and like taking notes and stuff uh I've. Actually I've started doing it since I I read about it, and I also read some blog posts about connecting like an obsidian note-taking thing to the gitlab pages, so I have a.

C

I began began doing it but, as I I said like I have a, I don't have that much time and usually I I get stuck in just looking for more vulnerabilities.

C

It's happened to me all the time when I try to like write a blog post or whatever it just stands up for I'm just sitting and looking at new stuff. Instead.

A

I mean that's not terrible if you do start using it. I want to know about it.

A

All right that looks like all the questions and in the doc does anybody have any question that they didn't get to ask in the doc.

A

All right that was me accidentally hitting siri over here um all right, james, I'm gonna kick it over to you. Then.

B

um Yeah, if there's no more questions, uh thank you huge. Thank you to you, johan, for taking the time to answer all of these and and to do the ama and thank you to everyone for joining as well. We had a lot of great questions today. I believe this uh is available immediately right on youtube uh for the recording um yeah and we we hope to see everyone uh on the next one.

C

B

C

For having me, thank you.

A

Awesome thanks so much johan. Thank you. Everyone thanks.

C

You all see you later.

C