FIRSTCON21 - June 8 | Stream 3 Part 2 (14:30-15:30 UTC)
summary
Presents concrete methods to find newly exposed hosts: ingest certificate transparency logs, extract SANs and resolve A/AAAA while deduplicating into a database (services often appear 48–72 hours after cert issuance); DNS brute force with a top‑20 list or Markov chain DBF; IPv6 heuristics (compressed addresses, memorable hex patterns, brute forcing known /64s), BitTorrent tracker n6 harvesting, reverse PTR dumps, passive DNS and BGP feeds (RIPE RIS). Shares code like ct‑scotianize and a domain classifier, and notes 85% randomized IPv6 from CIRCL measurements.
AI-written summary · about
chapters (36)
- 0:00Introduction
- 1:28Presenter focus
- 2:09Internet-wide scanning challenges
- 3:58Vulnerability discovery strategies
- 6:02Certificate transparency for scanning
- 8:29Advantages and drawbacks of certificate transparency
- 9:55DNS brute forcing
- 11:40DNS brute forcing with Markov chains
- 12:24IPv6 brute forcing
- 14:10IPv6 scanning challenges
- 15:35Public IPv6 address sources
- 16:17BitTorrent trackers for IPv6
- 17:43Reverse PTR DNS for regional scanning
- 19:27GitHub for scanning
- 20:51New domain lists for scanning
- 21:53Passive DNS for active scanning
- 22:13BGP monitoring for vulnerable networks
- 23:15Network telescopes analysis
- 24:18Active scanning summary
- 24:38Scanning techniques GitHub
- 25:21Q&A
- 26:27Next presentation intro
- 28:43New speakers setup
- 30:11Situational awareness defined
- 32:16Need for situational awareness
- 35:22Activity regulation explained
- 38:13Daily analyst operations
- 41:24ANSSI incident response modes
- 42:49Cyber defense situational awareness
- 45:19Major incident response SA
- 47:29Situation reports purpose
- 49:55Situational awareness missions summary
- 51:01Tailored analysis challenges
- 52:27Human resource challenges
- 54:11Team value milestones
- 57:05Q&A
related talks
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
44mNetsec is Dead(?): Modern Network Fingerprinting for...
31mNew Techniques for Split-Second DNS Rebinding
26mInternet Scanning - Current State and Lessons Learned
26mMisuse of DNS, the Second Most Used Protocol
43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocks
32mSomething’s Phishy: See the Hook Before the Bait
43ma journey...