ReproNow: Save time Reproducing and Triaging Security bugs

on YouTube ↗44m

" summary

Open-source browser extension that records screen plus HTTP traffic, packages the network JSON inside an MKV so a single file embeds network JSON into MKV, and runs entirely client-side. Built with getUserMedia/mediaRecorder, chrome.webRequest, ffmpeg.js with ts-ebml fallback, and exports requests as curl lines to load into Burp; exports curl for Burp. Works in Chrome/Opera (Firefox support pending), cannot capture response bodies because of API limits, and demonstrably reduces reproduce/triage back-and-forth time.

AI-written summary · about

" chapters (14)

1. 0:00Start
2. 0:45Introduction about Ourselves
3. 3:24Set Up a Bug Bounty Program
4. 3:58Setting Your Rules
5. 6:58What Information a Security Engineer Would Need To Actually Triage a Bug
6. 7:43Sample Reports
7. 16:35Screen Capture
8. 17:19Media Recorder Api
9. 17:48Code for the Screen Capture
10. 18:57Chrome Debugger Api
11. 19:19Chrome Web Request Api
12. 26:33Ffmpeg
13. 29:04Demo
14. 35:31Automatically Triaging Security Bugs

" related talks

• 45mReproNow - Save time Reproducing and Triaging Security BugsVinayendra Nataraja, Lakshmi Sudheer · OWASP AppSec California 2018
• 08mOvercome the trap of reproducing test failures with smart troubleshootingThanh To · TestFlix 2020
• 27mReverse Engineering a Private APIJoyce Lin · CascadiaJS 2022
• 09mSession ReplayRyan Albrecht · Vueconf.US 2023
• 23mBURPing for DevelopersFelix Winkelkötter · code.talks 2022
• 08mHow Big Buck Bunny helped track down bugsEvan Farina · Demuxed 2020
• 54mRemoving the gag from your browserJared Wyles · Web Directions Code 2012
• 43mAround the Web in 80 Hours: Scalable Fingerprinting with Chromium AutomationIsaac Dawson · CODE BLUE 2016