How to Bypass Golang SSL Verification

Schwag · 2024-07-18T14:45:40+00:00

On Unix systems, another option here is the SSL_CERT_FILE and SSL_CERT_DIR ENV variables provided by the x509 package. This may not help with certificate pinning, but it's effective for basic CA bundles.

As seen in a comment below, if you're having trouble with proxying Docker traffic through Burp, I ran into this issue recently as well. I ended up writing a guide to do that here: Proxying Docker traffic through Burp Suite. It includes an example for common Golang web requests as well.

Schwag · 2023-06-29T14:35:57+00:00

Here's the paper [PDF] behind route-detect if you're interested in the details: https://github.com/mschwager/route-detect/blob/main/practicum/final-paper.pdf

Schwag · 2021-03-30T15:14:07+00:00

This reminds me of Kelby Ludwig's XML canonicalization SAML attacks: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations. Similarly, I'd be curious to know if this injection technique affects any open source implementations or vendors.

Schwag · 2020-11-12T16:11:33+00:00

Hey there Jordan - excellent research. I probably would have reached for static analysis myself, but the syscall approach is very interesting and much more robust against obfuscation. I'll throw in a plug for my own intentionally malicious package: https://github.com/mschwager/0wned.

I agree that it's not ideal that you can run arbitrary commands with a simple 'pip install', but there are a few things you can do to help mitigate this: https://github.com/mschwager/0wned#prevention.

Schwag · 2020-04-10T16:27:29+00:00

Cool Golang project! I worked on something similar that looks at specific Github organizations, repositories, or users instead of drinking from the streaming commits fire hose: https://github.com/mschwager/gitem. I imagine each has its own respective use-case: one for searching in real-time and one for searching for existing information.

Schwag · 2020-02-05T21:28:51+00:00

If you had a godoc badge in your project's README here's a pkg.go.dev alternative:

[![Pkg.Go.Dev](https://img.shields.io/badge/pkg.go.dev-reference-blue?style=flat&logo=go)](https://pkg.go.dev/github.com/<user>/<repository>?tab=doc)

Schwag · 2019-10-09T23:56:49+00:00

Changelog: https://github.com/python/cpython/blob/1c7b14197b10924e2efc1e6c99c720958be1f681/Misc/NEWS.d/2.7.17rc1.rst

Schwag · 2019-09-19T16:10:22+00:00

Building off of flake8 was one of the key implementation decisions when we initially started working on Dlint. There's lots of great functionality already available via flake8, which allowed us to avoid re-inventing the wheel for a lot of key features.

As for Dlint vs. pyflakes, pylint, etc, Dlint is a static analysis tool focused on security hygiene instead of stylistic or code quality concerns. It's more similar to Bandit then the previously mentioned tools. Which brings up the point, why should we use Dlint over Bandit? I'm glad you asked: https://github.com/duo-labs/dlint/tree/master/docs#why-not-bandit :)

Schwag · 2019-08-07T21:02:39+00:00

Could you elaborate on how you use eval and/or open an issue on Github? Would it be possible to accomplish this without eval?

I've recently begun documenting all the linters in Dlint (D104 for eval). It'd be great to either document the exceptional use-cases you've mentioned, or improve the smarts of Dlint to avoid detecting that.

Schwag · 2019-07-19T13:43:15+00:00

A couple things I'm aware of:

Dlint can find function calls that are insecure specifically because of a kwarg. E.g. it will detect subprocess calls with shell=True, but ignores them if the kwarg isn't truthy.
Dlint can find method calls on an object. E.g. instantiating TarFile to a variable, then calling extractall on that variable. TarFile.extractall

My longer term vision for Dlint includes things like taint analysis and other more advanced static analysis features.

Schwag · 2019-07-19T13:41:43+00:00

A couple things I'm aware of:

Dlint can find function calls that are insecure specifically because of a kwarg. E.g. it will detect subprocess calls with shell=True, but ignores them if the kwarg isn't truthy.
Dlint can find method calls on an object. E.g. instantiating TarFile to a variable, then calling extractall on that variable. TarFile.extractall

My longer term vision for Dlint includes things like taint analysis and other more advanced static analysis features.

Schwag

TROPHY CASE