ReproNow - Save time Reproducing and Triaging Security Bugs
Lakshmi Sudheer, Vinayendra Nataraja at AppSec California 2018
Crowdsourcing security aka Bug Bounty Programs are adapted by almost all companies today: big, small, mid size. While companies reap a lot of benefits, the challenge is to have a security engineer/engineers reproduce each of the bug, understand the replication method and spend time recreating the security bug that the researcher reported. And sometimes (read all the time) it may also require a lot of going back and forth with the researcher to reproduce the vulnerability. As security engineers we felt the pain as well and we created a tool that solves this challenge and helps organization focus their resources on resolving these vulnerabilities and strengthening their security posture.
Our tool is an open source software and an easy to install browser extension. A researcher can install this extension on their browser and record the entire walkthrough of the vulnerability. Our tool captures not only the screen but even Network requests. So, a researcher can capture the entire session and submit this video to the organization. Then, the security engineers who validate this can play the video on the tool and see the exploit in action. They don’t have to spin up Burp Suite or other bazillion tools and again spend time on reproducing the entire thing. The tool also lets you search for a string, therefore you can jump to a specific payload to see the exploit. This makes triaging much easier, saving engineers valuable time.
Vinayendra Nataraja is a Senior Product Security Engineer at Salesforce and an independent security researcher. He has been in the security industry for 5 years now and holds a Masters degree in Information Security from Northeastern University. He leads the bug bounty efforts for Salesforce and also helps teams to build a secure application.
Lakshmi Sudheer is a Security Researcher at Adobe. She holds a Master of Science in Information Security from Northeastern University and has been in the security industry for about 4 years now. At Adobe, she works on solving challenging security issues across products and the organization. She has experience helping with bug bounty efforts and has been actively interacting with researchers in the security community.
Our tool is an open source software and an easy to install browser extension. A researcher can install this extension on their browser and record the entire walkthrough of the vulnerability. Our tool captures not only the screen but even Network requests. So, a researcher can capture the entire session and submit this video to the organization. Then, the security engineers who validate this can play the video on the tool and see the exploit in action. They don’t have to spin up Burp Suite or other bazillion tools and again spend time on reproducing the entire thing. The tool also lets you search for a string, therefore you can jump to a specific payload to see the exploit. This makes triaging much easier, saving engineers valuable time.
Vinayendra Nataraja is a Senior Product Security Engineer at Salesforce and an independent security researcher. He has been in the security industry for 5 years now and holds a Masters degree in Information Security from Northeastern University. He leads the bug bounty efforts for Salesforce and also helps teams to build a secure application.
Lakshmi Sudheer is a Security Researcher at Adobe. She holds a Master of Science in Information Security from Northeastern University and has been in the security industry for about 4 years now. At Adobe, she works on solving challenging security issues across products and the organization. She has experience helping with bug bounty efforts and has been actively interacting with researchers in the security community.