#HITB2016AMS CommSec Track D1 - Pentesting Chatops

This HITB 2016 Amsterdam talk presents ChatOps—coordinating pentesting operations through a central chat platform—as a transformative methodology for distributed security teams. Radically Open Security (ROS), a non-profit security consultancy with freelancers spanning global time zones, adapted GitHub's ChatOps concept for pentesting workflows using Rocket Chat (an open-source Slack alternative) as the operational hub.

The core innovation involves Hubot/Rawbot, a chat bot that integrates pentesting tools (nmap, w3af, sqlmap, Hydra, nikto, Shodan/Census passive scanning) and workflows via CoffeeScript-based integrations. Pen testers launch scans, crack hashes, and orchestrate exploitation entirely from chat. The automated reporting system uses XML templates and XSLT to compile structured findings into PDF reports—pen testers trigger this process from chat via commands that clone GitLab repositories, process files, commit results, and return download links.

A significant differentiator is inviting customers into the chat room as observers or participants. This transparency provides real-time visibility into scans, git commits, phishing campaign metrics, and findings—far exceeding traditional pentesting's limited engagement touchpoints. This strengthens trust, accelerates knowledge transfer, and has proven highly successful commercially.

ROS pioneered "red-blue pen testing," turning security assessments into gamified competitions. In one engagement, a customer's development team was split into competing squads, each guided by professional pen testers, with a Hubot scoreboard awarding points for discoveries. Over one week, the team found 40 vulnerabilities including a complete attack chain, receiving security education at the cost of a standard two-week engagement.

The organization operates as a non-profit fiscal fundraising institution, directing 90% of profits to the NL Net Foundation (supporting projects like Tor, EFF, Jitsi). At the time of the talk, ROS employed approximately 40 global freelancers and served 30+ customers. The speaker emphasizes open-sourcing tools and raising industry standards through transparency, encouraging competitors to adopt their systems and viewing industry-wide improvement as more valuable than competitive advantage.

Key technical components include Rocket Chat (self-hosted), Hubot for bot functionality, XML/XSLT for report generation, GitLab/GitHub with integrated webhooks for real-time commit notifications, and Kanban boards triggering chat reminders. Input sanitization and access controls ensure security when customers access operational chat rooms. The approach transforms pentesting from isolated backend work into collaborative, visible teamwork benefiting distributed organizations and customer engagement.