Corelan "Advanced" with Peter Van Eeckhoutte Corelan is back at Hack In Paris for the 6th time, offering the 'Advanced Win32 Exploitation' course again.
The Corelan® “ADVANCED” exploit development class is a fast-paced, mind-bending, hands-on course where you will learn advanced exploit development techniques from an experienced exploit developer. This is most certainly not an entry level course. In fact, this is a one of the finest and most advanced courses you will find on Win32 exploit development. This is a truly unique opportunity to learn advanced exploitation skills from “corelanc0d3r”, the founder of Corelan Team, author of mona.py, and author of numerous tutorials on Exploit Development for the Win32 platform. You will leave this class with an arsenal of tools, techniques and insights that will allow you to find bugs more easily, understand and manipulate the Windows heap, diagnose and understand heap corruptions and write complex exploits. Students are expected to understand the basics of memory management on Windows (stack, heap, process virtual memory layout), master stack based buffer overflows (saved return pointer overwrites, SEH overwrites), and have practical experience with ASLR & DEP bypass (i.e. you must be able to write ROP chains yourself).
Additionally, students should be fluent with debuggers (Immunity / notions of WinDBG), experienced with writing simple scripts in python/javascript and have a basic understanding of common assembly instructions. This is a fast-paced hands-on class, packed with knowledge and practical tips & tricks. Prepare for long days of brain smashing, bleeding from the eyes & ears and high blood pressure. Speakers  Peter Van Eeckhoutte Peter Van Eeckhoutte is the founder of Corelan Team and the author of the well-known tutorials on Win32 Exploit Development Training . The team gathers a group of IT Security enthusiasts and researchers from around the world, who all share common interests: doing research, gather & share knowledge, and perform responsible/coordination disclosure. Above all, the team is well known for their ethics and their approach to helping other people in the field. With his team, he has developed and published numerous tools that will assist pentesters and exploit developers, and published whitepapers/video’s on a wide range of IT Security related topics (pentesting tools, (malware) reverse engineering, etc). The team also moderates a forum that provides a platform for people who want to talk about exploit development, and operates an IRC channel (freenode, channel #corelan). Peter has been an active member of the IT Security community for close to 15 years and has been working on exploit development for 10 years. He presented at security conferences (Athcon, Hack In Paris, DerbyCon) and delivered the Corelan Live Win32 Exploit Development Bootcamp at various places around the globe. He trained security enthusiasts & professionals from private companies, government agencies and military. You can read more about their experiences on his website. | 3 days | €2,100.00 | €420.00 | |
Developing Burp Suite Extensions - From manual testing to security automation with Luca Carettoni Burp Suite is a powerful integrated platform for web application security. In this hands-on class, attendees will learn how to design and develop Burp Suite extensions for a variety of tasks. In just few hours, we will work on plugins to improve manual security testing efforts as well as to create fully-automated security tools. This workshop is based on real-life use cases where the extension capabilities of the tool can be unleashed to improve efficiency and effectiveness of security auditing. As an attendee, you will bring home a full bag of tricks that will take your web security skills to the next level. Prerequisites Attendees are expected to have rudimental understanding of Burp Suite as well as basic object-oriented programming experience (Burp Extensions will be developed in Java). While Burp extensions are developed live in Java, attendees can work on Python or Ruby since all exercises are also provided in those languages. Target Audience Suitable for both web application security specialists and developers. Material to bring by attendees Attendees should bring their own laptop with the latest Java as well as their favourite IDE installed. Speakers  Luca Carettoni With over 14 years of experience in the application security field, Luca Carettoni is a respected web security expert. Throughout his career, he worked on security problems across multiple industries and companies of different size. He is the co-founder of Doyensec, an application security consultancy working at the intersection of offensive engineering and software development. At LinkedIn, he led a team responsible for identifying new security vulnerabilities in applications, infrastructure and open source components. Prior to that, Luca worked as the Director of Information Security at Addepar, a startup that is reinventing global wealth management. Proud to be a Matasano Security alumni, he helped bootstrapping the Silicon Valley office by delivering high-quality security assessments to software vendors and startups. As a security researcher, he discovered numerous vulnerabilities in software products of multiple vendors including 3com, Apple, Barracuda, Cisco, Citrix, HP, IBM, Oracle, Sun, Siemens, VMware, Zend and many others. Since the beginning of his career, he has been an active participant in the security community and a member of the Open Web Application Security Project (OWASP). Luca holds a Master’s Degree in Computer Engineering from the Politecnico di Milano University. | 2 days | €1,200.00 | €240.00 | |
Finding and attacking web applications in PLCs and other critical devices with Bertin Bervis Critical and sensitive infrastructure is becoming a new way to make money for cybercriminals. Taking advantage of vulnerabilities in PLC web applications the attacker found a way to get persistence- and nice point entries to infect and take over the whole infrastructure. In this course we will cover how an attacker with proper OSINT research and web application security knowledge can achieve persistence in browser in order to expand the attack to the whole facility /infrastructure. The course will be hands on all the time, providing the attendees real world examples and techniques in order to find critical devices in the internet, from a smart home control to the power grid control/monitoring and so on.. PLC's webservers and other services provides useful information in order to recognize them - even if MODBBUS protocol is not possible to be detected, there are also other protocols and ways to find PLCs connected to the internet, we will cover how to get the device fingerprint correctly from modbus and also how snmp and other protocols can help us to find them in the internet. Let's write quickly in python a very useful tool in order to extract MODBUS device information string, also how to extract the ssl metadata and other useful data for PLC recognition. Every year a new device/technology for industrial monitoring purposes is being deployed to the internet without the proper security code testing, this leads to find easily well know security issues in web applications. Let's exploit some PLCs in real time and check the impact of what we found. We will dissect 2 PLC's web applications 0-days found recently from well know vendors in the industry. At the end there'll be a little challenge spotting vulnerability in a real PLC. Course outline - Introduction
- Real critical/sensitive device attack escenarios
- OSINT is your friend
- Recognition techniques
- Web application analisys
- Let's exploit something!
- Now is your turn, Spot the vulnerablity in a real PLC
Who should take this course - Pentesters
- Researchers
- Industrial facility technical staff
Pre-requisites - Basic knowledge of industrial protocols
- Basic knowledge of python
What attendees will be provided With - A list full of fingerprints for critical devices seen in the training
- Recogniton Tools
- Slides
What attendees should bring Speakers  Bertin Bervis Bertin Bervis is a security researcher from Costa Rica and he is interested in industrial security research , currently is working for a cyber security firm in Santiago de Chile called CyberTrust Spa as security consultant, Bertin has been speaker in several security conferences around the world like DEFCON , Blackhat And Ekoparty. | 1 day | €600.00 | €120.00 | |
Hardware hacking training with Hardsploit & Drones with Julien Moinard Tired of watching hardware products getting hacked every day without having your part of fun ? Don't worry it will not be the case anymore! This training teaches you hardware hacking in its most pragmatic aspects by using both theory and practice (hands-on). It follows a simple (but efficient) training methodology based on a "Discover / Analyze / Attack & Protect" guideline that can be applied to any kind of hardware product (Internet of Insecure Things included). Each student will receive a Hardsploit hardware hacking tool, with a value of 250 euros. Course Description This course smartly mix methods and tools in order to give you all the necessary knowledge to be able to perform hardware security audits by yourself. The last part but not least our "Capture The Drone" hands-on to complete the training by practicing what you have learned in an attack/defense scenario featuring our favourite small flying things. Target audience - This course is intended for everyone having an interest in security aspects related to hardware products or embedded devices.
- Electronic enthusiasts and professionals
- IT security professionals
Hardware/software Requirements - Latest VMware Player, VMware Workstation, VMware Fusion (VirtualBox not garanted)
- Hard disk : Minimum 15GB of free space
- RAM : 4GB Minimum 6GB recommended
- Minimum dual core CPU (Intel prefered,I3 I5 or I7)
- 64 Bits OS with administrator access : Windows, Linux or Mac os
- Virtualization instructions activated
- 2 free USB port
All students will be provided with - Full copy of the course
- One Hardsploit tool board for hardware security audit (see hardsploit.io)
- Training board (try again at your home)
- Few more goodies
Course Syllabus MODULE 1: Hardware Hacking 101 - Review of electronic basics, motivations for hardware hacking, brief history of hacking security talks
- Hardware security vulnerabilities review, offensive & defensive aspects
- Practical cases for hardware hacking analysis
- Hands-on : Basic electronic components use & fingerprinting
MODULE 2: How to access to the hardware for hacking / audit purpose - Review of methods & tools to perform hardware security audits
- Create your own audit plan, differences with software pentesting
- Hands-on : Practice exercises with hardware auditing tools
- Hands-on : How to acquire electronic signals, tools & demonstration
MODULE 3: How to access the software inside the hardware - Embedded system architecture presentation (Microcontroller, FPGA), direct access to the software via I/O interfaces (JTAG / SWD, I2C, SPI, UART, RF (ISM Band), etc.)
- Hands-on : Firmware dumping through different types of interfaces
- DEMO : Power analysis attacks - Indirect access to the software or sensitive content via side channel attacks
MODULE 4: Complete hacking lab - Full hands-on session to apply practical case on our vulnerable embedded system
- Hands-on : Identifying electronic components
- Hands-on : Electronic signals acquisition
- Hands-on : Bus signals interception and analysis (with Hardsploit)
- Hands-on : Modifying and dumping firmware via JTAG debug function (and other I/O access) (with Hardsploit)
- Hands-on : Fuzzing external interface to spot basic vulnerabilities in embedded systems
- Hands-on : Buffer overflow attacks on embedded system
- Hands-on : Exploiting vulnerabilities during a hardware security audit
MODULE 5: How to protect your hardware products - Secure Design and Development Life Cycle (SDLC)
- Review of hardware security best practices to limit the risks
- Hands-on : Limit JTAG access, limit software vulnerabilities at embedded level
- Review of protections against side channel attack (limit power analysis attacks)
MODULE 6: SDR Hacking - SDR hacking methodology (Software Defined Radio)
- Tools of trade (GNURadio, hardware products, etc.)
- Hands-on : How to reverse a wireless protocol from scratch ( communication with wireless LED screen, like on the highway)
MODULE 7: CTD Capture The Drone - Attack / Defense practical scenario team (Capture the Flag Mode)
- Each team has a mini-drone.
- Hands-on : Defend your drone and take down the others by using the tools and methods learned
- The winning team is the one with the higher-flying time
Speakers  Julien Moinard Julien MOINARD, is an electronic engineer with a solid background in this field (over 8 years) & Security consultant, associated with many personal and professional experiments in the field of micro controllers. Furthermore, he contributes to the Hardsploit project as a project leader. He is also a senior hardware pentester at SERMA SAFETY AND SECURITY. Julien attended as a trainer at Hack In Paris & BlackHat and as a speaker to numerous conferences,Hack In The Box, NullCon,CanSecWest, Chaos Computer Club, BlackHat. | 3 days | €2,400.00 | €480.00 | |
Making & Breaking Machine Learning Systems with Clarence Chio Making & Breaking Machine Learning Systems is a fast paced training session on machine learning from the infosec professional’s point of view. In this training, students will not only get hands-on experience with developing intelligent, learning security applications, but also learn the techniques for training, tuning, and evaluating such systems. The course is positioned for security professionals who are interested in machine learning, but may not have any practical experience with it. Machine learning is becoming increasingly ubiquitous in a variety of fields, and security professionals educated in this subject matter are better positioned to assess the (often lacking) security postures of machine learning algorithms and systems. This class does not promise that students immediately become machine learning experts, but does ensure that all applications and techniques learnt can be directly and immediately applicable to the work done by security engineers, penetration testers, application developers, and infosec enthusiasts alike. Overview Making & B reaking Machine Learning Systems is a fast paced session on machine learning from the Infosec professionals point of view. The class is designed with the goal of providing students with a hands-on introduction to machine learning concepts and systems, as well as making and breaking security applications powered by machine learning. The lab session is designed with security use-cases in mind, since using machine learning in security is very different from using it in other situations. Students will get first hand experience at cleaning data, implementing machine learning security programs, and performing penetration tests of these systems. Each attendee will be provided with a comprehensive virtual machine programming environment that is preconfigured for the tasks in the class, as well as any future machine learning experimentation and development that they will do. This environment consist of all of the most essential machine learning libraries and programming environments friendly to even novices at machine learning. At the end of the class, students will be put through a CTF challenge that will test the machine learning development and exploitation skills that they have learned over the course in a realistic environment. Preview We will post a video soon. What to bring? - Latest version of VirtualBox Installed
- Administrative access on your laptop with external USB allowed
- At least 20 GB free hard disk space
- At least 4 GB RAM (the more the better)
Prerequisites - Basic familiarity with Linux
- Python scripting knowledge is a plus, but not essential
Who Should Attend? - Security Professionals
- Web Application Pentesters
- Software/application developers
- People interested to start using machine learning for security
What to expect? - Familiarizing yourself with popular machine learning algorithms and how to adapt these for different problems
- How to clean and sanitize data using powerful data processing libraries in Python
- How to build a spam classifier and online anomaly detection system in Python
- How to do performance evaluations of machine learning classifiers
- Examples for using machine learning in intrusion detection, botnet detection, phishing detection, web vulnerability analysis, malware classification, and behavioural analysis
- Perform tuning of machine learning systems to improve classification/detection results
- Perform security evaluations and penetration tests on machine learning systems
- Fuzzing machine learning classifiers
- How to avoid vulnerabilities in machine learning system and algorithm design
- How to use Apache Spark to design scalable and distributed real-time machine learning systems
- Write your own machine learning captcha solver
What not to expect? To be a machine learning expert in just three days. This training will impart you all the necessary skills to start building security software using machine learning and teach the lesser known ways of exploiting such systems. Students need to put in further work and use the skills learnt in the class to continue their explorations in machine learning and keep up with the latest developments in this fast evolving field. Course Syllabus Day 1 - Introduction to machine learning
- Hands-on guided exploration of Python machine learning libraries:
- Data-wrangling using Numpy and Pandas
- Scikit-learn’s functions and capabilities
- Data visualization using Matplotlib/Seaborn
- Walkthrough of the most commonly used machine learning algorithms (with quick hands-on examples/visualizations for select algorithms)
- Supervised learning algorithms
- Linear/logistic regression
- Support Vector Machines
- Decision trees/Random forests
- Unsupervised learning algorithms
- Hierarchical/k-Means clustering
- Semi-supervised learning
- 2-hour example: Building (and bypassing) an email spam filter with scikit-learn
- Loading data efficiently
- Using a labeled email/spam corpus training and test set, extract salient features to build a word model of spam
- Model tuning, cross-validation, and evaluation process
- With complete knowledge of the system, manually craft a piece of spam to bypass the filter
Day 2 - Lecture on application of machine learning in the security/abuse space
- Spam, fraud, malware, phishing, and intrusion detection short examples
- Principles behind selecting the best machine learning models for different use-cases
- Considerations when using machine learning in an adversarial/malicious environment
- Deep learning for security
- Using Keras/TensorFlow for anomaly detection with convolutional neural networks
- Choosing the appropriate model for implementing different types of problems
- efficacy comparison of different machine learning techniques for solving the anomaly detection problem, and what other considerations to have
- 2-hour example: Building a simple network intrusion detection system with 2 different machine learning models
- Importance of understanding the data and the threat model before designing a solution for the problem
- Model tuning, cross-validation, and evaluation process
- Guided comparisons of the performance characteristics for each Implementation
- Visualizing and presenting the data for ease of analysis by security operation professionals.
Day 3 - Streaming pipelines for machine learning using Apache Spark MLlib (PySpark)
- Overview of Apache Spark
- General architecture
- Distributed, scalable machine learning deployments with Spark
- Guided example of a streaming architecture for network anomaly detection using reinforcement learning on Spark
- Evaluating the security of machine learning systems
- Techniques and guided example of fuzzing a classifier and regressor to find blind spots in the model
- Evaluation of intelligent learning system architecture that is resilient to model poisoning by an adversary
- Machine Learning CTF challenge - captcha bypass challenges (using captcha character classification starter code provided)
Speakers  Clarence Chio Clarence graduated with a B.S. and M.S. in Computer Science from Stanford University, specializing in data mining and artificial intelligence. He currently works as a Research Data Engineer at Shape Security, a startup in Silicon Valley building a product that protects from malicious bots and automated attacks on Global 2000 customers. At Shape, he works on the big data analysis systems that are used to tackle this problem. Clarence spoke on Machine Learning and Security at PHDays 2015 in Moscow, BSides Las Vegas 2015, Code Blue Tokyo 2015, SecTor Toronto 2015, and BSides NYC 2016. He had been a community speaker with Intel, and is also the founder and organizer of the "Data Mining for Cyber Security" meetup group, the largest gathering of security data analysis professionals in the San Francisco Bay Area. | 3 days | €1,800.00 | €360.00 | |
Offensive Mobile Application Exploitation - iOS & Android with Prateek Gianchandani Even wondered how different attacking a Mobile application would be, from a traditional web application? Gone are the days when knowledge of just SQL Injection or XSS could help you land a lucrative high-paying infoSec job. After the introduction of iOS 10 and Android 7 Nougat, We are bringing an updated version of the course with the latest tools & techniques. This will be an introductory course on exploiting iOS and Android applications, suited well for both beginners as well as advanced security enthusiasts. The training will be based on exploiting Damn Vulnerable iOS app, Android-InsecureBankv2 and other real-world application vulnerabilities in order to give an in-depth knowledge about the different kinds of vulnerabilities in Mobile applications. This course will also discuss how an attacker can secure their application using secure coding & obfuscation techniques. After the workshop, the students will be able to successfully pentest and secure applications running on the various operating systems. The training will also include a CTF challenge in the end where the attendees will use their skills learnt in the training to solve the CTF challenges. The students will be provided with Slides, tools and VMs used during the course. Prerequisites - Basic Linux knowledge
- Experiecne on any mobile testing is a plus
- Willingness to learn
Target Audience This course is for penetration testers, mobile developers or anyone keen to learn mobile application security Material to bring by attendees - A jailbroken device (iPhone/iPad/iPod). Please contact the trainer if you are having difficulty in arranging one
- Computer with atleast 20+GB of hard disk space and 4 GB of RAM
Course Syllabus Part 1 - iOS Exploitation Module 1 : Getting Started with iOS Pentesting - iOS security model
- App Signing, Sandboxing and Provisioning
- Setting up XCode 8
- Changes in iOS 10
- Primer to iOS 10 security
- Exploring the iOS filesystem
- Intro to Objective-C and Swift
- What's new in Swift 3 ?
- Setting up the pentesting environment
- Jailbreaking your device
- Cydia, Mobile Substrate
- Getting started with Damn Vulnerable iOS app
- Binary analysis
- Finding shared libraries
- Checking for PIE, ARC
- Decrypting ipa files
- Self signing IPA files
Module 2 : Static and Dynamic Analysis of iOS Apps - Static Analysis of iOS applications
- Dumping class information
- Insecure local data storage
- Dumping Keychain
- Finding url schemes
- Dynamic Analysis of iOS applications
- Cycript basics
- Advanced Runtime Manipulation using Cycript
- Method Swizzling
- GDB basic usage
- Modifying ARM registers
Module 3 : Exploiting iOS Applications - Exploiting iOS applications
- Broken Cryptography
- Side channel data leakage
- Sensitive information disclosure
- Exploiting URL schemes
- Client side injection
- Bypassing jailbreak, piracy checks
- Inspecting Network traffic
- Traffic interception over HTTP, HTTPs
- Manipulating network traffic
- Bypassing SSL pinning
Module 4 : Reversing iOS Apps - Introduction to Hopper
- Disassembling methods
- Modifying assembly instructions
- Patching App Binary
- Logify
Module 5 : Securing iOS Apps - Securing iOS applications
- Where to look for vulnerabilities in code?
- Code obfuscation techniques
- Piracy/Jailbreak checks
- iMAS, Encrypted Core Data
Part 2 - Android Exploitation Module 1 - Why Android
- Intro to Android
- Android Security Architecture
- Android application structure
- Signing Android applications
- ADB – Non Root
- Rooting Android devices
- ADB – Rooted
- Understanding Android file system
- Permission Model Flaws
Module 2 - Understanding Android Components
- Introducing Android Emulator
- Introducing Android AVD
Module 3 - Proxying Android Traffic
- Reverse Engineering for Android Apps
- Smali Labs for Android
- Dex Analysis and Obfuscation
- Android App Hooking
Module 4 - Attack Surfaces for Android applications
- Exploiting Local Storage
- Exploiting Weak Cryptography
- Exploiting Side Channel Data Leakage
- Root Detection and Bypass
- Exploiting Weak Authorization mechanism
- Identifying and Exploiting flawed Broadcast Receivers
- Identifying and Exploiting flawed Intents
- Identifying and Exploiting Vulnerable Activity Components
- Exploiting Backup and Debuggable apps
- Dynamic Analysis for Android Apps
- Analysing Proguard, DexGuard and other Obfuscation Techniques
Module 5 - Exploitation using Drozer
- Automated source code analysis
- Exploiting Android embedded applications
Speakers  Prateek Gianchandani OWASP member and contributor has been working in the infosec industry for about 5 years. He is currently working as an Information security engineer for an airlines company. During his five years, he has performed a number of penetration tests on mobile and web applications and even developed a lot of applications for the App Store. His core focus area is iOS application pentesting and exploitation. He is also the author of the open source vulnerable application named Damn Vulnerable iOS app and also runs a popular blog series on iOS application security at http://highaltitudehacks.com/security. | 3 days | €1,800.00 | €360.00 | |
Offensive PowerShell for Red and Blue Teams with Nikhil Mittal Penetration Tests and Red Team operations for secured environments need altered approaches. You cannot afford to touch disk, throw executables and use memory corruption exploits without the risk of being ineffective as a simulated adversary. To enhance offensive tactics and methodologies, PowerShell is the tool of choice. This training is aimed towards attacking Windows network using PowerShell and is based on real world pen tests and Red Team engagements for highly secured environments. The course runs as a penetration test of a secure environment with detailed discussion and use of custom PowerShell scripts in each phase. Attendees will get free one month access to a complete Active Directory environment after the training. This training aims to change how you test a Windows based environment. Prerequisites - Basic understanding of how penetration tests are done.
- Basic understanding of a programming or scripting language could be helpful but is not mandatory.
- An open mind.
Target Audience - Red Team members and penetration testers who want to dive in the world of Offensive PowerShell and improve their skills.
- Blue Team members and defenders who want to understand the latest techniques used by the attackers.
- Other security professionals who want to enhance their technical skills.
Material to bring by attendees - Administrative/root privileges on the laptop
- Ability to install OpenVPN client, connect to a VPN and RDP to Windows boxes.
Course Syllabus Day 1 – PowerShell Essentials - Introduction to PowerShell
- Language Essentials
- Using ISE
- Help system
- Syntax of cmdlets and other commands
- Variables, Operators, Types, Output Formatting
- Conditional and Loop Statements
- Functions
- Modules
- PowerShell Remoting and Jobs
- Writing simple PowerShell scripts
- Extending PowerShell with .Net
- Accessing Windows API
- WMI with PowerShell
- Playing with the Windows Registry
- COM Objects with PowerShell
- Recon, Information Gathering and the likes
- Vulnerability Scanning and Analysis
- Exploitation – Getting a foothold
- Exploiting MSSQL Servers
- Client Side Attacks with PowerShell
- PowerShell with Human Interface Devices
- Writing shells in PowerShell
- Using Metasploit and PowerShell together
- Porting Exploits to PowerShell
Day 3 – Post Exploitation and Lateral Movement - Post-Exploitation – What PowerShell is actually made for
- Enumeration and Information Gathering
- Privilege Escalation
- Dumping System and Domain Secrets
- Kerberos attacks (Golden, Silver Tickets and more)
- Pivoting to other machines
- Poshing the hashes™
- Replaying credentials
- Network Relays and Port Forwarding
Speakers  Nikhil Mittal Nikhil Mittal is a hacker, infosec researcher, speaker and enthusiast. His area of interest includes penetration testing, attack research, defence strategies and post exploitation research. He has 6+ years of experience in Penetration Testing for his clients which include many global corporate giants. He is also a member of Red teams of selected clients. He specializes in assessing security risks at secure environments which require novel attack vectors and "out of the box" approach. He has worked extensively on using Human Interface Device in Penetration Tests and PowerShell for post exploitation. He is creator of Kautilya, a toolkit which makes it easy to use HIDs in penetration tests and Nishang, a post exploitation framework in PowerShell. In his spare time, Nikhil researches on new attack methodologies and updates his tools and frameworks. Nikhil has held trainings and boot camps for various corporate clients (in US, Europe and SE Asia), and at the world’s top information security conferences. He has spoken at conferences like Defcon, BlackHat USA, BlackHat Europe, RSA China, Troopers, DeepSec, PHDays, BlackHat Abu Dhabi, Hackfest, ClubHack, EuSecWest | 3 days | €1,800.00 | €360.00 | |
Pentesting the Modern Application Stack with Bharadwaj Machiraju and Francis Alexander Continuous Build & Deployment tools, Message brokers, Configuration Management systems, Resource Management systems and Distributed file systems are some of the most common systems deployed in modern cloud infrastructures thanks to the increase in the distributed nature of software. Modern day pentesting is no more limited to remote command execution from an exposed web application. In present day scenario, all these applications open up multiple doors into a company’s infrastructure. One must be able to effectively find and compromise these systems for a better foothold on the infrastructure which is evident through the recent attacks on the application stack through platforms like Shodan paving way for a full compromise on corporate infrastructures. In this 2 day course we start by looking at the application stack consisting of Databases,CI tools, Distributed Configuration & Resource management tools, Containers, Big Data Environments, Search technologies and Message Brokers. Along with the training knowledge, the course also aims to impart the technical know-how methodology of testing these systems. This course is meant for anyone who would like to know, attack or secure the modern day stack. The students are bound to have some real fun and entirely new experience through this unique course, as we go through multiple challenging scenarios one might not have come across. During the entire duration of the course, the students are expected to learn the following: - Look for vulnerabilities within the application stack.
- Gain in depth knowledge on how to pentest the modern stack consisting of Continuous Build & Deployment tools, Message broker's, Configuration Management systems, Resource Management systems and Distributed file systems.
- Security testing of an entire application stack from an end-to-end perspective.
Teaching Methodology Students are encouraged to follow the technical training with hands-on approach to the facilitated labs for every module to gain deeper and practical understanding of the topic. Who should take this course - DevSecOps
- Security Engineers
- Penetration testers
- Bug bounty hunters
- System Administrators
- SOC analysts
- Security enthusiasts and anyone interested in the modern application stack.
Student requirements Knowledge of basic pentesting, web application working and linux command line basics,the ability to use a web proxy like Burp Suite, ZAP, and the ability to write basic scripts in any interpreted language is an added advantage. What students should bring The requirement for the course is a laptop with administrative and USB access and minimum configuration of 8GB RAM and 100GB hard-disk space.Full virtualisation support, Virtual Box and Docker should be installed. Unix box is preferred. What students will be provided with - Presentation Material and associated pdfs.
- 10+ containerized labs to emulate sophisticated production application stacks.
- Access to specific relevant OpSecX courses and certifications.
Course Syllabus Day 1 Pentesting some of the widely used systems in the modern stack :- Module 0: Modern Application Stack - Evolution of Application Stack
- Components of Stack
- Threat Modelling
- Attack Surface
Module 1: Pentesting Databases: - MySQL,Postgres and OracleDB
- Basic Enumeration
- Laying out the attack surface
- Pentesting third party plugins.
- Attacking Database Servers.
- Case Study of CVE-2016-6663
- Security testing using tools of trade.
- Pentesting NoSQL Databases & Caches: MongoDB, Cassandra, Redis & Memcache
- Fingerprinting NoSQL databases,
- Injection attacks on NoSQL Databases.
- Attacking and identifying vulnerabilities in NoSQL databases through NoSQL exploitation framework.
- Case study on Mongo Ransomware and hands on vulnerable applications.
- Securing databases.
Module 2: Public Cloud Environments - Introduction to Cloud Environments.
- AWS Configurations & AWS Security Checks.
- Pentesting AWS lambda servers.
- Secure Best practices for Cloud environments and Securing AWS instances
Module 3: CI Tools - Introduction to Jenkins, TeamCity and Go.
- Basic misconfigurations and attack surface for these tools.
- Security testing of CI Tools and outlook on vulnerabilities in Jenkins, TeamCity and Go.
- Case Study: Remote Code Execution on Jenkins.
Module 4: Software Collaboration Tools - Leveraging Version Control Systems like Git, SVN and Perforce.
- Attacking Code collaboration tools - Phabricator, Gitlab and Github Enterprise.
Module 5: Message Brokers - Introduction to RabbitMQ and Kafka.
- Common misconfigurations.
- Attacking and extracting juicy information from Message brokers.
Day 2 Module 6: Containers - Hacking Docker environments.
- Setting up vulnerability static analysis for Docker containers (Clair and other tools).
- Hacking Vagrant instances.
- Securing Docker and Vagrant instances.
Module 7: Distributed Configuration Management Systems (DCMS) - Attacking Apache Zookeeper, HashiCorp Consul & Serf, CoreOS Etcd.
- Owning the entire application thorough DCMS , pivoted attacks.
- Attacking and Scanning using Garfield.
Module 8: Distributed File System - Basic misconfigurations for Hadoop.
- Analysing the threat model for Hadoop.
- Attacks and remote code executions on Hadoop.
- Securing Hadoop Instances.
Module 9: Kubernetes,Mesos and Marathon (Distributed Deployment & Resource Management) - Introduction to Kubernetes,Mesos and Marathon
- Fingerprinting Kubernetes,Mesos and Marathon
- Common Misconfigurations
- Pentesting Kubernetes and pivoting through kubernetes containers.
- Hacking entire application stack through Mesos and Marathon.
- Securing Mesos instances.
Module 10: Search Technologies - Introduction to ElasticSearch and Apache Solr (Lucene)
- Laying out the attack surface and common misconfigurations.
- Pentesting ElasticSearch and Solr.
- Case Study :ElasticSearch CVE-2015-1427 RCE Exploit.
Labs 10+ containerized labs to emulate sophisticated production stack along with applications. Speakers  Bharadwaj Machiraju Bharadwaj Machiraju is project leader for OWASP OWTF. He is mostly found either building a web appsec tool or hunting bugs for fame (hackerone.com/tunnelshade). All tools are available at github.com/tunnelshade and all ramblings at blog.tunnelshade.in . Spoke at few conferences notably Nullcon, Troopers, Brucon, Pycon India etc.. Apart from information security, he is interested in sleeping, mnemonic techniques & machine learning. Francis Alexander Francis Alexander , Security Engineer for Envestnet|Yodlee has over 3+ Years of Experience in the Application Security industry, the author of NoSQL Exploitation framework and NoSQL Honeypot. His areas of interest include NoSQL Databases, Machine Learning and Cloud Security. He has been invited to speak & train at variety of conferences such as Troopers, Insomn'hack, Hack in the Box, Hack in Paris, 44Con, Nullcon, C0c0n. | 2 days | €1,200.00 | €240.00 | |
Practical Internet Of Things (IoT) Hacking with Aseem Jakhar "The great power of Internet Of Things comes with the great responsibility of security". Being the hottest technology, the developments and innovations are happening at a stellar speed, but the security of IoT is yet to catch up. Since the safety and security repercussions are serious and at times life threatening, there is no way you can afford to neglect the security of IoT products. The course focuses on the attack surface on current and evolving IoT technologies in various domains such as home, enterprise Automation. It covers grounds-up on various IoT protocols including internals, specific attack scenarios for individual protocols and open source software/hardware tools one needs to have in their IoT penetration testing arsenal. We also discuss in detail how to attack the underlying hardware of the sensors using various practical techniques. In addition to the protocols and hardware we will extensively focus on reverse engineering mobile apps and native ARM/MIPS code to find weaknesses. Throughout the course, We will use DRONA, a VM created by us specifically for IoT penetration testing. DRONA is the result of our R&D and has most of the required tools for IoT security analysis. We will also distribute DIVA – IoT, a vulnerable IoT sensor made in-house for hands-on exercises. The “Practical Internet of Things (IoT) Hacking” course is aimed at security professionals who want to enhance their skills and move to/specialise in IoT security. The course is structured for beginner to intermediate level attendees who do not have any experience in IoT, reversing or hardware. Speakers  Aseem Jakhar Aseem Jakhar is the Director, research at Payatu Technologies Pvt Ltd payatu.com a boutique security testing company. He is well known in the hacking and security community as the founder of null -The open security community, registered not-for profit organization http://null.co.in and also the founder of nullcon security conference nullcon.net and hardwear.io security conference http://hardwear.io He has extensive experience in system programming, security research, consulting and managing security software development projects. He has worked on various security software including UTM appliances, messaging/security appliances, anti-spam engine, antivirus software, multicast packet reflector, Transparent HTTPS proxy with captive portal, Bayesian spam filter to name a few. He currently spends his time researching on IoT security. He is an active speaker and trainer at security and open source conferences; some of the conferences he has spoken at include AusCERT, Defcon, Hack.lu, Black Hat, PHDays, Xcon, Cyber security summit - Bangalore, Cocon, OSI Days - Bangalore, Clubhack, Gnunify. His research includes Linux remote thread injection, automated web application detection and dynamic web filter. He is the author of open source Linux thread injection kit -Jugaad and Indroid which demonstrate a stealthy in-memory malware infection technique. | 3 days | €1,800.00 | €360.00 | |
Practical SAP Netweaver ABAP Pentest with Yvan Genuer SAP is no longer an unknown black box for security community and SAP product appears more and more often in audit requests. This training is focused on SAP Netweaver ABAP. Because we can't cover all SAP software in two days, we decided to work on the most frequent vulnerabilities we faced during our pentests. We'll provide different SAP Systems with different configuration issues in 'realist' environment with a SAP security specialist who receives official acknowledgements from SAP for vulnerabilities reported. Few slides, lots of practical, this is the leitmotiv of this workshop. SAP knowledge is not required. Prerequisites - General knowledge on information security, networking and pentesting
- SAP knowledges is NOT required
Target Audience - Pentesters or security professional
- Anyone interested to learn about SAP Security
Material to bring by attendees - Laptop, with administrative privileges on the system, at least 20G free space and 1G Ram for VM.
- SAP GUI (in a windows VM if you are on linux)
- SSH Client
- Virtualization software
Course Syllabus Day1 - Introduction
- Quick Introduction to SAP world
- SAP ?
- SAP in numbers
- Global concept
- SAP Gui
- Vocabulary
- Introduction to SAP Security
- Why it's important ?
- History
- The SAP security parts
- Risk
- Usefull transactions
- Usefull parameters
- Usefull reports & functions modules
- Training infrastructure
- Overview and warning
- Tools provided
- Hands-on : tools overview
- SAProuter
- Why saprouter is important
- How saprouter works
- SAP ports
- Saprouter vulnerability
- Hands-on : internal scan, discover SAP port, forward port
- Remediation
- SAP Client
- Overview of SAPGui, Webgui and other
- Information history gathering
- Sapgui Shortcut vulnerability
- Hands-on : retrieve information from end user, crack shortcut password
- Remediation
- SAP Netweaver ABAP
- Overview
- SAP Authorization (concept, critical report, os access, db access)
- Password concept and Default account
- Hands-on : find default account
- SAP Message Server
- Hands-on : gathering information
- SAP ICM
- Hands-on : usefull webservices
- SAP MMC
- Hands-on : gathering information
- Remediation
Day2 - Database level security
- Overview
- Direct attack to database
- Hands-on : Retreive SAP database schema password
- Remediation
- SAP Lateral movement
- RFC concept
- RFC hardcoded credential
- Hands-on : find other SAP, get access to trusted SAP system ? SAP Gateway
- Hands-on : get os access to trusted SAP system
- Remediation
- SAP to OS to Database to SAP to...
- Hands-on : Database to SAP
- Hands-on : SAP to OS
- Hands-on : OS to database
- Hands-on : SAP to database
- ABAP Code vulnerability
- ABAP Introduction
- ABAP command injection
- OS Command injection
- SQL injection
- Autorisation bypass
- Directory traversal
- Cross client access
- Genereic module execution
- Hands-on : use a vulnerable report to elevate priv
- Remediation
- Full SAP pentest challenge
- Hands-on : challenge from internet to internal SAP
- Challenge correction
- Conclusion of securing SAP System
- SAP security best practice overview
- Problems
- The challenge
- Conclusion
Speakers  Yvan Genuer Yvan as near than 15 years old experiences in SAP. Begin as SAP basis administrator for various highest French companies. He focuses himself to SAP Security, where he's self-taught, since 5 years. He's now the SAP assessment and pentester leader at Devoteam security team. Discreet person, however, he receives official acknowledgements from SAP AG for vulnerabilities reported. He is in Grehack conference organization committee since years, and has been invited to talk in Clusir association. | 2 days | €1,200.00 | €240.00 | |
Smart lockpicking - hands-on exploiting IoT devices based on access control systems with Slawomir Jasek Learn how to assess and secure IoT devices by having fun with hacking a dozen of devices among most profitable to attack - smart locks. The agenda will include: wireless sniffing, spoofing, cloning, replay, DoS, authentication and command-injection attacks, analyzing proprietary network protocols, breaking “Latest PKI technology”, abusing excessive services... The software-focused activities will be mixed with short entertaining tricks like opening lock by a strong magnet, counterfeiting fingerprints in biometric sensor or opening voice-controlled lock by hacking nearby speaking toys. Technologies covered will include: Bluetooth Smart, Linux embedded, KNX, NFC, WiFi, P2P, GSM, Wiegand, and others. Each student will receive a 100 EUR value hardware, consisting of Bluetooth hardware sniffer, Raspberry Pi configured with tools and Hackmelock for further practice at home. What will be provided: - course materials in PDFs (several hundred pages)
- all required additional files: source code, documentation, installation binaries…
- Bluetooth Smart hardware sniffer and development kit based on nrf51822 module
- 2 Bluetooth Low Energy USB dongles
- Raspberry Pi 3 with assessment tools and Hackmelock for further hacking at home
- NFC NXP PN532 board + “magic UID” card - which will allow you to clone most common Mifare Classic contactless cards
Here's a dedicated website on this topic: https://www.smartlockpicking.com Prerequisites - At least basic familiarity with Linux command-line, Kali, Wireshark.
- Scripting/programming skills will be very helpful.
- Mobile application reversing skills will be an advantage.
Target Audience - Pentesters, security professionals
- IoT developers
- Anyone interested
Material to bring by attendees Contemporary laptop with virtualization software able to run Kali Linux (at least 4GB of RAM, 40GB space), Android > 4.3 smartphone Course Syllabus - Bluetooth Smart - based on 7 various smart locks, and specially developed Hackmelock (consisting of Android mobile application and lock device simulated on Raspberry Pi):
- passive sniffing - hardware, software
- active MITM - learn GATTacker BLE proxy tool from its creator; BTLEjuice
- static authentication password capture
- spoofing devices and their status
- replay attacks
- command injection
- Denial of Service
- cracking "latest PKI technology"
- other flaws of custom challenge-response authentication
- abusing excessive services (e.g. module's default AT-command interface).
- weaknesses of access sharing functionality
- Linux embedded - based on wireless doorlock, alarm+home automation system
- authentication bypass
- information disclosure
- telnet brute-force
- command injection
- physical attack: switching to WiFi maintenance mode using external intercom
- UART interfaces
- Proprietary network protocols - based on several devices (fingerprint sensor, time attendance monitor, wireless doorlock, alarm system)
- methods of analyzing proprietary protocols - sniffing, MITM, reversing client/server
- sniffing administrative credentials
- abusing improper session management - authentication bypass
- P2P feature - how to attack doorlock hidden behind NAT
- taking control over proprietary HVAC control appliance
- Home automation systems integrated with alarms, doors and access control - based on KNX example installation provided
- typical architecture, group address, device address, KNX-IP gateway
- tools: ETS configuration software, knxmap, nmap scripts...
- locate KNX gateway in LAN or remotely from the Internet
- monitor mode - sniffing the bus passively
- sending write command to group address and open connected doorlock
- SMS and voice remote control over GSM - based on remote control alarm system
- brute-force alarm PIN via SMS and voice calls
- NFC/RFID - based on hotel electronic door lock, pinpad, time attendance sensor
- clone contactless card
- brute-force ID
- Wiegand
- sniff the data transmitted from access control reader using BLEKey
Moreover, everyone will also be able try oneself to: - open smart lock using strong magnet influencing the motor
- cheat fingerprint biometric sensor - you can make your own fingerprint clone
- open voice-controlled lock by hacking nearby speaking devices
Several exercises will be connected with electronic lock guarding a special box of goods from Poland. Whenever a participant will succeed in hacking the lock, the box opens automatically, and one can have a delicious cookie or a shot of a Polish vodka :) | 2 days | €1,200.00 | €240.00 | |
Social Engineering - the theory of debugging people (Learn to plan,execute and defend Social Engineering attacks) with Dominique C. Brack This is the first time Social Engineering Engagement Framework (SEEF) author offers an in-person public workshop. Normally the workshops and briefings are closed-group private enterprise or Government only workshops. Profit from first-hand knowledge and experience of a social engineering and information security professional with 20 years of experience. What you will learn: Tools and techniques to plan, execute and manage social engineering engagements. What can and will be used against you, your employees and your organization. This training will provide the skills to detect, defend and assess social engineering attacks and the associates risk with it. You will learn the motivations and methods used by social engineers enabling you to better protect yourself and your organization. Prerequisites None specific. Willing to learn and apply new things. A technical background is not necessary. Decision-maker, penetration tester, or hacking enthusiast, this training will be an excellent addition to your professional curriculum. Target Audience Professionals, Organisations and Governments. Individuals who have a professional interest in social engineering. Functions or roles requiring social engineering knowledge either for active use or for building protection against social engineering attacks. CISO's, Managers, Consultants, Developers, Hackers, Intelligence Org., Red Teams, Pentesters, Psychologists, Defence, Strategists, Tacticians, CxO's etc. Material to bring by attendees Laptop and note paper. Course Syllabus You can have the best technical security controls in the world, from the most expensive firewall to the most sophisticated biometric access control, but they will not protect you from social engineering attacks. This 2-day course will provide you with the skills to detect, defend and assess social engineering attacks. You will learn the motivations and methods used by social engineers enabling you to better protect yourself and your organization. This is not a technical course no technical prerequisites are required. Some tools might be used in the course for achieving a purpose but there will no programming skills necessary. You will learn how some of the most elegant social engineering attacks take place. Learn to perform these scenarios and what is done during each step of the attack. Social Engineering is an area filled with ethical challenges, risks and legal landmines and I will do my best to share my experiences in this course. So participants can reap the benefits of my experiences without falling in to the pitfalls I have over the years. - Social Engineering Economy - Introduction to Social Engineering
- Assessing the social engineering threats
- The evolution of social engineering
- Thinking like a social engineer
- Why social engineering works? The principles on which social engineering is based
- The legal and ethical aspects of social engineering
- The Social Engineering Engagement Framework (SEEF) – Advanced Techniques and Methods
- Social engineering engagement management – how to execute SE engagements/ tests
- Governance, Risk and Compliance including “++”
- Approach Selection Method (ASM) – selecting the most effective and efficient approach
- Attack Vector Development (AVD) – developing the most effective attack vectors
- The psychology of social engineering – interposal distance, zones of approach, rapport building etc.
- Social Engineering Prevention and Defence
- Identify countermeasures against social engineering attacks
- Phishing attacks - is it worth to run phishing exercises?
- Defend against social engineering deceptions that threaten organizational security
- Plan and evaluate security assessments
- Promote vigilance and implement procedures to defeat deceptions
- Exercises and practical application – Tools used by Social Engineers
- Identifying interview techniques that elicit private information
- Leveraging authority as a manipulation tool
- Conducting information collection: i.e. dumpster dive to gather intelligence
- Gathering Information and Intelligence Identifying information sources
- OSINT tools
Speakers  Dominique C. Brack Dominique C. Brack is a recognized expert in information security, including identity theft, social media exposure, data breach, cyber security, human manipulation and online reputation management. He is a highly qualified, top-performing professional with outstanding experience and achievements within key IT security, risk and project management roles confirming expertise in delivering innovative, customer-responsive projects and services in highly sensitive environments on an international scale. Mr. Brack is accessible, real, professional, and provides topical, timely and cutting edge information. Dominique’s direct and to-the-point tone of voice can be counted on to capture attention, and – most importantly - inspire and empower action. Last year's conference appearance's: - AREA41 (DEFCON Switzerland), Zürich June 2016 https://area41.io/
- Hack In Paris, Paris July 2016 https://hackinparis.com/
- ISC2 EMEA Security Congress, Dublin October 2016 http://emeacongress.isc2.org/
- DeepSec 2016 Austria, Vienna November 2016 https://www.deepsec.net/
| 2 days | €1,200.00 | €240.00 | |
WebSecNinja, Master the Lesser Known WebAttacks Version 2.0 with Ajin Abraham This is a brand new and unique web security course that takes the learner to the next level of web security. A perfect blend of latest and lesser known web attacks that are explained with ultimate details, accompanied by demos and “how tos” that you can apply in real world red-team pentesting. The course curriculum is designed to include web attacks and techniques that are not much documented in books, trainings, courses and elsewhere along with the well known OWASP Top 10 web vulnerabilities. To make the course more effective and practical, a live CTF will be organized for the attendees to apply what they have just learned. This course is made in such a way to accommodate latest attacks as and when they are discovered or published on various conferences like BlackHat, DEFCON, OWASP AppSec etc. This course is best suited for pentesters, web security architects, students, web developers, javascript developers, security engineers, and security consultants. The contents of the course are well structured to satisfy all kinds of audience from beginner to advanced level of competence. This course try to cover such attacks and techniques and helps you to become the Jedi Master of Web Security Speakers  Ajin Abraham Ajin Abraham is a Security Engineer for IMMUNIO with 7+ years of experience in Application Security including 4 years of Security Research. He is passionate on developing new and unique security tools. Some of his contributions to Hacker's arsenal include OWASP Xenotix XSS Exploit Framework, Mobile Security Framework (MobSF), Xenotix xBOT, NodeJsScan etc to name a few. He has been invited to speak at multiple security conferences including ClubHack, NULLCON, OWASP AppSec Eu & AsiaPac, BlackHat Europe, Hackmiami, Confidence, BlackHat US, BlackHat Asia, ToorCon, Ground Zero Summit, Hack In the Box and c0c0n. | 3 days | €1,800.00 | €360.00 | |
Xtreme Mobile App Attack with Sneha Rajguru This full-fledged hands-on workshop will get the attendees familiar with the various Android as well as iOS application analysis techniques and bypassing the existing security models in both the platforms. The main objective of this workshop is to provide a proper guide on how the mobile applications can be attacked and provide an overview of how some of the most important security checks for the applications are applied and get an in-depth understanding of these security checks. The workshop will also include a CTF challenge designed by the trainer in the end where the attendees will use their skills learnt during the workshop to solve this challenge. This workshop will mainly focus on the following : - Arm basics and Android native code.
- Reverse engineer Dex code for security analysis.
- Jailbreaking/Rooting of the device and also various techniques to detect Jailbreak/Root.
- Runtime analysis of the apps by active debugging.
- Modifying parts of the code, where any part can be specified as some functions, classes and to perform this check or to identify the modification, we will learn how to find and calculate the checksum of the code. Our objective in this section will be to learn, Reverse Engineering an application, get its executable binaries , modify these binaries accordingly, resign the application.
- Runtime modification of code. Objective is to learn how the programs/codes can be changed or modified at runtime. we will learn how to perform introspection or overriding the default behavior of the methods during runtime and then we will learn how to identify if the methods have been changed). For iOS we can make use of tool Cycript, snoop-it etc.
- Hooking an application and learn to perform program/code modification.
- By the end of workshop, based on the course content CTF challenges written by the trainer will be launched, where the attendees will use their skills learnt in the workshop to solve the CTF challenges. The workshop will begin with a quick understanding on the architecture, file system,permissions and security model of both iOS and Android platform.
NOTE:
The tools and techniques used in the workshop are all open source and no special proprietary tools need to be purchased by the attendees for analysis post the training. Some of the tools taught in the training will be helpful in analysis and automating test cases for security testing of the mobile apps: - Drozer
- Introspy
- Apktool
- Dex2jar
- Cycript
- JD-Gui
- SSL Trust killer
Speakers  Sneha Rajguru Sneha works as a Sr.Security Consultant with Payatu software labs LLP and holds C.E.H and E.C.S.A certifications. Her area of interest lies in Web application and mobile application security and fuzzing. She has discovered various serious application flaws within open source applications such as PDFLite.Jobberbase, Lucidchart and many opensource wordpress plugins and many more. She is also an active member of Null – The open security community in India, and a contributor to regular meetups at the Pune chapter. She has spoken and provided training at GNUnify, FUDCon, Defcamp#6, Nullcon, BSidesLV and DefCon 24. | 3 days | €1,800.00 | €360.00 | |
