Instructor(s): Anthony Lai and Matt Brooks
This dojo includes a crash course on basic and intermediate level malware and document malware analysis skills in static and behaviour analysis...
Instructor(s):
Blessen Thomas
The Droid-Sec Exploitation training will enable attendees to master various android application penetration testing techniques and exploitation methods. With the rise of IoT devices, we have also included IoT smart watch wearable application penetration testing methodology and case studies.
This training focuses on practical hands-on exercises on several dedicated vulnerable apps, with the basic theory explained prior to the Do-It-Yourself mind-bending exercises - enabling the attendee to test his acquired skills during the training course.
This two-day fast-paced, brain-melting, revamped, custom-tailored, flag-ship training program will include subjects such as setting up Android pentest environments, identifying and exploiting application vulnerabilities in a variety of mobile application architectures, relevant mobile forensics, malware analysis concepts, and complementary subjects.
What not to expect:
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
Day 1:
Module 1: Lab setup and in-depth analysis
Module 2: Reverse engineering of Android application binaries (static analysis)
Module 3: Insecure data storage
Module 4: Data interception and manipulation (dynamic analysis)
Day 2:
Module 5: Analyzing runtime analysis
Module 6: Exploiting logic and code flaws in applications
Module 7: Automated assessment with Introspy / & Drozer /Mobile Security Framework, Xposed Framework
Module 8: Android forensics
Module 9: Android Malware Analysis
Module 10: Analysing HTML5 applications
Module 11: IoT smart watch wearable application penetration testing
Students could be familiar with below topics but not mandatory:
Participants are required to bring their own laptop (no Netbooks, no tablets, no corporate laptop due to the restrictions enabled) with Windows 7 64 bit in Host machine installed. Min 500 GB free Hard disk space and 8 GB RAM preferred, with antivirus and firewall disabled. Genymotion free version installed (https://www.genymotion.com/#!/ ), Virtual box installed (https://www.virtualbox.org/), with no VPN installed. Attendees must have administrator privilege, orking USB port and wi-fi enabled. Updated to the latest display drivers.
No need for devices, as training will be done using emulator.
Pentesting and Exploiting Highly Secured Enterprise Networks is an action-packed, hands-on class, giving attendees a chance to perform real-world exploitation on Enterprise network scenarios, accompanied with practical lab exercises in a CTF-style format. The course goes far beyond simple exploitation of low-hanging fruit, and shows pentesters how to perform the abilities of an advanced attacker; finding flaws in a secured networks and calculating the business risk associated with these flaws.
This training is intended for senior/experienced pentesters. Just running a vulnerability scanner and submitting it as your report provides no real benefit to a company. This course goes far beyond your traditional pentesting courses. Real-world Enterprise networks are much more complex in nature, needing your special attention in choosing the techniques and tools that you use in order to infiltrate. A senior penetration tester must succeed where others fail. A senior pentester doesn't give up when a particular exploit is not working - they try to analyse the exploit and make modifications as necessary. They should think outside-of-the-box and come up with solutions to complex problems. They must have knowledge of all domains, and skills that range from network attacks, web attacks, scripting to system exploitation.
This training is a result of years of pentesting experience compromising some of the most highly secured networks, combined into one practical and hands-on class. This course provides in-depth knowledge of the most powerful attack vectors and provides labs to perform these attacks in numerous hands-on scenarios.
Because automation of tools is essential due to time constraints, we have included a module on Python to automate the testing of systems, services, and applications. Multiple python Modules, libraries, and debugging tools have already been written to help simplify and automate fuzzing and research. In order to reach the next level in penetration testing, one must embrace the idea of adding programming into their penetration testing toolkit. Once this power is obtained, tools can be written and shared, allowing you to build up an arsenal for reconnaissance, scanning, fuzzing, and exploitation.
Metasploit and other 3rd party tools are easily detectable by modern security solutions and they have fingerprinted quite well, so it is not possible to have an emulate modern powerful adversary using these tools - there is need for custom code. When we are using custom code that is target specific, there is no mass deployment so antivirus vendors doesn't have signature for those. Building custom scripts will also help in bypassing firewall, IDS/IPS and to evade AV. Custom script will help in post exploitation such as list patches, list users, list AD accounts in active directory, pull passwords with mimikatz, bypass UAC etc. When you are attacking, it is useful to load code into remote process and have it execute within that process' context. So for this we will use DLL injection and we will write DLL injector using Python and this will help us to evade firewalls.
As a pentester you need to be familiar with how to edit, modify and execute shellcodes and be able to understand how exploits work. There are a few scripts online which can cause harm to your system, so you need to how that script works. Metasploit's XOR, shikata_ga_gai encoders are quite well detectable by AntiVirus so we will write our own custom encoders to evade Antivirus and we will use polymorphic engines which is quite difficult to detect and fingerprint.
We will build Command and Control (C2), because network intrusion may be detected and the compromised system can be patched, or some exploits only work once, to survive the reboot. C2 will be Stealth to avoid detection by IDS, persistence to survive reboot, encryption for secure communication and minimising possibility of firewall interference.
This training has been taken by 1000+ security professionals and red team members worldwide to advance their pentesting and exploitation skills, and we have received extremely positive feedback.
The lab has real-world remote Enterprise networks, including different flavours of operating system such as windows and linux. The lab contains real world Firewalls, IDP/IPS, DMZ, Load Balancers, Web Application Firewalls, Active Directory etc. This course is for you if you want to pentest and exploit highly secured Enterprise networks using cutting edge techniques. The training includes 50+ labs and 30+ challenges inspired by real world vulnerabilities and case studies. After the training, attendees will get 1-month remote lab access free, with an additional 20 challenges, 5+ hours of HD videos of training walkthrough, and pre-access to videos on basic Assembly Language and Python Scripting which will help them in class.
Day 1:
Day 2:
Day 3:
Day 4:
This class is designed to introduce students to the best tools and technology available for automating vulnerability discovery and crash triage with a focus on delivering a practical approach to applying this technology in real deployments at any scale.
Through an applied understanding of introductory program analysis and binary translation, techniques for finding various bug classes and methods for improved crash debugging will be discussed. We will analyse the properties of memory corruption from integer overflows, uninitialized variables, use-after-free and look at applying tools such as compiler plugins, binary instrumentation frameworks, memory debuggers, and fuzzers to discovering each one.
Next take a deep dive into fuzzing, covering all aspects of this practical approach to finding bugs. As the most approachable and versatile of the available tools, the student will apply various fuzzing techniques to several real-world pieces of software. Students will learn strategies for analysing attack surface, writing grammars, and generating effective corpus. We will explore in detail the latest innovations such as harnessing code coverage for guided evolutionary fuzzing and symbolic reasoning for concolic fuzzing.
We approach crash analysis through the lens of scriptable debuggers and program analysis. We will once again look at properties of how memory corruption manifests in a crashing condition. We will apply tools like reverse debugging and memory debugging scripts to assist in interactively diagnosing root cause of crashes. Then we will leverage the power of dynamic taint tracking and graph slicing to help isolate the path of user controlled input in the program and identify the exact input bytes influencing a crash. Lastly, we will look at possible ways to aid in determining severity of a vulnerability.
This class will focus on x86/x64 architecture and target Windows and Linux environments, however some discussion regarding applications to ARM and mobile platforms will also be included and all of the concepts if not the direct tools will be useful in other environments.
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
Day 1: Program Analysis
Morning:
Afternoon:
Day 2: Dynamic Binary Instrumentation
Morning
Afternoon
Day 3: Fuzzing & Triage I
Morning:
Afternoon:
Day 3: Fuzzing & Triage II
Morning:
Afternoon:
Students should be prepared to tackle challenging and diverse subject matter and be comfortable writing functions in in C/C++ and python to complete exercises involving completing plugins for the discussed platforms. Attendees should have basic experience with debugging native x86/x64 memory corruption vulnerabilities on Linux or Windows.
Students should have the latest VMware Player, Workstation, or Fusion working on their machine.
This class is meant for professional developers or security researchers looking to add an automation component to their software security analysis. Students wanting to learn a programmatic and tool driven approach to analysing software vulnerabilities and crash triage will benefit from this course.
This is a fast paced course designed to introduce attendees to Windows Kernel Exploitation. We will cover the basics of Windows Kernel Internals and hands-on fuzzing of Windows Kernel Mode drivers. We will deep-dive into exploit development of Pool based buffer overflow vulnerability in Kernel driver.
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
Upon completion of this training, participants will be able to:
What Not to Expect:
Windows Internals
Memory Management
Why to Attack Kernel?
Windows Driver Basics
Fuzzing Windows Kernel
Exploitation
Kernel Payload
Miscellaneous
Who should attend? Information Security Professionals, anyone with an interest in understanding Windows Kernel exploitation, Ethical Hackers and Penetration Testers looking to upgrade their skill-set to the kernel level.
A laptop capable of running two virtual machines simultaneously (8 GB of RAM) and 40 GB free hard drive space. Everyone should have Administrator privilege on their laptop.
HackerOne's bug hunters have earned $20-Million in bug bounties by 2017, and are expected to earn $100-Million by the end of 2020. Some of HackerOne's customers include the United States Department of Defense, General Motors, Uber, Twitter, and Yahoo. This clearly shows where the challenges and opportunities are for bug hunters in the upcoming years. This course will provide you with a solid technical training by one of the Top 10 HackerOne bug hunters.
Modern web applications are complex, and it's all about full-stack nowadays. That's why we will dive into full-stack exploitation so that you can master web attacks and maximize your payouts. Say "No" to classical web application hacking, and instead join this unique hands-on training to become a full-stack exploitation master.
After completing this training, you will have learned about:
Students will be provided with a VMware image with a specially prepared testing environment to play with the bugs. This environment will be self-contained, and when the training is over students can take it home to hack again at their own pace, after signing a Non-disclosure Agreement.
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
To get the most out of this training, an intermediate knowledge of web application security is recommended. Students should be familiar with common web application vulnerabilities and have experience in using a proxy, such as Burp Suite Proxy or similar, to analyse or modify the traffic.
Students will need a laptop with a 64-bit operating system, at least 4 GB RAM (8 GB preferred), 35 GB free hard drive space, USB port (2.0 or 3.0), wireless network adapter, administrative access, ability to turn off AV/firewall and VMware Player/Fusion installed (64-bit version).
Prior to the training, make sure there are no problems with running 64-bit VMs (BIOS settings changes may be needed). Please also make sure that you have Internet Explorer 11 installed on your machine or bring an up-and-running VM with Internet Explorer 11 (you can get it here: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/).
Penetration testers, bug hunters, security researchers/consultants.
"There's an Intel on every desktop, but an ARM in every pocket." ARM has emerged as the leading architecture in the Internet of Things (IoT) world. The ARM IoT Exploit Laboratory is a 4-day intermediate (approaching advanced) level class intended for students who want to take their exploit writing skills to the ARM platform. The class covers everything from an introduction to ARM assembly all the way to Return Oriented Programming (ROP) on ARM architectures. Our lab environment features hardware and virtual platforms for exploring exploit writing on ARM based Linux systems and IoT devices. The class concludes with an end-to-end "Firmware-To-Shell" hack, where we extract the firmware from a popular SoHo router and an IP Camera, build a virtual environment to emulate and debug them, and then build exploits to gain a shell on the actual hardware devices. The 4-day format features lots of hands-on exercises allowing students to internalise concepts taught in class.
This class is perfectly suited for students who are keen to dive into the world of modern ARM exploit development. As with the popular Exploit Laboratory, all topics are delivered in a down-to-earth, learn-by-example methodology. The same trainers who brought you The Exploit Laboratory for over 12 years, have been working hard in putting together an all new class based on past feedback!
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
Students will be provided with all the lab images used in the class. The ARM IoT Exploit Laboratory uses a "Live Notes" system that provides a running transcript of the instructor's system to all the students. Our lab environment, plus about 700MB of curated reading material, will be made available to all attendees to take with them and continue learning after the training ends.
DAY 1
DAY 2
DAY 3
DAY 4
The following tutorials have been specially prepared to get students up to speed on essential concepts before coming to class.
a) Operating Systems - A Primer b) How Functions Work c) Introduction to Debuggers
HARDWARE REQUIREMENTS:
SOFTWARE REQUIREMENTS:
For the last few years we have taught iOS and OS X kernel exploitation to a wide variety of students. As Apple keeps adding new security mitigations into the kernel or changes how security relevant implementations like how the kernel heap works, we have continued to update our course curriculum. For 2018 we went a step further, and for the first time in the history of our courses, we are offering an advanced version of our kernel exploitation course that builds on top of our previous courses.
In this advanced course, we will focus less on what security features were added by what iOS version, and more on questions and topics that arise during the development of kernel exploits for real kernel vulnerabilities that were made public in 2017.
During the training we will make available devices on iOS 11.0 to perform the hand on tasks, because they can only be performed on devices having vulnerabilities.
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
Introduction:
Low Level ARM64:
iOS Kernel Debugging:
iOS Kernel Vulnerability Types
iOS Kernel Heap Exploitation:
iOS Kernel Exploit Mitigations
iOS Kernel Vulnerabilities
iOS Kernel Jailbreaking
Students must have prior knowledge in exploitation (basics will not be taught) and must be capable of understanding/programming exploits in C. Students will get an introduction into low level ARM/ARM64 as part of the course.