Security Training
Security Certification
Internet Storm Center
Cyber Security Graduate School
Security Awareness Training
Penetration Testing
Industrial Control Systems
Cyber Defense Foundations
IT Audit
Computer Forensics
Software SecuritySEC760: Advanced Exploit Development for Penetration Testers
- Contents | Schedule | Additional Info
- Instructor: Stephen Sims
- $3,735
- 36 CPE/CMU
- Laptop Required
Vulnerabilities in modern operating systems such as Microsoft Windows 7/8, Server 2012, and the latest Linux distributions are often very complex and subtle. Yet, they could expose organizations to significant attacks, undermining their defenses when wielded by very skilled attackers. Few security professionals have the skillset to discover let alone even understand at a fundamental level why the vulnerability exists and how to write an exploit to compromise it. Conversely, attackers must maintain this skillset regardless of the increased complexity. SANS SEC760: Advanced Exploit Development for Penetration Testers teaches the skills required to reverse engineer 32-bit and 64-bit applications, perform remote user application and kernel debugging, analyze patches for 1-day exploits, and write complex exploits, such as use-after-free attacks, against modern software and operating systems.
You Will Learn:
- How to write modern exploits against the Windows 7 and 8 operating systems.
- How to perform complex attacks such as use-after-free, Kernel exploit techniques, one-day exploitation through patch analysis, and other advanced topics.
- The importance of utilizing a Security Development Lifecycle (SDL) or Secure SDLC, along with Threat Modeling.
- How to effectively utilize various debuggers and plug-ins to improve vulnerability research and speed.
- How to deal with modern exploit mitigation controls aimed at thwarting success and defeating determination.
| Course Contents | Instructors | Schedule |
|---|---|---|
| SEC760.1: Threat Modeling, Reversing and Debugging with IDA | Stephen Sims |
Mon Dec 16th, 2013 9:00 AM - 5:00 PM |
OverviewDefinition: Many penetration testers, incident handlers, developers, and other relative professionals lack reverse engineering and debugging skills. This is a different skill than reverse engineering malicious software. As part of the Security Development Lifecycle (SDL) and Secure-SDLC, developers and exploit writers should have experience using IDA Pro to debug and reverse their code when finding bugs or when identifying potential risks after static code analysis or fuzzing. CPE/CMU Credits: 6 Topics
|
||
| SEC760.2: Advanced Linux Exploitaiton | Stephen Sims |
Tue Dec 17th, 2013 9:00 AM - 5:00 PM |
OverviewThe ability to progress into more advanced reversing and exploitation requires an expert-level understanding of basic software vulnerabilities, such as those covered in SANS SEC660. Heap overflows serve as a rite of passage into modern exploitation techniques. This day is aimed at bridging this gap of knowledge in order to inspire thinking in a more abstract manner, necessary for continuing further with the course. Linux can sometimes be an easier operating system to learn these techniques, serving as a productive gateway into Windows. CPE/CMU Credits: 6 Topics
|
||
| SEC760.3: Patch Diffing, One-Day Exploits, and Return Oriented Shellcode | Stephen Sims |
Wed Dec 18th, 2013 9:00 AM - 5:00 PM |
OverviewIt is well known that attackers download patches as soon as they are distributed by vendors such as Microsoft in order to find newly patched vulnerabilities. Often, vulnerabilities are disclosed privately, or even discovered in-house, allowing the vendor to more silently patch the vulnerability. This also allows the vendor to release limited or even no details at all about a patched vulnerability. Attackers are well aware of this and quickly work to find the patched vulnerability in order to take control of unpatched systems. This technique is also performed by incident handlers, IDS administrators and vendors, vulnerability and penetration testing framework companies, government entities, and others. CPE/CMU Credits: 6 Topics
|
||
| SEC760.4: Windows Kernel Debugging and Exploitation | Stephen Sims |
Thu Dec 19th, 2013 9:00 AM - 5:00 PM |
OverviewThe Windows Kernel is very complex and intimidating. This day aims to help you understand the Windows kernel and the various exploit mitigations added into recent versions. You will perform Kernel debugging on various versions of the Windows OS, such as Windows 7 and 8, and learn to deal with its inherent complexities. Exercises will be performed to analyze vulnerabilities, look at exploitation techniques, and get a working exploit. CPE/CMU Credits: 6 Topics
|
||
| SEC760.5: Windows Heap Overflows and Client-Side Exploitation | Stephen Sims |
Fri Dec 20th, 2013 9:00 AM - 5:00 PM |
OverviewThe focus of this section is primarily on Windows browser and client-side exploitation. You will learn to analyze C++ vftable overflows, one of the most common mechanisms used to compromise a modern Windows system. Many of these vulnerabilities are discovered in the browser and therefore, browser techniques will be taught, such as modern heap spraying to deal with IE 8/9/10 and other browsers such as FireFox and Chrome. You will work towards writing exploits in the Use-After-Free/Dangling Pointer vulnerability class. CPE/CMU Credits: 6 Topics
|
||
| SEC760.6: Capture the Flag | Stephen Sims |
Sat Dec 21st, 2013 9:00 AM - 5:00 PM |
OverviewDay 6 will serve as a capture the flag day with different types of challenges from material taught throughout the week. CPE/CMU Credits: 6 Topics
|
||
| Additional Information | ||
| Laptop Required | ||
|
You must bring and will use VMware to run multiple operating systems when performing class exercises. Linux VM's with all necessary tools will be provided on a DVD on the first day. Tools needed for Windows will be issued in class; however, you are required to build and bring the Windows virtual machines as listed below under Option 1 or Option 2. The VMs must be unpatched as we will be installing and removing patches in class. If possible, please ensure you bring the English Language Pack versions of the designated Windows VMs so that everyone is running the same images. If you choose to, or are unable to bring the specified OS and/or Service Pack versions, you may experience different outcomes during exercises. Ensure that you have the administrative ability to disable all security software and protections, including antivirus and personal firewalls. You will not be able to complete the exercises without this level of control. Also ensure that you can install software that may be blocked by administrative or security controls due to their nature. You will be installing various debuggers and vulnerable applications onto the VM's. Please adhere to the following:
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org. |
||
| Who Should Attend | ||
|
||
| Prerequisites | ||
Previous exploit-writing experience is required, such as those techniques covered in SANS SEC660: Advanced Penetration Testing, Exploits, and Ethical Hacking. This includes experience with stack-based buffer overflows on both Linux and Windows, as well as experience defeating modern exploit mitigation controls such as DEP, ASLR, canaries, and SafeSEH. Experience with various fuzzing tools such as the Sulley Fuzzing Framework is required. Programming experience is important, preferably with C/C++. At a minimum, scripting experience in a language such as Python, Perl, Ruby, or LUA is mandatory. Programming fundamentals such as functions, pointers, calling conventions, structures, etc is mandatory and will be assumed knowledge. Experience with reverse engineering vulnerable code is also required, as is the ability to read x86 disassembly from within a debugger or disassembler. Experience with both Linux and Windows navigation is required, as well as TCP/IP experience. Failure to meet these requirements may result in the inability to keep up with the pace of the course. Courses that Lead-in:
Courses that are Pre-reqs:
|
||
| What You Will Receive | ||
|
||
| You Will Be Able To | ||
|
||
| Hands-on Training | ||
|
||
| Price | Options |
|---|---|
| $3,735 | — |
