SANS Institute

SECURITY 709

Developing Exploits for Penetration Testers and Security Researchers

This is a special beta course whose materials are still being fine-tuned. We are offering it at a discount at this event in exchange for the students' feedback and critique, which will help us improve and finalize the course's content and exercises
Register early as space is limited.

As zero-day vulnerabilities are discovered more frequently, malicious computer attackers are constantly writing exploits to attack them. But when a new flaw is discovered, it is often difficult to determine whether it is truly exploitable, making an analysis of business risk difficult, if not impossible. Things get even more murky when the flaw is discovered in home-grown applications supporting an enterprise. Yet until now, only a small, self-selected, high-tech "priesthood" of security researchers have had the skills to determine whether a given flaw can lead directly to exploitation. For the first time, SANS' leading technical experts will share some of their 'beyond pen testing' secrets with select groups of students.

Do you want to join the skilled security researcher elite and stop relying on others to find your application's vulnerabilities and start writing your own Proof of Concept (POC) code? Do you want the skills to be part of the security researcher "priesthood"?

In this course, we bridge the gaps and take a step-by-step look at Linux and Windows operating systems and how exploitation truly works under the hood. This two-day course rapidly progresses through exploitation techniques used to attack stacks, heaps, and other memory segments on Linux and Windows. This is a fast-paced course that provides you with the skills to hit the ground running with vulnerability research. We end the course with a Capture the Flag (CTF) exercise requiring you to discover and exploit vulnerabilities on remote systems.

Attendees can apply the skills developed in this class to create and customize exploits for penetration tests of homegrown software applications and newly discovered flaws in widespread commercial software. Understanding the process of exploit development can help enterprises analyze their actual business risks better than the ambiguous hypotheticals we often contend with in most traditional vulnerability assessments.

This course is not for the faint of heart or those with modest skills. It is leading edge stuff for the best technical security professionals, security researchers, and pen testers. If you are able to absorb it, the knowledge gained throughout the course will help you write custom exploits to gain privileged system access and determine the real risk to your business. Precompiled exploits won't help you here!

Target Audience

• Incident handlers looking to take the next step in understanding exploitation in its most technical form
• Network and system security professionals looking to understand the methods used to write exploit code and discover vulnerabilities
• Programmers and code review engineers looking to understand the threat of exploitation and how to write Proof of Concept (POC) code to demonstrate exploitation techniques
• Certification-holders looking to improve and put their practical knowledge to the test
• Anyone looking to build credibility and take a technical course on advanced hacking techniques

Pre-requisites

This is a fast-paced, advanced course that requires a strong desire to learn custom exploitation techniques and advanced penetration testing. Courses such as SEC504 :: Hacker Techniques, Exploits & Incident Handling, SEC560 :: Network Penetration Testing and Ethical Hacking, and SEC610 :: Reverse-Engineering Malware are recommended prior to or as a companion to taking this course. Experience with programming in any language is recommended but not required. The basics of programming will not be covered in this course. Most of the vulnerable programs and exploits are written in C, C++, Perl, or Python. Familiarity with Linux and Windows is highly recommended. Additionally, this course requires familiarity with the intel x86 processor, machine code, and the C language.

Author Statement

As a perpetual student of information security, I am excited to offer this course documenting the steps I took when diving head first into exploitation and writing Proof of Concept (POC) code. In all of my years focusing on these topics, I found many holes and unanswered questions. With this course I aim to bridge the gap between the daily practice of security engineering and the advanced world of security research and hacking. Attackers are always one step ahead and are relying on our nature to become complacent with controls we work so hard to deploy. If you find this topic as fascinating as I do, I look forward to seeing you soon!

- Stephen Sims