Offensive Operations
Explore content featuring this instructor’s insights and expertise.
Fear not the kernel. This WinDbg workshop takes you below user mode to inspect filesystem minifilters, kernel structures, and security product telemetry, building the debugger confidence needed for advanced SEC665 research.
SEC665: Advanced Red Team Operations is here. Attend this workshop for a deep dive into the brand-new course - exploring its syllabus, advanced tooling, security product internals, and kernel driver reversing, all culminating in a live lab demo built for seasoned operators.
In this fast-paced, fun talk, we'll cover the top ways that I've improved my efficiency and productivity by changing the way I interact with Al so far in 2025.
By now you have learned how to travel through time using Time Travel Debugging. TTD is such a powerful feature and you’ve only begun to scratch the surface of its use cases.
Join SANS instructor Jonathan Reiter for this webcast covering his newly published poster, Comprehensive Kernel Debugging for Windows Developers.
Have you ever wanted to debug Windows binaries with WinDbg, but just not sure where to start? Well, this brand new series of workshops is for you! This series of workshops will start with the absolute basics of WinDbg and debugging in general. By the end of the entire series, you will be much more comfortable with WinDbg and will understand what's happening under the hood a bit more.
Dive into the intricacies of Portable Executable (PE) parsing in this presentation showcasing the usefulness of the PE Parsing with WinDbg cheat sheet.
Hear ye! Hear ye! Be ye free from the CRT! What’s life like anyway without the CRT? What can a program even do without it? As the entire series comes to a close, this part will explore the CRT and how to become independent from it. This independence is critical to understand when it comes to creating binaries that are compiled as PIC; Position Independent Code.
Directory enumeration is just one of many features implants should have. The first workshop covered how to do that, and this workshop will cover how to enumerate processes and modules that could be loaded in them.
Step into an inspiring conversation with SANS Instructors Jonathan Reiter, Christopher Elgee, and Jon Gorenflo—esteemed professionals who have seamlessly transitioned from military service to thriving careers in cybersecurity. Whether you're a current service member, a veteran, or someone looking to understand the unique advantages of a military background in the cyber world, this session is for you! Meet the Speakers: • Jonathan Reiter, Senior Master Sergeant (E8) & Certified Instructor: With years of experience in military cyber operations, Jonathan brings invaluable insights into the skills and discipline honed in the service and how they translate into success in the private sector. • Christopher Elgee, Certified Instructor & Senior Security Analyst, Counter Hack: A seasoned instructor with a deep understanding of offensive cyber tactics, Christopher will share his journey from military duty to becoming a leading voice in cybersecurity education and practice. • Jon Gorenflo, Principal Instructor: As a former military cyber professional now excelling in the civilian world, Jon offers a unique perspective on the transition process, the challenges faced, and the opportunities available. What You'll Learn: • The parallels between military and private sector cyber roles • How military experience can provide a solid foundation for a cybersecurity career • Tips and advice on transitioning from military service to the civilian cyber industry • Answers to your burning questions about leveraging military skills in the cyber realm Why Attend? • Inspiration: Hear firsthand stories of transformation and success. • Insight: Gain practical advice on making your own career shift. • Connection: Network with like-minded professionals and expand your support system. Engage in a dynamic discussion and leave with a clearer path to your future in cybersecurity.
This presentation delves into the strategic utilization of Windows HTTP libraries, WinInet and WinHTTP, for developing red team malware tools. Starting with an overview of these libraries, we highlight their pivotal roles in Windows networked applications, particularly in covert operations and data exfiltration scenarios. The WinInet API, primarily client-focused, and the server-optimized WinHTTP API are examined for their applicability in maintaining stealthy communications with command and control servers. A practical beaconing example in C++ will demonstrate each library's functionality in simulated red team scenarios. The session concludes with a case study on certificate pinning, essential for bypassing network security measures and enhancing the stealthiness of malware communications. Attendees will leave with a comprehensive understanding of how to choose and implement the right HTTP library to bolster the effectiveness and discretion of their malware initiatives.
When developing an implant in C/C++ for Windows, there will come a time when you must implement some kind of directory enumeration capability. There are several methods that can help you achieve this and this workshop will talk about a few and implement one of them using Windows APIs.
How do applications download Internet resources like files, how are specific requests crafted like GET and POST, how are headers and user agent strings created? This part of the series will answer all of those questions by introducing two Win32 libraries: WinHttp and WinINet.
Threads, stacks, and heaps! Part 8 will take a look at using Windows APIs to create threads, heaps, and using a debugger to view stacks. We will also talk about some of the myths around stack growth versus stack usage.
On part 6 of the series we learned about the anatomy of executable images and parsing PE headers. We will continue with PE parsing and will explore a few more interesting areas of a PE file.
After enumerating a list of loaded modules, it's only fitting to get started with what normally comes next, parsing exports of a DLL. Before we can do that, we will have to understand the anatomy of executable images. This means parsing PE headers. It would be great to have the following programs installed before this Part 6: WinDbg, PE Explorer by Pavel.PS: don't forget your files from Part 5; you'll need them!
Picking up where Part 4 left off, we will have linked list enumeration where we will look at a real world example of how knowing the underlying structure comes into play. After linked list enumeration, we can finally start to talk about some Windows internals, Windows APIs, and Windows specific structures.
Part 4 of this series will continue where Part 3 left off with the introduction of functions. For this part we will learn how how create functions that accept pointers as arguments, how to validate pointer arguments, SAL annotations, structures, and linked lists.
Have you ever wanted to understand how the tools and frameworks you are using during a Red Team engagement work under the hood?
Pointers that point, loops that make you dizzy, and functions that do something. For Part 3 of our series we'll continue where Part 2 left off and then introduce pointers, loops, and functions and their stack frames.