ＨｉｄｅＺｅｒｏＯｎｅ

The Bug Hunter’s Methodology (TBHM) is a two-day, paid, virtual training that aims to equip you with the latest tools, techniques, and strategies, plus provide a data-driven methodology on how and where to search for vulnerabilities that are currently common in the wild.

Unlike other courses, TBHM Live is not an A-Z or beginner-oriented course. True to the spirit of my public TBHM talks, my emphasis is on expert tips, time-saving tricks, practical Q&As, automation strategies, vetted resources, and engagement via the dedicated community on Discord.

The Mandiant – Hunt Mission Workshop, also known as the Practical Threat Hunting course, is a comprehensive three-day training program designed to equip threat hunters and incident responders with the core concepts of developing and executing threat hunts.

The course aims to enable students to:

• Apply cyber threat intelligence concepts to hunt for adversary activity in their environment.
• Establish a repeatable hunt methodology and develop hunt use cases.
• Leverage endpoint data to hunt.
• Establish measures of effectiveness for a hunt program.

Mandiat – Hunt Mission Workshop

Mandiant red teams have conducted hundreds of covert red team operations. This course draws on that knowledge to help learners improve their ability to prevent, detect, and respond to threats in an enterprise network.

Learners will better understand advanced threat actor behavior that Mandiant experts have observed through incident response investigations. Learners will also see how Mandiant red teams refine advanced attacker tactics, techniques and procedures (TTPs) for use by red teams in their attempts to emulate advanced threat actors. Learners will develop the ability to think like an attacker and creatively use these TTPs to accomplish response goals while avoiding detection.

Mandiant red team leads conduct this fast-paced technical course with presentations and scenario-based labs based on frontline expertise and intelligence-based security research. Learners receive hands-on experience conducting covert cyber attack simulations that mimic real-world threat actors. They will learn how to bypass advanced network segmentation, multi-factor authentication and application whitelisting, abuse web applications, escalate privileges and steal data while circumventing detection methods.

The Corelan “BOOTCAMP” is a truly unique opportunity to learn both basic & advanced techniques from an experienced exploit developer, at a conference. During this (typically 3 ‘long’ day) course, students will be able to learn all ins and outs about writing reliable exploits for the Windows platform.  The trainer will share his “notes from the field” and various tips & tricks to become more effective at writing exploits.

We believe it is important to start the course by explaining the basics of stack buffer overflows and exploit writing, but this is most certainly not “your average” entry level course. In fact, this is a true bootcamp and one of the finest and most advanced courses you will find on Win32 stack based exploit development.

This hardcore hands-on course will provide students with solid understanding of current x86 (stack based) exploitation techniques and memory protection bypass techniques.  We make sure the course material is kept updated with current techniques, includes previously undocumented tricks and techniques, and details about research we performed ourselves.  Combined with the way the course is built up, this will turn this class into a truly unique experience.

Syllabus

• The x86 environment

  • System Architecture
  • Windows Memory Management
  • Registers
  • Introduction to Assembly
  • The stack
  • Running 32bit applications on a 64bit OS (wow64)

• The exploit development lab environment

  • Setting up the exploit developer lab
  • Using debuggers and debugger plugins to gather primitives

• Stack Buffer Overflows

  • Stack Buffers
  • Functions
  • Saved return pointer overwrites
  • Stack cookies
  • Structured Exception Handlers
  • etc

• Egg hunters

  • Using egghunters
  • Egg hunters in a WoW64 environment

• Reliability++ & Reusability++

  • Finding and avoiding bad characters
  • Creative ways to deal with character set limitations

• Metasploit framework Exploit Modules

  • Writing exploits for the Metasploit Framework
  • Porting exploits to the Metasploit Framework

• ASLR

  • Bypassing ASLR

  DEP

  • Bypassing NX/DEP
  • Return Oriented Programming / Code Reuse (ROP)

  Intro to x64 exploitation

  • x64 processes, memory map, registers
  • Functions & calling conventions
  • Structured Exception Handling
  • Stack buffer overflows
  • ROP
  • Shellcode

Corelan Win32 Exploit Development Bootcamp

The Advanced Software Exploitation (ASE) course offers security professionals an opportunity to test and develop their skills like never before. During this course, students will learn to identify common vulnerabilities and then use them to develop exploits for a wide range of software applications, including popular Windows applications, interpreted languages, and Web browsers.

In the first half of the course, attendees will use fuzzing, reverse engineering, and source code auditing, to attack a wide variety of applications (e.g. iTunes, Firefox, Vulnserver, etc.) and then use proven exploitation techniques to develop an exploit for one of the VMs (Windows 7, Windows 8.1 and Windows 10).

Then, in the second half of the course, the focus will shift from classic vulnerabilities to more advanced ones. In this section, students will learn how to escape Java sandbox using a type confusion vulnerability, how to circumvent the ASLR without pointer leaks, and how to use precise heap spraying, just to name a few.

By the end of this course, students will know how to find software vulnerabilities using fuzzing, reverse engineering, and source code auditing, and then how to write their own exploits in Python, JavaScript, or Java.

Syllabus

Fundamentals: Intro
Fundamentals: Stack Buffer Overflow
Fundamentals: Structured Exception Handler Overwrite
File Format Fuzzing: Intro
File Format Fuzzing: The Peach Fuzzer
Network Protocol Fuzzing: Vulnerability Discovery
Network Protocol Fuzzing: Exploitation
Attacking Web Browsers: Vulnerability Discovery
Attacking Web Browsers: Exploitation
Practical Patch Diffing
Exploiting vulnerabilities in the Oracle JVM: Vulnerability Discovery

Exploiting vulnerabilities in the Oracle JVM: Exploitation

Advanced Windows exploitation

Conclusion

Ptrace Security – Advanced Software Exploitation