Toorcon X Workshop

As I mentioned before, Joe and I are doing a Crash Course In Pentesting 2 day workshop at ToorconX

http://sandiego.toorcon.org/content/section/4/8/

Here's a piece from the description:

"This course will cover some of the newer aspects of pen-testing covering; Open Source Intelligence Gathering with Maltego and other Open Source tools, Scanning, Enumeration, Exploitation (Both remote and client-side) and Post-Exploitation relying heavily on the features included in the Metasploit Framework. We'll discuss our activities from both the Whitebox and Blackbox approach keeping stealth in mind for our Blackbox activities.

Web Application penetration testing will be covered as well with focus on practical exploitation of cross-site scripting (XSS), cross-site request forgery (CSRF), local/remote file includes, and SQL Injection."

But I wanted to give a few more details.

Day 1 is network level pentesting and Day 2 is web application pentesting.

Network level is mostly my responsibility and I'll be focusing on black box information gathering, client side attacks, and post exploitation. Its hard to cover pentesting in a day, so I'll be talking heavily on client side attacks and how to implement those into your pentests and some of the tools you'll need to do it. A little bit on local/priv escalation attacks that you'll need to do once you have that userland shell and post exploitation. There is also a block on metasploit and the students will take home a copy of LSO's Metasploit Mini Course.

Web application is Joe's responsibility and it should be really good. We've had a custom web app built with vulnerabilities intentionally built in. So the students will be able run the tools he is going to discuss and then exploit the vulnerabilities they find. They also get to take the VM home with them.

If you have questions feel free to post up or email me with them.

Crash Course In Penetration Testing Workshop at Toorcon

Joe and I will be conducting our Crash Course In Penetration Testing Workshop at Toorcon in September.

http://sandiego.toorcon.org/content/section/4/8/

Description

Instructors: Joseph McCray & Chris Gates
Includes: 250GB 2.5" USB Harddrive preloaded with lab VMWare images

This course will cover some of the newer aspects of pen-testing covering; Open Source Intelligence Gathering with Maltego and other Open Source tools, Scanning, Enumeration, Exploitation (Both remote and client-side) and Post-Exploitation relying heavily on the features included in the Metasploit Framework. We'll discuss our activities from both the Whitebox and Blackbox approach keeping stealth in mind for our Blackbox activities.

Web Application penetration testing will be covered as well with focus on practical exploitation of cross-site scripting (XSS), cross-site request forgery (CSRF), local/remote file includes, and SQL Injection.

The course will come with a complementary USB Harddrive loaded with the lab Virtual Machine images for you to play with so you can continue to hone your skills and learn new techniques even after the course is finished. Attendees will walk away with a current knowledge of how to pen-test both a network and a web application, all of the basic tools needed, and a set of practice exercises that they can use to improve their skills.

Crash Course In Penetration Testing Workshop at Toorcon

Just got back from doing a workshop with Joe at Toorcon. It was titled Crash Course in Penetration Testing

here is the blurb from the toorcon page:

"This course will start with the basics of pen-testing methodology covering Footprinting, Scanning, Enumeration, and Exploitation which will cover attacking Web Apps, Buffer Overflows, and will set you loose on a set of rootwars challenge servers. The course will come with a complementary USB Harddrive loaded with an attack VM and challenge VM images for you to play with so you can continue to hone your skills and learn new techniques even after the course is finished. Attendees will walk away with a working knowledge of how to pen-test a network, all of the basic tools needed, and a set of exercises that they can use to improve their skills."

All in all, I thought it went really well. we maxed out attendance (actually 2 over), the class was engaged and interested and responsive, so that's always good. What I thought was cool about the workshop is that we gave out 250GB hard disks with all the tools, Virtual Machines, and extra reading to the students. we had a minor issue with the firmware on the drives that they wouldn't mount under linux, so that's a good point for future classes where we do the same thing (not to get those types) but like I said we came away feeling like it went well.

Because Joe is a Pen-tester for his day job, he did most of the talking, but I chimed in when I had something to say and I, of course, did the metasploit section because I am a fanboy.

we really didnt have time to talk Buffer Overflows but we covered the other topics and tried to break them out based on if you are looking at a network internal or external and how to approach it from those perspectives.

I think we are going to run an online version on LSO for members, it will run for about a week each iteration.