Date: October 3,4
Presenters: Craig Young
Skill Level: Beginner / Intermediate

Note: This course will be offered In-Person

Since 2019, the NSA’s software reverse engineering toolkit, Ghidra, has made powerful multi-architecture/multi-platform decompilation capabilities freely available. Join us for an introduction to Ghidra and a series of incremental challenges to build up hands-on experience. Students will learn how to navigate Ghidra, analyze binaries, and use integrated Python scripting. We’ll then shift focus to see what some common anti-reversing techniques look like when analyzed with Ghidra. Lessons will illustrate strategies for peeling back these layers of obfuscation using gradually more sophisticated examples. By the end of the class, students will be writing their own Ghidra scripts to recover encrypted data from real malware samples.

The course has been updated to use Ghidra v10 including the hotly anticipated debugger!

Date: October 3,4
Presenters: NotSoSecure
Skill Level: Beginner/Intermediate

Note: This course will be offered In-Person

This 2-day course cuts through the mystery of Cloud Services (including AWS, Azure, and G-Cloud) to uncover the vulnerabilities that lie beneath. We will cover a number of popular services and delve into both what makes them different, and what makes them the same, as compared to hacking traditional network infrastructure. Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques, and knowing how to protect yourself from them is critical. This course covers both the theory as well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure. Prior pentest/security experience is not a strict requirement, however, some knowledge of Cloud Services and familiarity with common Unix command-line syntax will be beneficial. This is a attack only focused class. In case you are interested in the Defense of all these attacks please register on our Hacking and Securing Cloud Infrastructure 4 Day Class.

Note: Students will have access to a state-of-the-art Hacklab with a wide variety of vulnerabilities to practice exploitation and will receive a FREE 1 month subscription after the class to allow more practice time along with the support portal to clear doubts.

Highlights of our Training:

• Gaining Entry in cloud via exposed services
• Attacking specific cloud services
• Post Exploitation
• Auditing and benchmarking of Cloud
• Continuous Security Testing of Cloud
  

Date: October 3,4
Presenters: Mohammed Aldoub (@voulnet)
Skill Level: Beginner/Intermediate

NOTE: This course will be a Virtual event

This is a fully hands-on practical concentrated course on securing and attacking web and cloud APIs. APIs are everywhere nowadays: In web apps, embedded systems, enterprise apps, cloud environments and even IoT, and it is becoming increasingly necessary to learn how to defend, secure and attack API implementation and infrastructure. This training aims to engage you in creating secure modern APIs, while showing you both modern and contemporary attack vectors.

With more than 55 labs in two days, you are in for a glue-me-to-the-keyboard adventure covering:

• Defending and attacking Web APIs (REST, GraphQL..etc)
• Attacking and securing AWS APIs and infrastructure.
• Launching and mitigating modern Injection attacks (SSTI, RCE, SQLi, NoSQLi, Deserialization, object injection and more)
• Securing and attacking passwords and secrets in APIs.
• API authentication, authorization and access control.
• Targeting and defending API architectures (Serverless, microservices, web services & APIs)
  

Date: October 3,4
Presenters: Paula Januszkiewicz & Dr. Mike Jankowski-Lorek
Skill Level: Intermediate

NOTE: This course will be offered In-Person

Exploits are not the only way to get to the systems! We will go through the operating system’s built-in problems and explore how they can be beneficial for hackers. One of the most important things to conduct a successful attack/pentest is to understand how the targets work. To the bones! Afterwards everything is clear and the tool is just a matter of our need.

This deep-dive training on Active Directory security will cover a broad range of topics. You will learn how to perform Pass-the-Something attacks, bypass common mitigations like LSA process protection or Credential Guard, launch offline attacks against domain controllers, audit AD-stored credentials, decrypt passwords, private keys, and other sensitive data from user profiles and achieve stealthy persistence. Several of these topics will be based on presenters’ own unique security research.

The training is a must-go for security administrators, engineers, and architects. The content will be highly technical and unsuitable for people who are afraid of command-line interfaces. At least 5 years of experience with Active Directory are recommended.

Date: October 1-4
Presenters: : Monnappa & Sajan Shetty
Skill Level: All

NOTE: This course will be a Virtual event

This 4-day virtual training teaches the concepts, tools, and techniques to analyze, investigate, and hunt malwares by combining two powerful techniques malware analysis and memory forensics.

This course will introduce attendees to the basics of malware analysis, reverse engineering, Windows internals, and memory forensics. It then gradually progresses deep into more advanced concepts of malware analysis & memory forensics. Attendees will learn to perform static, dynamic, code, and memory analysis. To make the training completely practical, it consists of scenario-based hands-on labs after each module, which involves analyzing real-world malware samples and investigating malware infected memory images (crimeware, APT malware, Fileless Malware, Rootkits, etc.). This hands-on training is designed to help attendees gain a better understanding of the subject in a short span of time.

Throughout the course, the attendees will learn the latest techniques used by the adversaries to compromise and persist on the system. In addition to that, it also covers various code injection, hooking, and rootkit techniques used by the adversaries to bypass forensic tools and security products. During the training, you will also gain an understanding of how to integrate malware analysis and memory forensics techniques into a custom sandbox to automate the analysis of malicious code.

After taking this course, attendees will be better equipped with the skills to analyze, investigate, hunt, and respond to malware-related incidents.Whether you are a beginner interested in learning malware analysis and memory forensics from scratch or an experienced professional who would like to enhance your existing skills to perform a forensic investigation or threat hunting, this training will help you accomplish your goals.

Note: Students will be provided with malware samples, malware-infected memory images, course material, lab solution manual, video demos, custom scripts, and Linux VM.

Date: October 1-4
Presenters: : NotSoSecure
Skill Level: Intermediate

NOTE: This course will be offered In-Person

The 2022 edition of our best selling class, brings more new, neat and ridiculous network hacks. From old-school misconfiguration issues to the very latest cutting-edge techniques and exploits against the modern network platforms, we have got it all covered. The course will cover advanced penetration techniques to achieve exploitation against these platforms:Modern Operating systems (Windows, Linux)Multiple Databases, Web and Application serversSwitches/RoutersDockerVLANsKubernetesAWS/Azure/GCP specific attacksIaaS, PaaS, CaaS, SaaS and Serverless exploitationLogging and Monitoring Network AttacksVPNsNote: Students will have access to a state-of-the-art Hacklab with a wide variety of vulnerabilities to practice exploitation and will receive a FREE 1 month subscription after the class to allow more practice time.