AppSec Seattle 2006/Training - Revision history

OWASP: /* T1. Foundations of Web Application Security - One Day Course - October 16th, 2006 */

2006-12-13T20:36:01Z

‎T1. Foundations of Web Application Security - One Day Course - October 16th, 2006

OWASP at 20:35, 13 December 2006

2006-12-13T20:35:36Z

Esheridan: /* T2. Web Services and XML Security - One Day Course - October 16th, 2006 */

2006-10-11T19:50:19Z

‎T2. Web Services and XML Security - One Day Course - October 16th, 2006

Esheridan: /* T2. Web Services and XML Security - One Day Course - October 16th, 2006 */

2006-10-11T19:49:55Z

‎T2. Web Services and XML Security - One Day Course - October 16th, 2006

Wichers: /* T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006 */

2006-10-09T14:17:14Z

‎T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006

Wichers: /* T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006 */

2006-10-09T14:16:16Z

‎T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006

Wichers: /* T1. Foundations of Web Application Security - One Day Course - October 16th, 2006 */

2006-10-09T14:12:33Z

‎T1. Foundations of Web Application Security - One Day Course - October 16th, 2006

Wichers: /* T3. Advanced Asp.Net Exploits and Countermeasures - One Day Course - October 16th, 2006 */

2006-09-01T14:29:15Z

‎T3. Advanced Asp.Net Exploits and Countermeasures - One Day Course - October 16th, 2006

Wichers: /* T3. Advanced Asp.Net Exploits and Countermeasures - One Day Course - October 16th, 2006 */

2006-08-16T18:27:27Z

‎T3. Advanced Asp.Net Exploits and Countermeasures - One Day Course - October 16th, 2006

Wichers at 18:26, 16 August 2006

2006-08-16T18:26:44Z

@@ Line 86: / Line 86: @@
 '''Tutorial Provider'''
-This tutorial is provided by longtime OWASP contributor: [http://www.aspectsecurity.com https://www.owasp.org/images/3/30/200px-Aspect_Security_Logo.jpg]
+This tutorial is provided by longtime OWASP contributor: [http://www.aspectsecurity.com https://www.owasp.org/images/3/30/100px-Aspect_Security_Logo.jpg]
 == T2. Web Services and XML Security - One Day Course - October 16th, 2006 ==

@@ Line 86: / Line 86: @@
 '''Tutorial Provider'''
-This tutorial is provided by longtime OWASP contributor: [http://www.aspectsecurity.com http://www.owasp.org/docroot/owasp/img/members/aspect_logo.gif]
+This tutorial is provided by longtime OWASP contributor: [http://www.aspectsecurity.com https://www.owasp.org/images/3/30/200px-Aspect_Security_Logo.jpg]
 == T2. Web Services and XML Security - One Day Course - October 16th, 2006 ==

@@ Line 113: / Line 113: @@
 Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b
-'''Tutorial'''
+'''Tutorial Provider'''
 This tutorial is provided by [http://www.arctecgroup.net http://www.owasp.org/images/b/bc/Arctec_logo.jpeg]

← Older revision		Revision as of 19:49, 11 October 2006
Line 112:		Line 112:

	Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b		Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b
		+
		+	'''Tutorial'''
		+
		+	This tutorial is provided by [http://www.arctecgroup.net http://www.owasp.org/images/b/bc/Arctec_logo.jpeg]

	== T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006 ==		== T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006 ==

← Older revision		Revision as of 14:17, 9 October 2006
Line 174:		Line 174:
	'''Tutorial Provider'''		'''Tutorial Provider'''

−	This tutorial is provided by: [http://www.~~aspectsecurity~~.com http://www.owasp.org/~~docroot~~/~~owasp/img~~/~~members~~/~~aspect_logo~~.gif]	+	This tutorial is provided by: [http://www.ioactive.com http://www.owasp.org/images/4/46/IOActive.gif]

← Older revision		Revision as of 14:16, 9 October 2006
Line 171:		Line 171:

	Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b		Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b
		+
		+	'''Tutorial Provider'''
		+
		+	This tutorial is provided by: [http://www.aspectsecurity.com http://www.owasp.org/docroot/owasp/img/members/aspect_logo.gif]

← Older revision		Revision as of 14:12, 9 October 2006
Line 83:		Line 83:

	Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b		Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b
		+
		+	'''Tutorial Provider'''
		+
		+	This tutorial is provided by longtime OWASP contributor: [http://www.aspectsecurity.com http://www.owasp.org/docroot/owasp/img/members/aspect_logo.gif]

	== T2. Web Services and XML Security - One Day Course - October 16th, 2006 ==		== T2. Web Services and XML Security - One Day Course - October 16th, 2006 ==

@@ Line 109: / Line 109: @@
 Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b
-== T3. Advanced Asp.Net Exploits and Countermeasures - One Day Course - October 16th, 2006 ==
+== T3. Advanced ASP.NET Exploits and Countermeasures - One Day Course - October 16th, 2006 ==
 '''Course Overview'''
-In this one day course you will push Asp.Net to the limit and will be shown how Asp .NET applications and environments can be exploited by skilled attackers. Advanced exploitation techniques will be presented together with low-level technical analysis of the .Net Framework. You will also learn advanced defense techniques such as: Building an Asp .NET Security Protection layer (also called a Web Application Firewall) and Real time patching of vulnerabilities in the target application, the .Net Framework or the CLR.
+In this one day course you will push ASP.NET to the limit and will be shown how ASP.NET applications and environments can be exploited by skilled attackers. Advanced exploitation techniques will be presented together with low-level technical analysis of the .NET Framework. You will also learn advanced defense techniques such as: Building an ASP.NET Security Protection layer (also called a Web Application Firewall) and Real time patching of vulnerabilities in the target application, the .NET Framework or the CLR.
 '''Details'''
@@ Line 119: / Line 119: @@
 The Course is made of 2 modules (one in the morning and one in the afternoon)
-'''Module 1: Security principles and .NET Framework Architecture; Guerrilla Threat Modeling; Exploiting Asp.Net Applications'''
+'''Module 1: Security principles and .NET Framework Architecture; Guerrilla Threat Modeling; Exploiting ASP.NET Applications'''
-* Analysis of the .Net Framework and its core components (CLR, Garbage Collector, Verifier, Security Manager)
+* Analysis of the .NET Framework and its core components (CLR, Garbage Collector, Verifier, Security Manager)
 * Using quick-and-dirty threat models to discover vulnerabilities in the target application
-* Exploiting vulnerabilities in Asp.Net applications: Data Validation, Authorization, Authentication, SessionState, XSS, Cookies, AJAX, Web Services, Remoting, etc. (using basic and advanced techniques)
+* Exploiting vulnerabilities in ASP.NET applications: Data Validation, Authorization, Authentication, SessionState, XSS, Cookies, AJAX, Web Services, Remoting, etc. (using basic and advanced techniques)
-* Exploiting Buffer Overflows and Windows vulnerabilities via Asp.Net Applications
+* Exploiting Buffer Overflows and Windows vulnerabilities via ASP.NET Applications
-'''Module 2: Exploiting Full Trust and Partial Trust Asp.Net Environments; Advanced Asp.Net Countermeasures'''
+'''Module 2: Exploiting Full Trust and Partial Trust ASP.NET Environments; Advanced ASP.NET Countermeasures'''
-* Practical demonstrations of the power of Full Trust Asp.Net:
+* Practical demonstrations of the power of Full Trust ASP.NET:
 * Rooting the CLR (e.g. patching the .Net Framework and CLR), Reflection, IIS Metabase, Shellcode injection, Launching internal attacks to compromise the server and the data center
 * Full Trust non-verification and Type Safety attacks (via MSIL manipulation)
-* Exploiting Insecure Partial Trust Asp.Net Environments
+* Exploiting Insecure Partial Trust ASP.NET Environments
-* Applying real-time security patches in the target application, .Net Framework and CLR
+* Applying real-time security patches in the target application, .NET Framework and CLR
 * Solutions to create secure Data Validation and Authorization architectures
-* Creating secure Asp.Net hosting environments
+* Creating secure ASP.NET hosting environments
-* Building an Asp.Net Security Protection layer (also called web Application Firewall);
+* Building an ASP.NET Security Protection layer (also called Web Application Firewall);
 You will walk away from this class with a much better understanding of some of the weaknesses of .NET applications, particularly the internals of the .NET framework. You will also get the chance to put your skills to the test against a target application over the course of the class.
@@ Line 158: / Line 158: @@
 '''Trainer'''
-Dinis Cruz is the current Owasp .Net Project leader and the main developer of several of OWASP .Net tools (SAM'SHE, ANBS, SiteGenerator, PenTest Reporter, Asp.Net Reflector, Online IIS Metabase Explorer).
+Dinis Cruz is the current Owasp .Net Project leader and the main developer of several of OWASP .NET tools (SAM'SHE, ANBS, SiteGenerator, PenTest Reporter, Asp.Net Reflector, Online IIS Metabase Explorer).
 Dinis is also is a Senior IOActive Security Consultant based in London (UK) and specialized in: ASP.NET Application Security, Active Directory deployments, Application Security audits and .NET Security Curriculum Development.
-Since the 1.1 release of the .Net Framework, Dinis has been one of the strongest proponents of the need to write .Net applications that can be executed in secure Partially Trusted .Net environments, and has done extensive research on: Rooting the CLR, exposing the dangers of Full Trust Asp.Net Code, Type Confusion vulnerabilities in Full Trust (i.e. non verifiable) code, creating .Net Security Protection Layers and using Reflection to dynamically manipulate .Net Client applications.
+Since the 1.1 release of the .NET Framework, Dinis has been one of the strongest proponents of the need to write .NET applications that can be executed in secure Partially Trusted .NET environments, and has done extensive research on: Rooting the CLR, exposing the dangers of Full Trust ASP.NET Code, Type Confusion vulnerabilities in Full Trust (i.e. non verifiable) code, creating .Net Security Protection Layers and using Reflection to dynamically manipulate .Net Client applications.
 '''Registration'''
 Registration is available via the OWASP Conference Cvent site at: http://guest.cvent.com/i.aspx?4W,M3,57a181da-f20b-40fb-80ef-472a647bce7b