OWASP Bucharest AppSec Conference 2017 Training2 - Revision history

Oana Cornea at 08:29, 2 October 2017

2017-10-02T08:29:50Z

Oana Cornea at 20:12, 27 September 2017

2017-09-27T20:12:12Z

Oana Cornea at 15:39, 27 September 2017

2017-09-27T15:39:59Z

Oana Cornea at 18:45, 23 September 2017

2017-09-23T18:45:56Z

Oana Cornea at 18:25, 23 September 2017

2017-09-23T18:25:43Z

Oana Cornea at 18:25, 23 September 2017

2017-09-23T18:25:17Z

Oana Cornea at 18:24, 23 September 2017

2017-09-23T18:24:54Z

Oana Cornea at 19:51, 13 September 2017

2017-09-13T19:51:49Z

Oana Cornea at 19:51, 13 September 2017

2017-09-13T19:51:24Z

Oana Cornea at 19:50, 13 September 2017

2017-09-13T19:50:48Z

@@ Line 6: / Line 6: @@
 | style="width:25%" valign="middle" height="30" bgcolor="#CCCCEE" align="center" colspan="0" | '''Trainers'''
 | style="width:40%" valign="middle" height="30" bgcolor="#CCCCEE" align="center" colspan="0" | '''Description'''
 |-
 | style="width:10%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | 2 days training <br> 11th and 12th of October <br> daily: 9:00 - 17:00<br><br>

@@ Line 6: / Line 6: @@
 | style="width:25%" valign="middle" height="30" bgcolor="#CCCCEE" align="center" colspan="0" | '''Trainers'''
 | style="width:40%" valign="middle" height="30" bgcolor="#CCCCEE" align="center" colspan="0" | '''Description'''
 |-
 | style="width:10%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | 2 days training <br> 11th and 12th of October <br> daily: 9:00 - 17:00<br><br>
@@ Line 85: / Line 55: @@
 '''Seats available:''' 20 (first-come, first served)<br>
 '''Price: 1000 euros/person'''<br>
 [https://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2017-tickets-35356670754 Register here]
 |}

@@ Line 38: / Line 38: @@
 [https://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2017-tickets-35356670754 Register here]
 |-
-| style="width:10%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | 2 days training <br> 12th and 13th of October <br> daily: 9:00 - 17:00<br><br>
+| style="width:10%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | 2 days training <br> 11th and 12th of October <br> daily: 9:00 - 17:00<br><br>
 | style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Advanced Malware Analysis<br>

@@ Line 36: / Line 36: @@
 '''Seats available:	'''20 (first-come, first served)<br>
 '''Price: 400 euros/person'''<br>
 [https://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2017-tickets-35356670754 Register here]
 |-

@@ Line 95: / Line 95: @@
 '''Intended audience:''' This workshop is essential to information security, mobile security & risk management, loss prevention, corporate security and law enforcement personnel interested in Mobile Security. e.g. Security professionals, who possess basic general security knowledge. Personnel who have working knowledge of android security and pentesting and want to gain experience in the end-to-end mobile security process can attend this training.<br>
 '''Skill level:	''' intermmediate - advanced<br>
-'''Requirements: Attendees must bring their laptop (with administrative privileges) to run all the tools and software. The laptop should atleast have 6 GB RAM and 100 GB of Hard Disk Space. The Laptop must have Java, VirtualBox, PuTTY pre-installed.'''
+'''Requirements:''' Attendees must bring their laptop (with administrative privileges) to run all the tools and software. The laptop should atleast have 6 GB RAM and 100 GB of Hard Disk Space. The Laptop must have Java, VirtualBox, PuTTY pre-installed.
 <br>
 '''Seats available:	'''20 (first-come, first served)<br>

@@ Line 52: / Line 52: @@
 *Get prepared for active research at the forefront of these areas.
 *Throughout the course, real-world examples in conjunction with numerous hands-on exercises will provide android pentesting & analysis skills.
 Outline: Android Security
 *Module 1:

@@ Line 45: / Line 45: @@
 The knowledge of Mobile Security, especially Android has become essential in securing today’s digital environment. This workshop is developed to introduce and bring hands on experience of the exciting and growing field of Android Pentesting and its Security Essentials.<br>
 Upon completing this course, the participants are expected to:
 * Gain a set of techniques focused on the use of vendor-neutral, open source tools, Develop the skills to capture suspicious data.
-* Discern unusual patterns hidden within seemingly normal applications.
+*Gain a set of techniques focused on the use of vendor-neutral, open source tools, Develop the skills to capture suspicious data.
-* Understand the basics of Android Security Architecture.
+*Discern unusual patterns hidden within seemingly normal applications.
-* Get trained enough to start into Mobile Pentesting as the new generation Mobile Security Researcher.
+*Understand the basics of Android Security Architecture.
-* Get prepared for active research at the forefront of these areas.
+*Get trained enough to start into Mobile Pentesting as the new generation Mobile Security Researcher.
-Throughout the course, real-world examples in conjunction with numerous hands-on exercises will provide android pentesting & analysis skills.<br>
+*Get prepared for active research at the forefront of these areas.
 Outline: Android Security
-* Module 1
+*Module 1:
-*# Intro to Android
+*#Introduction to Android OS
-*# Android Security Architecture
+*#Android Security Architecture
-*# Android application structure
+*#Android Permission Model
-*# Signing Android applications
+*#Sandboxing Applications
-*# Android Debug Bridge
+*#Setting up the Android Emulator
-*# Understanding Android file system
+*#Setting up a Mobile Pentest Environment
-* Module 2
+*Module 2:
-*# Understanding Android Components
+*#Inspecting Application Certificates and Signatures
-*# Introducing Android Emulator
+*#Signing/Resigning Android Applications
-*# Introducing Android AVD
+*#Application Signatures Verification
-* Module 3
+*Module 3:
-*# Proxying Android Traffic
+*#Bypassing Android Permissions
-*# Reverse Engineering for Android Apps
+*#Introduction to Drozer
-*# Dex Analysis and Obfuscation
+*#Setting up and Running a Drozer Session
-* Module 4
+*Module 4:
-*# Attack Surfaces for Android applications
+*#Reversing Android Applications
-*# Exploiting Local Storage
+*#Analysing DEX Files
-*# Exploiting Weak Cryptography
+*#Working with Logcat
-*# Exploiting Side Channel Data Leakage
+*#Network Traffic Inspection
-*# Root Detection and Bypass
+*#Passive Intent Sniffing
-*# Exploiting Weak Authorization mechanism
+*#Exploiting Services
-*# Identifying and Exploiting Flawed Broadcast Receivers
+*#Exploiting Broadcast Receivers
-*# Identifying and Exploiting Flawed Intents
+*#Exploiting Insecure Data Storage
-*# Identifying and Exploiting Vulnerable Activity Components
+*#Exploiting Poor Cryptography Implementation
-*# Exploiting Backup and Debuggable apps
+*#Exploiting Data Leakage vulnerabilities
-*# Dynamic Analysis for Android Apps
+*#Exploiting the Debuggable Applications
-*# Analyzing Proguard, DexGuard and other Obfuscation Techniques
+*#Static/Dynamic Analysis of Android Applications
 <br>
 '''Intended audience:''' This workshop is essential to information security, mobile security & risk management, loss prevention, corporate security and law enforcement personnel interested in Mobile Security. e.g. Security professionals, who possess basic general security knowledge. Personnel who have working knowledge of android security and pentesting and want to gain experience in the end-to-end mobile security process can attend this training.<br>

@@ Line 94: / Line 94: @@
 |-
 | style="width:10%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | 2 days training <br> 12th and 13th of October <br> daily: 9:00 - 17:00<br><br>
-| style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Advanced Malware analysis<br>
+| style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Advanced Malware Analysis<br>
 | style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Himanshu Khokhar

@@ Line 125: / Line 125: @@
 . Other major types of malware types
-*#Understanding and dissecting JavaScript malwares
+*Understanding and dissecting JavaScript malwares
-*#De-obfuscating JavaScript malwares
+*De-obfuscating JavaScript malwares
-*#Understanding and dissecting PDF based malwares
+*Understanding and dissecting PDF based malwares
-*#Dissecting macro based malwares in Microsoft Office files
+*Dissecting macro based malwares in Microsoft Office files
 . Shellcodes, Rootkits and Ransomwares

@@ Line 102: / Line 102: @@
 Syllabus
 --------------------------------
-*1. Malware ananlysis fundamentals
+. Malware ananlysis fundamentals
-*#Malware analysis and Reverse Engineering
+*Malware analysis and Reverse Engineering
-*#Setting up an environment for malware analysis
+*Setting up an environment for malware analysis
-*#Setting up the toolkit to analyze malwares effectively
+*Setting up the toolkit to analyze malwares effectively
-*#Performing basic static analysis
+*Performing basic static analysis
-*#Performing basic dynamic analysis
+*Performing basic dynamic analysis
-*2. Advanced Static Analysis
+. Advanced Static Analysis
-*#Revisiting x86 assembly concepts to apply it in malware analysis
+*Revisiting x86 assembly concepts to apply it in malware analysis
-*#Recognizing key data structures and language constructs in malware
+*Recognizing key data structures and language constructs in malware
-*#Recognizing and locating common Windows API functions in malwares
+*Recognizing and locating common Windows API functions in malwares
-*#Understanding and defeating anti-disassembly techniques
+*Understanding and defeating anti-disassembly techniques
-*3. Advanced Dynamic malware analysis
+. Advanced Dynamic malware analysis
-*#Getting used to debuggers and debugging
+*Getting used to debuggers and debugging
-*#Understanding and defeating anti-debugging techniques
+*Understanding and defeating anti-debugging techniques
-*#Dealing with packed malwares
+*Dealing with packed malwares
-*#Unpacking packed malwares and challenges in unpacking
+*Unpacking packed malwares and challenges in unpacking
-*#Dumping packed malwares in unpacked state from memory
+*Dumping packed malwares in unpacked state from memory
-*#Understanding Code injection in depth
+*Understanding Code injection in depth
-*#Dissecting file-less malwares
+*Dissecting file-less malwares
-*4. Other major types of malware types
+. Other major types of malware types
 *#Understanding and dissecting JavaScript malwares
 *#De-obfuscating JavaScript malwares
@@ Line 130: / Line 130: @@
 *#Dissecting macro based malwares in Microsoft Office files
-*5. Shellcodes, Rootkits and Ransomwares
+. Shellcodes, Rootkits and Ransomwares
-*#Understanding Shellcodes and performing Shellcode analysis
+*Understanding Shellcodes and performing Shellcode analysis
-*#Understanding Rootkits and performing Rootkit analysis
+*Understanding Rootkits and performing Rootkit analysis
-*#Understanding Ransomwares and performing Ransomware analysis
+*Understanding Ransomwares and performing Ransomware analysis
-'''Intended audience:Advanced Malware Analysis is a full hands-on course. It is useful both for beginners into the field of malware analysis, as well as for those who have been into this area for some time but want to polish their skills to a new level. Other than malware analysts, reverse engineers, forensic investigators, threat analysts, students, people wanting to get into malware analysis can take this course.''' <br>
+'''Intended audience:'''Advanced Malware Analysis is a full hands-on course. It is useful both for beginners into the field of malware analysis, as well as for those who have been into this area for some time but want to polish their skills to a new level. Other than malware analysts, reverse engineers, forensic investigators, threat analysts, students, people wanting to get into malware analysis can take this course. <br>
-'''Skill level:	''' <br>
+'''Skill level:	''' Intermediate <br>
 '''Requirements: Knowledge of x86 Assembly lang, familiarity with debuggers, disassemblers, Windows OS. A Laptop with at least 8 GB of RAM. VMWare Workstation or Virtualbox. '''
 <br>
-'''Seats available:	'''20 (first-come, first served)<br>
+'''Seats available:''' 20 (first-come, first served)<br>
 '''Price: 1000 euros/person'''<br>
 [https://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2017-tickets-35356670754 Register here]
 |}