Trainings

SAINTCON is focused on providing great technology security instruction and training. Topics and activities at SAINTCON provide all levels of security training from fundamentals to advanced techniques.

The overall schedule can be found here, but these are some of the trainings that will happen at SAINTCON 2017...

Have you ever wanted to know more about testing the security of a web application? Are you responsible for protecting a number of web sites for your employer, but don't know where to begin? And what's with all these acronyms such as CSRF, SQLi, XSS, and SSI? If you want to learn the basics of web application security and testing apps, then this class is for you!

This course covers the different components of a websites, how they can be attacked, and how to protect them. Topics include testing for SQL injection, cross site scripting (XSS), cross site request forgery (CSRF), access controls, authentication and more. You will learn how to use a number of security tools to test for these issues, but the goal is for you to understand the issues rather than be tool dependent.

By the end of the course you should have a foundational understanding of:
* web app vulnerabilities
* techniques for finding vulnerabilities
* exploiting web app flaws
* how to make recommendations to fix them

To take this course, you will need
* a laptop with at least 4 GB of RAM (8 GB would be better)
* already installed virtualization software such as VMware Player/Workstation/Fusion or Virtual Box
* a SamuraiWTF virtual machine already running on your laptop

This introductory to intermediate level class will give you a crash course on Web Application Ethical Hacking. On the first day students will begin with a quick overview of the HTTP Protocol, Proxies, HTML and JavaScript; and then dive into the most common vulnerabilities found on the web and how to test for them. Lessons will be focused on making sure you understand what you're doing, rather than just blindly running another tool. Day two will then jump into effectively using, troubleshooting, and triaging results from automated tools. Knowing where your tools will fail you, and how to fix them when they do; is critical for consistently covering common findings in an application. 

Have you heard your friends or colleagues talk about "sniffing" network traffic?  Do you want to know if that new "smart"-X device is actually just a way for companies to "steal" more of your private information.  Find out what is really happening on your networks with this introduction to Wireshark, one of the most popular tools used in industry for network analysis.  No prior knowledge is necessary.   We will start with a brief introduction to Wireshark, its capabilities and uses. Next, we will discuss where and how to monitor your network with Wireshark and what factors affect those decisions. At this point we are now ready to start applying capture filters, display filters, and custom colorization rules to highlight the information we are interested in seeing. We will focus on understanding several popular network protocols including (ARP, IP, ICMP, TCP, UDP, HTTP and others).  The entire workshop will be very hands on with many different sample captures to work from as we identify both normal and abnormal traffic. We will not be doing any live captures.

Introduction (5 min)
Where and How to sniff (20 min)
Capture and Display Filters (15 min)
Colorization Rules (15 min)
Network Protocols
+ARP (15 min)
+IP (30 min)
+ICMP (15 min)
+UDP (15 min)
+TCP (30 min)
+HTTP (30 min)
Other Considerations - Teaser for the advanced training (15 min)

This class will introduce students to Powershell, showcasing its attractiveness to sysadmins, defenders, and attackers alike.  We'll learn by doing, performing different attacks using popular frameworks, as well as creating our own attack scripts from scratch.  We'll bypass antivirus and whitelisting applications, connecting to our PoC command-and-control centers as we remotely take over a computer: we'll steal documents, grab screen and email content, turn on the mic and webcam, control the mouse and keyboard, modify settings, defeat two-factor authentication, execute programs at will.. anything that a real attacker may do.  From a defender perspective, we'll understand how such attacks work, review the artifacts that they leave behind, and close some of the holes that allow them to take place.

While this is a fast-paced class, no previous Powershell experience is necessary.  Students are expected to have understanding of Windows operations and network infrastructure, as well as basic scripting concepts such as objects, loops, variables, etc.  Students will need to bring their own computer, capable of simultaneously running at least two guest Windows VMs.

The objective of this training is to increase the security awareness and experience with identification and mitigation of vulnerabilities in web and mobile applications. The goal is to produce future applications that are increasingly resilient to attacks. The training is language neutral as the concepts apply to any programming language or development framework with the examples from the most popular ones. The participants will have an opportunity to apply the learned concepts during the hands-on labs and exercises.

Real-world examples drawn from the instructor's pen testing experience are used to demonstrate how OWASP Top 10 vulnerabilities can be combined into surprising compromises. During and after the training attendees will have a custom VM with all the open source tools and hands-on labs/modules that they can practice with after the training or share with their colleagues who missed the training.

Interested in learning how to hack wireless networks? This training workshop will walk you through using the Aircrack suite and hostapd-wpe to test wireless networks. Instruction and labs will cover:

-Scanning for wireless networks and stations
-Identifying hidden SSIDs
-WEP Initialization Vector attacks
-WPA2 PSK capture and cracking
-WPA2-Enterprise evil twin attacks and password cracking

This introductory to intermediate level class will give you a crash course on Web Application Ethical Hacking. On the first day students will begin with a quick overview of the HTTP Protocol, Proxies, HTML and JavaScript; and then dive into the most common vulnerabilities found on the web and how to test for them. Lessons will be focused on making sure you understand what you're doing, rather than just blindly running another tool. Day two will then jump into effectively using, troubleshooting, and triaging results from automated tools. Knowing where your tools will fail you, and how to fix them when they do; is critical for consistently covering common findings in an application. 

If you were the kid who took things apart to see how they worked this course may be for you. Reverse Engineering is the processes of extracting knowledge or design information from anything man-made. SRE (Software Reverse Engineering) or RCE (Reverse Code Engineering) is the process of disassembling binary programs with the intent of understanding their functions, features, and capabilities.

There are many reasons to perform SRE as it has applications in many fields. It is often used for security auditing, cracking, circumventing access restrictions, customizing embedded systems, repairs or retrofits, enabling crippled features, or even mere satisfaction of curiosity. Whatever the reason the skill set is the same. That is the ability to look into a compiled binary and extract from it key information on its design that may or may not be revealed to the end user that runs the application.

In this course, we'll focus on x86 Assembly language and Windows PE file format. The principles from this course can then be applied to other operating systems and instruction sets. Having a basic understanding of C programming is recommended as a prerequisite but it is not required be proficient in the C language.

A windows machine (or VM) is required for the course.
We will be using the freeware version of IDA and a hex editor for the labs.

Training Instruction for NMAP for beginners looking to become more proficient with this powerful tool.  Given basic networking knowledge, how does one begin to use NMAP and progress into some of it's more useful advanced and/or odd functionality. We will begin with the general syntax, and end with "what to do with NMAP when you are bored" as well as finding potentially useful NMAP Scripting Engine (NSE) scripts. We will cover navigating the man pages to significant areas of concern, and general usage tips for when things seem to be going wrong.

This training will focus on using Wireshark to spot potentially malicious traffic on your network. A basic familiarity with Wireshark and network protocols is assumed. However, we will provide a quick review of key concepts covered. We will start with a brief review of Wireshark, its capabilities and uses. Next, we will discuss complex network capture scenarios including encrypted traffic . We will then discuss different network scanning attacks including host discovery, port scanning, OS fingerprinting, ARP spoofing and IP spoofing. We will finally consider recent malware in the headlines and look at how wireshark can help detect these threats. The entire workshop will be very hands on with many different sample captures to work from as we identify both normal and abnormal traffic. We will not be doing any live captures.

Introduction (5 min)
Review: (15 min)
+Filters & Colorization Rules
+Network Protocols
Wireshark tricks: (60 min)
+Capturing encrypted traffic
+Capturing from multiple sources
+Capturing remotely
+Detecting non-standard ports
Network Scans: (60 min)
+Host discovery techniques (15 min)
+Port scanning (30 min)
+OS fingerprinting (15 min)
+ARP/IP spoofing (20 min)
Recent Malware sightings: (60 min)
+Heartbleed
+Mirai
+Wannacry
Summary (5 min)

Get savage in the defense of our information systems in this hands-on training where we will enable you to make small changes within your enterprise to greatly increase the cost for hackers to exploit your information systems. In this highly interactive training we will show you how to flip the script on attackers by detecting and disrupting the most bleeding edge hacking techniques within windows environments used by criminals, pentesters, and red teamers alike.

Topics covered include:
- Endpoint Visibility: Leveraging osquery to detect suspicious actions on targets
- Memory Forensics: Determining if a suspicious process is malicious using ProcDump & Volatility
- PowerShell Prevention: Reducing the attack surface by hardening PS and monitoring suspicious activity
- Lateral Movement: Monitoring key windows events to expose lateral movement by hackers
- Stealthy Malware Detection: Custom endpoint monitoring with Sysmon to easily detect attackers

Take your security game to the next level in this hands-on training!

The objective of this training is to increase the security awareness and experience with identification and mitigation of vulnerabilities in web and mobile applications. The goal is to produce future applications that are increasingly resilient to attacks. The training is language neutral as the concepts apply to any programming language or development framework with the examples from the most popular ones. The participants will have an opportunity to apply the learned concepts during the hands-on labs and exercises. 

Real-world examples drawn from the instructor's pen testing experience are used to demonstrate how OWASP Top 10 vulnerabilities can be combined into surprising compromises. During and after the training attendees will have a custom VM with all the open source tools and hands-on labs/modules that they can practice with after the training or share with their colleagues who missed the training.

This entry-level, hands-on training will introduce students to Splunk in the context of everyday information-security tasks.  We'll understand what Splunk is (and what it isn't), go over architecture and deployment scenarios, and take a bird eye's view of how Splunk works behind the scenes.  We'll review the Search Processing Language and use it for basic querying of large datasets, as we investigate suspicious account and machine activities.  We'll then dive into more complex searches and create interesting queries, reports, dashboards, and alerts, all applicable to monitoring, investigating, and incident response.

Do you want to regain some control over the information and data that you share online?
Do you want to know how to communicate privately and securely with your friends and family?
Do you want to reduce the personal data that advertisers, ISPs, and websites collect about you?
Do you want to harden your online accounts against hostile takeover?

This workshop covers the basic actions you can take right now to protect and privatize your devices, your online accounts, and your network activity.

By the end of this workshop you will:
- Learn about threat modeling
- Take a security self-assessment
- Improve your online privacy & security
- Think twice before using a consumer VPN
- Understand the purpose of password managers
- Understand and experience browser fingerprinting
- Have a guide for privatizing your social media accounts
- Have links to intermediate and advanced security guides
- Understand the importance of account compartmentation
- Know how to securely communicate with a trusted contact
- Watch a live demo of how 2FA prevents an account takeover

Attendees need their laptop, smart phone, and a willingness to ask questions and make the changes that will help defend them against digital attackers.

IT Forensics Fundamentals.  

In this class we will cover the basics of forensics procedures:

Phases of Computer Evidence

  • Collection
  • Preservation
  • Filtering
  • Presentation

Physical Scene

  • Search
  • Documentation
  • Seizure

Understanding Evidence
  • Gathering
  • Handling
  • Documenting
  • Rules of Evidence
  • Evidence Dynamics

Interviews
  • Questions that should be asked
  • Documenting interviews

Volatile Data and Computer State
  • When to cleanly shutdown
  • When to pull the plug
  • When volatile data must be captured

Digital Images
  • Creating digital images that are forensicly sound
  • Documenting digtial images
  • Searching slack space
  • Carving files
  • Understanding Metadata

Building a Case
  • Documenting results
  • Building a report

RESERVED FOR UEN CUSTOMERS

A Deep Dive into the iBoss Platform by iBoss Trainers