From BruCON 2015
Jump to: navigation, search
(Trainers Biography)
 
(One intermediate revision by the same user not shown)
Line 2: Line 2:
  
 
===Course Description===
 
===Course Description===
Have you ever thought of hacking web applications for fun and profit? How about playing with authentic, award-winning security bugs identified in some of the greatest companies? If that sounds interesting, join this two-day hands-on training!
+
Have you ever thought of hacking web applications for fun and profit? How about playing with authentic, award-winning security bugs identified in some of the greatest companies? If that sounds interesting, join this hands-on training!
  
I will discuss security bugs that I have found together with Michał Bentkowski in a number of bug bounty programs (including Google, Yahoo, Mozilla, Twitter and others). You will learn how bug hunters think and how to hunt for security bugs effectively.
+
I will discuss security bugs that I have found together with Michał Bentkowski in a number of bug bounty programs (including Google, Yahoo, Mozilla, Twitter and others). You will learn how bug hunters think and how to hunt for security bugs effectively.  
  
To be successful in bug hunting, you need to go beyond automated scanners. If you are not afraid of going into detail and doing manual/semi-automated analysis, then this hands-on training is for you. After completing this training, you will have learned about:
+
To be successful in bug hunting, you need to go beyond automated scanners. If you are not afraid of going into detail and doing manual/semi-automated analysis, then this hands-on training is for you.
 +
 
 +
After completing this training, you will have learned about:
 
* tools/techniques for effective hacking of web applications
 
* tools/techniques for effective hacking of web applications
 
* non-standard XSS, SQLi, CSRF
 
* non-standard XSS, SQLi, CSRF
Line 28: Line 30:
 
* logical flaws
 
* logical flaws
 
* and more…
 
* and more…
 +
 +
If you want to know what students from Oracle, Adobe, ESET and other companies say about this
 +
training, then visit [https://silesiasecuritylab.com/services/training/#opinions this page] to learn more.
  
 
Students will be handed in a VMware image with a specially prepared testing environment to play with the bugs. What's more, this environment is self-contained and when the training is over, students can take it home (after signing a non-disclosure agreement) to hack again at their own pace.
 
Students will be handed in a VMware image with a specially prepared testing environment to play with the bugs. What's more, this environment is self-contained and when the training is over, students can take it home (after signing a non-disclosure agreement) to hack again at their own pace.
Line 40: Line 45:
 
Dawid Czagan has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.  
 
Dawid Czagan has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.  
  
Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing and training services. He also works as Security Architect at Future Processing. Dawid shares his security bug hunting experience in his hands-on training "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". He delivered security trainings/workshops at CanSecWest (Canada), DeepSec (Austria), IAESTE CaseWeek (Silesian University of Technology, Poland) and for many private companies. Dawid also published over 20 security articles (InfoSec Institute, USA).  
+
Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing and training services. He also works as Security Architect at Future Processing.  
 +
 
 +
Dawid shares his security bug hunting experience in his hands-on training "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". He delivered security trainings/workshops at Hack In The Box (Amsterdam), CanSecWest (Vancouver), DeepSec (Vienna), Hack In Paris (Paris) and for many private companies. He also spoke at Security Seminar Series (University of Cambridge) and published over 20 security articles
 +
(InfoSec Institute).
  
 
To find out about the latest in Dawid’s work, you are invited to visit his blog and follow him on Twitter (see below).
 
To find out about the latest in Dawid’s work, you are invited to visit his blog and follow him on Twitter (see below).
Line 48: Line 56:
 
Links :  
 
Links :  
 
* [https://silesiasecuritylab.com/blog Dawid's blog]
 
* [https://silesiasecuritylab.com/blog Dawid's blog]
 +
* [https://silesiasecuritylab.com/services/training/#opinions What students say about this training]
  
 
''Mon. 5 - 6 October 2015 (09:00 - 17:00)''
 
''Mon. 5 - 6 October 2015 (09:00 - 17:00)''

Latest revision as of 14:10, 24 June 2015

Hacking web applications – case studies of award-winning bugs in Google, Yahoo, Mozilla and more

Course Description

Have you ever thought of hacking web applications for fun and profit? How about playing with authentic, award-winning security bugs identified in some of the greatest companies? If that sounds interesting, join this hands-on training!

I will discuss security bugs that I have found together with Michał Bentkowski in a number of bug bounty programs (including Google, Yahoo, Mozilla, Twitter and others). You will learn how bug hunters think and how to hunt for security bugs effectively.

To be successful in bug hunting, you need to go beyond automated scanners. If you are not afraid of going into detail and doing manual/semi-automated analysis, then this hands-on training is for you.

After completing this training, you will have learned about:

  • tools/techniques for effective hacking of web applications
  • non-standard XSS, SQLi, CSRF
  • RCE via serialization/deserialization
  • bypassing password verification
  • remote cookie tampering
  • tricky user impersonation
  • serious information leaks
  • browser/environment dependent attacks
  • XXE attack
  • insecure cookie processing
  • session related vulnerabilities
  • mixed content vulnerability
  • SSL strip attack
  • path traversal
  • response splitting
  • bypassing authorization
  • file upload vulnerabilities
  • caching problems
  • clickjacking attacks
  • logical flaws
  • and more…

If you want to know what students from Oracle, Adobe, ESET and other companies say about this training, then visit this page to learn more.

Students will be handed in a VMware image with a specially prepared testing environment to play with the bugs. What's more, this environment is self-contained and when the training is over, students can take it home (after signing a non-disclosure agreement) to hack again at their own pace.

Requirements

To get the most of this training basic knowledge of web application security is needed. Students should have some experience in using a proxy, such as Burp, or similar, to analyze or modify the traffic.

Students will need a laptop with 64-bit operating system, at least 4 GB RAM (8 GB preferred), 35 GB free hard drive space, USB and Ethernet ports, administrative access, ability to turn off AV/firewall and VMware Player installed (64-bit version).

Trainers Biography

Dawid Czagan.jpeg

Dawid Czagan has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.

Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing and training services. He also works as Security Architect at Future Processing.

Dawid shares his security bug hunting experience in his hands-on training "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". He delivered security trainings/workshops at Hack In The Box (Amsterdam), CanSecWest (Vancouver), DeepSec (Vienna), Hack In Paris (Paris) and for many private companies. He also spoke at Security Seminar Series (University of Cambridge) and published over 20 security articles (InfoSec Institute).

To find out about the latest in Dawid’s work, you are invited to visit his blog and follow him on Twitter (see below).


300px-twitter-icon.jpg @dawidczagan

Links :

Mon. 5 - 6 October 2015 (09:00 - 17:00)

Register.jpg

Back to Training Overview