We are pleased to announce that the researchers of Exodus Intelligence will be providing publicly available training in person on March 28 2023 in Austin, TX.
The intermediate course, titled the Vulnerability Assessment Class, covers a wide range of vulnerability and exploitation related topics and is intended for the beginner to intermediate level practitioner. This course is intended to prepare the student to fully defend the modern enterprise by being aware and equipped to assess the impact of vulnerabilities across the breadth of the application space.
Attendees should plan to travel and arrive prior to Tuesday, March 28th. The course work will conclude on Friday, March 31st, 2023.
Seating is limited. Since this training will be in person, there are a limited number of seats available.
Vulnerability Assessment Class
This 4 day course is designed to provide students with a comprehensive and progressive approach to understanding vulnerability and exploitation topics on both the Linux and Windows platforms. Attendees will be immersed in hands-on exercises that impart valuable skills including a deep dive into the various types of vulnerabilities exploited today, static and dynamic reverse engineering, vulnerability discovery, and exploitation of widely deployed server and client-side applications. This class will cover a lot of material and move very quickly.
- Computer with ability to run a virtual machines (recommended 16GB+ memory)
- Some familiarity with debuggers, Python, C/C++, x86 ASM. IDA Pro or Ghidra experience a plus.
- No prior vulnerability discovery experience is necessary
Pricing and Registration
The cost for the 4-day course is $4000 USD per student. You may register and pay below, or you can e-mail email@example.com to register and we will supply a purchase order.
Vulnerability and risk assessment
- NDay risk and patching timelines
- Vulnerability terminology: CVE, CVSS, CWE, Mitre Attack, Impact, Category
- Risk assessment
- Vulnerability mitigation
- Basics of HTTP
- Format of HTTP request and response, URI
- Command Injection and Directory Traversal attacks
- Cross-site scripting and cross-site request forgery
- XML External Entity attacks
- Request Smuggling
- SQL Injection
Modules include examples of affected CVEs and practicals.
- Basics of binaries
- Platformns: Linux and Windows
- x86 assembly, PE, and ELF formats
- Stack, Heap, Dynamic modules
- PIE, ASLR, DEP
- Ghidra, WinDBG, and gdb
- Stack buffer overflow
- OS/Theme: Linux
- Return to shellcode, Return to libc, Stack pivot, etc.
- Linux-based practical and demo
- Use after free
- OS/Theme: Windows
- Overview of NT Heap, LFH
- Practical and demo