Wednesday November 10th, 2021.

Where

Online

Registration

Registration here

Fee

Registration is free

Training Topics

1. Fuzzing 101 by Diane Dubois
2. Hands-on introduction to web vulnerability research by Lena David
3. Crash Course in x86 Reverse Engineering by Michelle Bergeron

Fuzzing 101 by Diane Dubois

When

• CET 9:00 - 12:00
• PT 00:00 am - 03:00 am
• ET 3:00 am - 06:00 am
• IST 1:30 am - 4:30 am

What are the key takeaways?

• General knowledge on fuzzing
  • Know the basic concepts to get started and be able to later understand the material on fuzzing (conferences, papers…)
  • Targets: C code, C++ code, x86
• Methodology to approach vulnerability research through fuzzing
  • Be able to reason later about fuzzing with different setups (sources, closed-source, …)
• Hands-on experience on vulnerable binary / C code
  • Demystifying fuzzing and getting comfortable fuzzing / writing a fuzzer with hands-on labs
  • Target: C code / binary

Software prerequisites

• A Debian / Ubuntu host or VM
• Download and build AFL: AFL
• Install clang (version 6.0 or greater). Instructions: llvm
• Have a code editor you feel comfortable using

Prerequisites

• Some prior knowledge of C or C++ will be useful for the second hands-on lab
• Prior experience on reverse engineering will also be a plus (it is not a prerequisite) to help understand the parts on black-box fuzzing (fuzzing closed-source binaries) but there will be no hands on on that

Bio

Diane Dubois, @0xdidu

After starting her career as a developer in the PowerShell team at Microsoft, Diane transferred to the security field, first as a developer and then as a reverse engineer. She currently works as a Security Engineer at Google Zurich. Her focus areas are operating systems, virtualization, and firmware analyzed on a day to day basis through security reviews and vulnerability research.

Hands-on introduction to web vulnerability research by Lena David

When

• CET 14:00 - 17:00
• PT 5:00 am - 8:00 am
• ET 8:00 am - 11:00 am
• IST 6:30 pm - 9:30 pm

What is it about?

The security level of web applications is often assessed through penetration tests (or pentest for short), which consist in adopting a stance close to that of an attacker or hostile user to try to find security flaws. This workshop aims to provide the participants with basic knowledge on how to approach that process. After a quick introduction to a possible test methodology and commonly used tools, we will use the latter to work on several frequently encountered vulnerability classes in a series of practical exercises based on real-life examples.

Key takeaways

• Some methodology for web vulnerability research, tried and tested against multiple real-life examples
• Basic knowledge regarding how to use BurpSuite and other common tools

Software prerequisites

• Nothing more specific than a computer able to run VirtualBox
• A virtual machine containing the necessary tools will be provided a few days before the workshop

Prerequisites

This workshop is intended to be beginner-friendly, and there is no prior knowledge required. However, little theoretical knowledge about common web vulnerability classes may help benefit from it to a grater extent.

Bio

Lena David is a security researcher at Synacktiv, where she mostly carries out penetration testing and red team engagements.

Crash Course in x86 Reverse Engineering by Michelle Bergeron

When

• CET 18:00 - 21:00
• PT 9:00 am - 12:00 pm
• ET 12:00 pm - 15:00 pm
• IST 10:30 pm - 1:30 am

What is it?

In this introductory-level course, you’ll learn the basics of reverse engineering Windows x86 binaries. You’ll get a taste for reading x86, using a disassembler and debugger, and thinking like a reverse engineer. You’ll leave with resources to continue your learning journey as part of the Blackhoodie community.

Why learn reverse engineering?

Reverse engineering skills have a broad set of applications in cybersecurity, software/hardware, and life. Maybe you want to become a malware researcher, grow as a (non-reverse) engineer, improve your analytical skills, explore different career paths, or just try something new: reverse engineering is for you.

What will we do?

We will ramp up on reading x86, learning to use the tools, and spend the rest of the time solving practical exercises and reverse engineering challenges.

Prerequisites

Half a day is a very short amount of time together - please arrive with your training software (listed below) set up ahead of time. Please open each piece of software at least once before the class to make sure it works. Be ready to work hard, ask questions, and have fun!

Knowledge prerequisites

• Extremely helpful if you are comfortable with the C or C++ programming language (we’ll be reverse engineering programs written in C).
• Understand what a computer processor is and have a basic grasp on what they do Resource: See How a CPU Works
• Understand what the words “assembly language” mean (even if you aren’t familiar with using it). Resource: Assembly language - Wikipedia
• Have a basic understanding of what a call stack is and how it works. Resource: Call stack - Wikipedia

Software prerequisites

On a Windows machine or VM with internet connectivity

• Install IDA Free IDA Free – Hex Rays (hex-rays.com)
• Install OllyDBG OllyDbg v1.10
• Install CFF explorer Explorer Suite – NTCore

Tips

If you’re using a VM, ensure you’re able to copy/paste from the host.

Since we’ll be doing the workshop via videoconferencing, it’s highly preferable to have adequate screen real estate to simultaneously look at the presenter as well as your work environment.

Two screens recommended.

Bio

Michelle Bergeron is a Senior Security Software Engineer at Microsoft; specifically, she’s a penetration tester for Microsoft Office. She first learned to reverse engineer binaries at a Blackhoodie workshop in 2018, fell in love with it, and has been paying it forward by teaching women those skills at Blackhoodie workshops ever since.

What is BlackHoodie?

BlackHoodie is a series of free, women-only reverse engineering bootcamps, which started in 2015 and in 2018 slowly became a global initiative, with events happening in different locations in Europe and the United States. More information on the idea of BlackHoodie and upcoming events can be found at blackhoodie.re

Contact

Email: mailto:blackhoodie.grehack@gmail.com