Workshop: Hack Yourself First: How to go on the Cyber-Offence - Day 1/2

Day 1/2


Cyber-attacks have become a reality of running software on the web today. We find ourselves under a constant barrage of malicious activity from hacktivists, online criminals and increasingly, nation states. Successful attacks from these adversaries are predominantly via flaws in the software products they target – flaws that could have been prevented by developers understanding how online attackers work and what the appropriate defensive measures are.

Hack Yourself First” is all about building up defensive skills in developers. It looks at security from the attacker’s perspective and takes them through the steps necessary to exploit vulnerable software on the web so that they can experience hacking first hand. Workshop participants are set specific goals they must complete that involve probing for risks and then exploiting discrete vulnerabilities in a specially built vulnerable application. The interactive nature of the workshop means that multiple attack vectors are usually identified across the spectrum of participants and each person contributes their own unique perspective as to how specific risks are exploited.


Objectives

The objective of the workshop is that each person walks away with demonstrated experience across a broad spectrum of specific risks. They not only learn about but also demonstrate practical experience across a range of different vulnerabilities targeted to the specific needs of the group.

Topics include:

1. SQL injection

2. Cross site scripting

3. Cross site request forgery

4. Clickjacking

5. Session hijacking

6. Account enumeration

7. Transport layer security

8. API security

9. Mobile services integration

10. Brute force attacks

11. Passwords cracking

12. Parameter tampering

13. Attack automation

14. Dynamic analysis

Intended audience

  • Software Developers
  • System Administrators
  • Testers

This workshop is aimed at any software developer, system admin or tester who wants to get a better understanding what is going on in cyber space if it comes to hacking and cracking of systems. This workshop enables you to take a pro-active approach and you learn how hackers will try to break your system. This workshop will be an eye opener for most attendees and it is the starting point of becoming a better developer. It all starts with awareness and improving your own habits. So start hacking yourself first, to become a better developer!

Required equipment

Attendees will need to bring a computer with one of following software options installed:

Fiddler: http://www.telerik.com/download/fiddler
Charles Proxy: http://www.charlesproxy.com/download/
Burp Suite: https://portswigger.net/burp/communitydownload

If possible please also bring your smartphone.

About the instructors

Scott Helme is a hacker, researcher and builder of things. Scott founded securityheaders.com and report-uri.com. He's a Pluralsight author, BBC hacker in residence and award winning entrepreneur. Find him at scotthelme.co.uk.

Troy Hunt is a Microsoft Regional Director and MVP, Pluralsight author and world-renowned internet security specialist. He spends his time teaching developers how to break into their own systems before helping to piece them back together to be secure against today’s online threats. He’s also the creator of “Have I been pwned?”, the free online service for breach monitoring and notifications. Troy regularly blogs at troyhunt.com from his home in Australia.