Paddington Oracle Bear

Immunity does a lot of commercial consulting, and one thing I make sure to do is follow up on essentially every gig. I think it's important to know what we're getting into customers with, and why. This is the major benefit of any services arm - you get a ground truth for how all this stuff applies in the wild.

For example: Does training effect phishing? What do people build web applications with? What vulnerabilities are in .Net applications these days? Is Java on the Server still vulnerable to the same things it used to be, or have new frameworks made it better?

This is different than the sorts of data you get from web application scanners. You can only reach so deeply with a scanner, which means that applications can, over time, appear to be getting MORE secure. But what they MIGHT be doing is getting more secure from the kinds of things scanners can find!

The Paddington Oracle: "I see something over there! IT IS BAD CRYPTOGRAPHY IN YOUR SESSION ID!"

For example: in the past year, we've found more Padding Oracle cryptographic attacks than SQL Injections. This introduces another problem: Development teams are well prepared to understand certain classes of vulnerabilities.  I find SQL Injection and File Include are something you can easily explain, but CSRF and XSS are a lot harder. Imagine the fun we have on a consulting readout when we hand over ten pages of explanation of the cryptographic differences between what they did, and what they should do to defeat a complex attack that while hard to explain, still "got a shell".

Good consulting is more TRAINING than services. If you don't teach them how to do padding oracle attacks, then they'll just re-code the bug into something else. And failing that, you have to at least teach them it is important to get right, and to test it before they ship it. Sometimes that alone is the win of the engagement.

INFILTRATE 2015 Training Redux: Let us info(s)t(r)ain you!

So as is tradition, we've completely overhauled our training curriculum for Infiltrate 2015. Here's a rundown of what the new options are, what they entail, and how they might suit you and your team.

Keep in mind, as always, we only run these courses once a year, and only during INFILTRATE.

Masterclass 

4 days, Apr 20-23, $4,500 USD

Our flagship class is revamped for 2015 with the return of the Linux Kernel exploitation component. This section is taught by one of the authors of "Attacking the core", which set the industry standard for Kernel exploitation books. The class was rewritten to include new exploitation and bypass paradigms and will boost your Linux Kernel exploit skills into the modern era where SMEP is a thing, and NULL dereferences are (sort of, sometimes) VOID.

To prevent burnout and keep peak brain momentum we have made the masterclass 4 days long, as opposed to 5 days. This means you get an extra Friday to roam the beach and meditate on your newly acquired skills and whether to use them for good or evil (or some morally ambiguous combination of both).

For the first 2 days of masterclass you'll be running through the 2015 edition of the Immunity SMT class, which will be even more hands on and exercise oriented this year, to ensure you go home with practical and applicable SMT solving skills.

As with previous editions, the Immunity masterclass is intended for people that are already very comfortable with exploit development and general computer science theory. If you want to push further into the cutting edge of offensive theory and methodology, the Masterclass is for you.

Wide open to Interpretation 

4 days, Apr 20-23, $4,500 USD

New in the 2015 Infiltrate Training line up is the Wide open to Interpretation class. In this class we take two widely used interpreted serverside web application languages, and run through advanced exploitation and vulnerability analysis scenarios for both.

The idea behind the Wide Open class is to get the student thinking in terms of primitives and concepts that may translate into any interpreted language with exposed remote surface. For the first 2 days of the class we take a deep dive tour of PHP based exploitation, and for the second half of class we get into the nooks and crannies of Java based serverside exploitation.

We consider this class to be a great follow up to our Websploitation (AKA Webhacking) class. If you've taken our Webhacking class previously, you may want to consider signing up for the Wide Open class this year.

Click here for ring 0 

4 days, Apr 12-15, $4,500 USD

Another new addition to our training lineup for 2015 is the "click here for ring 0" course. This class is all about hands on exploitation and we consider it the follow up to our infamous (and now retired) "unethical hacking" class. 

In this class you will go through the process of writing a clientside exploit as well as a local privilege escalation attack against a modern Windows system. Thus providing you with the workflow and methodology used by many modern APT-style teams to gain access to your infrastructure.

If you are a penetration tester with a knack for exploit development interested in goal based hacking, then this is the class for you. It gets right to the point, and you'll walk out of it with practical exploit development skills you can start using immediately to build and improve your arsenal of clientside and privilege escalation attacks.

Wait, no Unethical Hacking this year? Serio?

Yep, serio. Even though we know people love the unethical class, and it always sells out, we wanted to rejuvenate our curriculum with a more refreshed and updated look at the modern vulnerability and exploitation landscape. Having said that, if you reeeeeaaaaallllly want to take the unethical class, we might consider flying out to your location to come teach it, provided you have a large enough group of students (20 minimum). If you're interested in setting something like that up, just contact us at admin (at) immunityinc.com or give us a call at +1-786-220-0600 (ask for Dave, Dave loves phonecalls).

WebSploitation

3 days, Apr 13-15, $3,300 USD

Our always popular webhacking class is back leaner and stronger than ever in the 2015 Websploitation curriculum. We've trimmed the fat to ensure you get the absolute most bang for buck in this 3 day hands on web application hacking class.

This class teaches you how to tackle many common web application attacks in a CTF style token grabbing format that builds a fun, friendly, yet competitive environment for the student.

The Websploitation class  is fantastic for both the modern penetration tester as well as the memory corruption dinosaur looking to refresh and update their Web 2.0 hacking ability.

If you've never taken one of our courses, and you want to get down to the hacking part of the puzzle without having to stare at a debugger for days, we highly recommend the Websploitation class as your introduction to the INFILTRATE training lineup.

Sold! I want to sign up! Now what?

Awesome. If you have any questions about group discounts, incentives and pricing feel free to contact us at admin (at) immunityinc.com, or give us a call at +1-786-220-0600.

For a more detailed overview of what is and isn't covered in each course, please visit us at: http://infiltratecon.org/training.html

Infiltrate 2015 - Free Ticket Challenge #1 (Solved)

Infiltrate 2015 is right around the corner! Only three short months until we can all enjoy two days of highly technical offense focused conference goodness in sunny South Beach.

As we get closer to the conference we decided to give away some free tickets to Infiltrate by way of puzzle challenges. And what better first challenge for a Miami Beach based con than a Cuban Number Station?

So we put out the following audio file for people to analyze and decode. Gaston, our winner, was the first to submit a correct solution, and an elegant one at that.



The audio consists of a female voice reading a list of numbers. The numbers represent nibbles of a PNG file. You could solve this by hand with Google translate, but this process is very error prone. If you miss one number you are basically up that one creek without a paddle.

Gaston produced this clever script to extract the bytes from the audio:


If everything adds up correctly you end up with the following image (md5: d4549b09612ade7e8459ddd7c16f95f7):

The final part of the first Infiltrate 2015 Ticket Challenge, was to extract the secret message embedded in this image. We used a very simple LSB steganographic algorithm hiding bits in RGB bytes. This graph from DFI News (http://www.dfinews.com/articles/2009/06/find-incriminating-contraband-images) explains the algo in a nutshell:

Our winner then extracted the bits with the following script:


After extracting the bits you quickly discover that the secret message is:

#BOOM# NORTH KOREA WAS HERE :]

I wonder who could have left that? All indicators currently point at Immunity's Lord of Attribution and Prime Minister of remote sensing, our very own CEO, Dave Aitel.

So that's it for the first Infiltrate 2015 Ticket Challenge, we plan on doing a few more, so stay tuned to your local number stations and congrats to Gaston for his free Infiltrate ticket!

Web Hacking 2014, lessons learned

We've done Immunity's Web Hacking class five times now and each time we learn something different. This blog post is going to incorporate some lessons from both the public Infiltrate 2014 class as well as a private class we did for a client.

Create a minimum and maximum duration for topics -- Web hacking takes place over 3-4 days, with 7 hours per day of instruction. The maximum amount of time we want to spend on any one topic is therefore 7 hours. In my experience 90 minutes is the minimum amount of time it takes to introduce a topic and have students complete a few hands on exercises. As an example, we can introduce XXE and have students exploit a straight forward vulnerability in probably under 90 minutes. But getting the HTTP and FTP out-of-band techniques is a bit more complicated.

What is the minimum time needed for a topic? -- Some things can't really be meaningfully condensed, in our experience if you want to successfully exploit a padding oracle vulnerability under real world constraints we need 7 hours to get you there (assuming you have no prior experience). Likewise we can give a good introduction to XSS and have you practically exploit (i.e. more than just popping alert(1)) a few bugs in about 2 hours.

Topics must be modular -- Prior to the private class we'd basically always covered the same things in our web hacking course. This client wasn't interested in PHP or Open Source Information Gathering (OSIG) so we had to cut those from the course. By keeping each topic isolated we could add and subtract content pretty easily and shuffle the order in which we covered topics. This is to say that no part of XSS should depend on completing the Command Injection topic, intra topic dependencies are ok and unavoidable.

In order to be modular you need a lot of content -- The PHP and OSIG modules combined for around 6-7 hours worth of content, since those weren't being covered we had to dramatically expand the content of each module to make up the difference. We've got around 5-6 hours of XSS content available and now we can fit this topic into any length slot based on customer need.

Testing things at scale -- One of the big 'whoops' moments we had for the Infiltrate version of this class was the scoring server breaking. We'd tested it prior to the class but came to find out during the course that the sqlite3 backing DB was not up to this particular task with the number of students we had. So, Miguel had to convert to PostgreSQL during the lunch break.

Better score reporting -- When we started the class in 2012 we had a dedicated war games type portion of the class after we'd covered all the content. In each subsequent class we've cut down on the war games portion in favor of covering more content but kept the scoring, completing in class exercises awarded tokens of a certain value, the student with the highest score at the end would win something (this year, a plaque!). We're going to spend some development time getting better scoring reporting for the instructors so we can track who hasn't completed a particular exercise a bit easier. We will probably do away with the dedicated war games portion in favor of spending more time on certain topics.

After hours access -- For each iteration of this class we've run into the situation where students want to keep working but the class had ended for the day. Typically we stop teaching at 5:00PM and call a hard stop at 5:30 but many students want to continue working. We've considered hosting copies of the exercises on a private VPN that students can access from their rooms if they wish and we may put some engineering time into that before the next Infiltrate.

ircd and collaboration -- Esteban had the great idea to host an in class ircd that would allow for greater collaboration if students wanted it. Some people might say "create a Sharepoint site" or "start a wiki", communicating effectively over IRC is a skill your attackers have so you should learn it too.

Fit and finish matter -- Aesthetically this class is almost 100% powered by Bootstrap. Use design to make accessing information easier and more pleasing. This goes a long way towards streamlining the class. Especially when students don't have to ask you if an exercise is broken because all you have is a single input field and an unhelpful HTML title.

Be more than vulnerable -- Students tend to be more engaged when interacting with applications that serve some purpose outside of just being vulnerable. One of our XSS exercises allows students to make web comics, another is a front end for a network ACL complete with listening service you need to connect to. Sometimes when you have to teach a very specific concept, zeroing in on that functionality is unavoidable. But we try to make the page easy to hold a student's interest and that comes by adding a bit of functionality.

"The Brain Stealer", Heartbleeding partial keys, etc.

One thing about bugs like Heartbleed is that they give you random memory contents. And sometimes these memory contents include an entire private key, and sometimes they do not. What can you do with a partial RSA key? Well, often you can solve using an SMT solver for the rest of the key! How cool is that? 

I mention this because it is something I did not know until yesterday, when Ronald walked me through part of the Immunity Master Class, which is being taught at INFILTRATE here in Miami next month (May 19th-23rd). And it's one thing to know that this is possible, but it's a whole different thing to have code to actually do it. 

That's why I love the Master Class, because no matter how good you are there is still a lot to learn in our industry even at the most technical level, and it's often stuff you can put directly into your high level research efforts. 

I personally grew up on Unix hacking. There are dark corners of the Solaris operating system that I'll never forget, like my first girlfriend's foibles. But I didn't realize how poorly I really knew Unix until I saw how Ronald puts the entire Kernel and Userspace together in his head when writing an exploit. So I often sit in on the Master Class to learn Unix hacking from one of the few people who I know is empirically better at it.

And of course, when it comes to SMT solvers, the whole world is still learning where they can and cannot go. As part of that, Immunity did a DARPA project to work on something called ILLITHID, which finds vulnerabilities by doing symbolic execution.

And as of today, we're announcing that because we're going to be extensively using ILLITHID (click here to see it in action) in class, students will be eligible to receive a free student license (i.e. non-commercial) for ILLITHID to take home with them. This is currently the only way you can get ILLITHID, and frankly is worth the price of admission alone!

If you're interested, send an email to admin@immunityinc.com and sign up or ask us for more information! (A detailed description of the class and INFILTRATE itself is here.)

"Unethical Hacking" Training available at INFILTRATE 2014!

One thing about the Unethical Hacking training happening at INFILTRATE 2014 is the advantage technology investments have improved the way people learn buffer overflows. This class is pretty unique in that we've run hundreds of people through it who have only basic programming skills, and at the end of it they are doing assembly language, writing intermediate level Windows buffer overflows, and have an accurate picture of how the process of taking a vulnerability to an exploit works. 

Part of the secret is VisualSploit, and the 2.0 version is an amazing improvement. As you can see below, it runs within your browser, and you drag and drop the components into it to reflect your understanding of how the program stack is behaving. You're writing exploits, but naturally, without coding at all.

A simple example exploit from class - VisualSploit, Immunity Debugger and your brain are all the tools you need!

Some of the blocks wrap quite complex functionality and calculations such as a jump from one block to another one. This makes learning the whole process thousands of times easier for students who are not already assembly language experts by avoiding hard to find typos.

A much more complex version of VisualSploit - coming up with the building blocks of an exploit can take four hours, but it's an intensely educational four hours!

So in summary, by taking the requirement that you know how to code Python or some other language out of the class, it more effectively and reliably teaches people how to write exploits. You come in knowing just a little bit about programming, and you walk out a completely changed person. I've seen it hundreds of times which is why it's my favorite Immunity class to teach. It's less frustrating, and more fun, simply because we invested in the tools to make the learning process better.

So sign up or call us for more information!
infiltrate@immunityinc.com
(p) +1-786-220-0600

Web Hacking Language Review

In a lot of respects the rewards for web exploits are more immediately accessible than complex memory corruption exploits. Part of the reason is that web applications are designed to be more accessible than the musty insides of a kernel. The amount of knowledge you need to be efficient at web hacking and to really understand it can be daunting, especially if you don't come from a programming or systems engineering type background. We've observed a bit of a disparity in the skill sets of our students for Web Hacking, some come from a web application development background and the basics of the HTTP protocol are well known to them. Other students may not have a firm grasp on that subject matter so we're addressing that with the Web Hacking Language Review.The language review is a one day intensive designed to give you the basic fluency needed to be productive in the Web Hacking class itself.

The very first thing we do is a practical look at the HTTP protocol. You'll be interacting with simple web applications and viewing your traffic through various proxies and Wireshark to get a feeling for what's actually happening, we'll talk about useful information contained in the HTTP response headers and so forth.

Our next stop is Linux command line fundamentals. Many people are daunted by the power of the Linux CLI and try to stick with more GUI centered tools and operating systems. It's true that the Linux CLI is extremely powerful and therefore complex but understanding basic usage, file system layout and how to ask the OS for help will provide you with the confidence you need to start using Linux as your primary OS for penetration testing.

Python is the in house programming language at Immunity, all of our products rely on it and we write it every day. A key part of our educational philosophy is that you need to be able to implement an attack to really understand it. That means being able to write it up and for us (and you) that means Python. We'll be spending time giving you hands on experience setting up PIP the Python package manager and writing simple but effective scripts in Python.

JavaScript is everywhere and thanks to projects like Node.js is now doing everything. Having a firm understanding of JavaScript is essential for assessing Web 2.0 applications, Node.js applications and making your XSS do more than just shout alert('XSS!!!'); We'll be covering some of the language fundamentals and giving you some directed experience in writing JavaScript.

MySQL you can't really understand SQL Injection unless you understand SQL and MySQL is one of the most popular relational databases in use today. Virtually any PHP application will have a MySQL option for data store purposes and many applications depend on some type of SQL database (Microsoft SQL, PostgreSQL, Oracle, etc). During this class period we will provide you with a SQL database and help you extract data from it to understand what types of SQL queries you'll likely come into contact with in the wild.

This class review gives you the background you need to get the most out of our Web Hacking course. If you're not confident in any one of the above sections I would encourage you to come to the course and take the refresher because during the proper Web Hacking course we won't be covering these fundamentals.

For more information contact sales@immunityinc.com and get a quote for the language review!