“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process
our bank transactions, handle our private data and set us up on romantic dates.
However, few of us care to wonder,”How (in)secure can these apps be?” Well… at
Troopers 19, you can learn how to answer this question yourself!
In our 2 day long “Hacking mobile applications” workshop, we teach how to find
security vulnerabilities in mobile apps, exploit them and defend against them.
We start from scratch, therefore no prior experience in hacking or developing
mobile apps is required. Whether you want to learn how to pentest mobile apps,
you are an app developer that fancies to secure his/her apps, or just curios,
our workshop is a jumpstart to your goal.
Generally speaking, I’m more of a Cat type of guy, but I have to say I really
love BloodHound. And if you do too, you are in for a treat…
Last week, the ERNW InsightActive
Directory Security Summit took place in Heidelberg.
(More Info)
For
this occasion, @Enno_Insinuator asked me
if I would like to deliver a BloodHound Workshop, and of course I accepted
the challenge…
We had a full class, I had a blast training it, and I hope the trainees enjoyed
it as much as I did.
But that’s not all…
Another part of the deal was that I had to write a Training Guide that we
would then share with the Community (aka you).
So here it is, fresh from the Heidelberg press and available for download:
As Kai and I will be holding a
TROOPERS workshop on automation with ansible,
we needed a setup for the attendees to use ansible
against virtual machines we set up with the necessary environment. The idea was,
that every attendee has their own VMs to run ansible against, ideally including
one to run ansible from, as we want to avoid setup or version incompatibilities
if they set up their own ansible environment on their laptop. Also they should
only be able to talk to their own machines, thus avoiding conflicts because of
accidental usage of wrong IPs or host names but also simplify the setup for the
users.
Hi there,
Like in recent years the popular
Hacking 101 workshop
will take place on TROOPERS17, too! The workshop will give attendees an insight
into the hacking techniques required for penetration testing. These
techniques will cover various topics:
information gathering
network scanning
web application hacking
low-level exploitation
…and more!
During this workshop you will learn, step by step, a testing methodology
that is applicable to the majority of scenarios. So imagine you have to
assess the security of a system running on the Internet. How would you
start? First, you need a good understanding about the target, including running
services or related systems. Just scanning an IP will most likely not reveal
a lot of information about the system. The gathered information may help you to
identify communication relations of services that could include vulnerabilities.
A brief understanding of the target and it’s related
systems/services/applications will make scanning and identifying
vulnerabilities a lot easier and more effective. Then, the last step will be
the exploitation of the identified vulnerabilities, with the ultimate aim to
get access to the target system and pivot to other, probably internal,
systems and resources.
This is a guest post by the SAP security experts of BIZEC. Enjoy reading:
On March 20^(th), the first BIZEC workshop will be held
at the amazing Troopers conference in Heidelberg, Germany. For those still
unfamiliar with BIZEC: the business application security initiative is a
non-profit organization focused on security threats affecting ERP systems and
business-critical infrastructures.
The main goals of BIZEC are:
Raise awareness, demonstrating that ERP security must be analyzed
holistically.
Analyze current and future threats affecting these systems.
Serve as a unique central point of knowledge and reference in this subject.
Provide experienced feedback to global organizations, helping them to increase
the security of their business-critical information.
Organize events with the community to share and exchange information.
The
“BIZEC workshop at Troopers 2012”
will dive into the security of SAP platforms. Still to this day, a big part of
the Auditing and Information Security industries believe that Segregation of
Duties (SoD) controls are enough to protect these business-critical systems.
By attending this session, InfoSec professionals and SAP security managers will
be able to stop “flying blind” with regards to the security of their SAP
systems. They will learn why SoD controls are not enough, which current threats
exist that could be exploited by evil hackers, and how to protect their
business-critical information from cyber-attacks.