Ethical Hacking Code Review and Exploitation

In a landscape where unknown vulnerabilities continue to threaten critical systems, the Ethical Hacking Code Review and Exploitation (EHCRX) course offers an immersion into offensive and defensive source code analysis techniques, revealing how hidden vulnerabilities in the stages of software development can be exploited to bypass business logic and cause significant impacts.

The training covers ways to identify security flaws in source code using techniques such as source-to-sink and sink-to-source analyses, which can be used to inspect code packages, as well as to create rules to detect vulnerabilities at scale, creating Proofs of Concept (PoC) to exploit them. Beyond analyzing common vulnerabilities, you will learn in practice the concept of strategically combining seemingly isolated flaws to maximize the impact of an attack, a procedure known as a vulnerability chain.

Many resources are spent on SAST/DAST solutions and, even so, several vulnerabilities are found daily. Do not wait until a gap in the code compromises your application. Protect your projects and your reputation by learning how to detect and fix flaws that traditional tools cannot identify. The aim of this course is to teach how to find and carry out these attacks, so that the basic detection of these tools is complemented with real attacker behaviors, resulting in functional exploits.

How can companies protect themselves against these attacks? How can you prevent a programming mistake from being exploited to exfiltrate all the data from your applications? Or how to create techniques where developers do not need to worry about security and can simply code using predefined code? During the course, students will learn protection techniques for all the attacks demonstrated, developing a vulnerable application at first and then fixing all the flaws. Several Secure by Design techniques will be presented, such as Domain-Driven Design, providing an understanding of how to release applications that are secure by default.

At the end of the course, students will be able to apply all the knowledge acquired to perform real vulnerability analyses, studying and using recent CVEs, and have the possibility to find new flaws and execute other attack paths.

A variety of topics will be covered: White-box Pentest fundamentals, filter evasion, bypassing authentication and authorization mechanisms, vulnerability research in source code, proofs of concept, flaw reporting, root cause analysis, secure development, secure by design, among others.