Ethical Hacking Exploit Development
Detailed study of the process of creating and developing (userland) exploits for applications and binaries on the Windows Operating System, with a focus on the x86 architecture.
About the Course
The Ethical Hacking Exploit Development (EHXD) course provides a detailed study of the process of creating and developing (userland) exploits for applications on the Windows Operating System, focusing on the x86 architecture. Ideal for information security professionals who seek new challenges and want to better understand how attacks work, how flaws are found in programs and systems, how exploits are built to exploit these vulnerabilities, and how an attacker manages to circumvent certain protections.
The training is 100% practical (hands-on) and real applications on modern operating systems will be explored through a series of exercises and labs. The student will encounter scenarios ranging from the simplest to the most complex that will develop skills not only on the offensive side (Pentesting, Red Team) but also on the defensive side (SOC, CSIRT, Blue Team). With the constant evolution of cyber threats, it is of fundamental importance to know and stay up to date on the main attacks and how they work in order to protect your organization.
In EHXD, challenging topics will be covered, starting with classic buffer overflow, moving through the fuzzing process to find failure points (bugs) in binaries, creating exploits that take advantage of Windows Structured Exception Handling (SEH overwrite), binary analysis and manual injection of malicious code into legitimate applications (backdooring), the process of creating 0-Day exploits (procedures and methodology), exploits using Egghunter, creation of exploits in constrained environments, manual creation and encoding of shellcode, an introduction to the Return Oriented Programming (ROP) technique to bypass Data Execution Prevention (DEP), among others.
For those interested in understanding the nature of exploits in depth and who want to take a step forward beyond simply using automated tools, this is the perfect training, delivered by qualified professionals, with tailored instruction and high-quality material, where each topic is described in rich detail, allowing the student to reproduce the activities easily and intuitively.
Course Content
- 1.Review of stack-based buffer overflow exploitation for x86 applications
- 2.Exploitation of Windows Structured Exception Handling (SEH overwrite)
- 3.Backdooring legitimate Windows applications
- 4.Manual encryption of malicious code
- 5.Creating exploits using the Egghunter technique
- 6.Applying Egghunter on 64-bit operating systems
- 7.0-Day exploit creation methodology
- 8.Exploit development in constrained environments, with manual shellcode creation and encoding
- 9.Review of Windows protections against exploits
- 10.Return Oriented Programming (ROP)
- 11.Using ROP to bypass DEP