This information is from a previous year. Please visit shellcon.io for up to date information.
Our workshops have reached capacity, but free training is still available!
Please visit ShellCon University to sign up!
Summary: This training will cover the basics of RFID, provide hands on labs using Proxmark3 devices, and provide a fun environment for attendees to learn
about different RFID communication protocol attacks. Upon completion of the training, students will:
-Understand the technologies involved in RFID
-Be able to perform clones of prox RFID
-Be able to reverse engineer unknown prox formats
-Be able to clone vulnerable ISO/IEC 14443 RFID
-Be familiar with the use of the proxmark tool/hardware
Summary: Microsoft systems are in use by most companies around the world. As technology professionals especially, Windows is almost unavoidable. In recent generations, PowerShell has become deeply tied to the Windows operating system and its management. The aim of this workshop is to make you competent in PowerShell quickly. Our approach is simple: We’ll walk through some programming concepts and language particulars. If you’re the curious type, you’ll dig deeper into each area on your own or help us guide the class conversation. If not, you should still be able to stumble though most of the content with us. By the end of the workshop, you should have a working knowledge of PowerShell, the ability to comprehend others' code, as well as the fundamental skills to build your own tools.
Summary: An introduction to process hollowing works, how it is used by malware, and why. The main exercise will focus on teaching you how to spot process hollowing, as well as some dynamic analysis techniques to unpack malware using this knowledge.
Summary:
- Quick intro to threat modeling - when given a new application, where should you focus your time?
- Outside in vs inside out testing - tips on what's useful to test dynamically and confirm via source review vs locating an issue through source review and PoC-ing via dynamic testing
- Looking for common issues via source review - present some issues whose origin cannot be expressed with grep (e.g. a controller method not calling an authz method, ordering of methods being called, missing annotations, etc.)
- These issues motivate the usefulness of being able to search code in a way that has some syntactic understanding of the underlying language (i.e. not just string searching)
- Overview of static and dynamic analysis - strengths and limitations
- Static analysis - the big picture, taint analysis-type problems: sources, sinks, and transfer and cleanse functions
- Static analysis fundamentals - lexing, parsing, building Abstract Syntax Trees (ASTs), ...
- Challenges when performing static analysis - supporting many languages, dynamic typing, eval/reflection constructs, container types, precision vs. memory and speed trade-offs
- A brief tour of other types of program analysis - fuzzing, symbolic execution, model checking, etc. - basically, what are all the ways you can build tools to find bugs?
- Hands-on exercise of doing some lightweight static analysis