Black Hat USA 2008 Training

Caesars Palace Las Vegas • August 2-3 & August 4-5

Web Application (In)security

Marcus Pinto & Dafydd Stuttard

Overview:
NGS works at the cutting edge of web application security, performing penetration tests on some of the most high-profile sites on the internet, as well as writing many of the tools which are commonly used in application testing. In this course we cover all areas of web application security from Cross-Site Scripting, SQL Injection, LDAP Injection, Java Applet disassembly, Command Injection, Shared Hosting security bypasses, IDS Evasion and vulnerabilities in off-the-shelf products. Delegates will get the opportunity to try their had at all of these and much more in the practical exercises.

With much of Web Application security now common knowledge, NGS has pushed this subject to its new limits, sharing the techniques which make the difference between a methodology and a deep hack. Having written the two groundbreaking papers on SQL Injection, we share more, newer SQL hacks to beat the web applications currently out there. Powerful new demonstrations of real Cross Site Scripting exploitation will be provided. Client-side disassembly and ActiveX fuzzing will be explored. NGS will provide a toolset for delegates for all of the demonstrations, and move on from the labs to a final web application where delegates get the opportunity for some real hacking and fun in a “capture the flag” contest.

This course has a heavy lab content, so familiarity with common web application tools and vulnerabilities is required for full appreciation of the course.

Course Length: Two days. All course materials, lunch and two coffee breaks will be provided. A Certificate of Completion will be offered. You must provide your own laptop.

Trainer:

Marcus Pinto

(UK CHECK Team Leader), Principal Consultant, NGSSoftware

Marcus has over 5 years’ experience in providing technical, hands-on consultancy to a diverse range of high-profile clients such as the British Ministry of Defence, High Street Banks, Financial Institutions, Telecommunications and the British National Critical Infrastructure.

In his current employment he is heavily involved with NGS’ financial sector clients. This involvement requires a strong focus on web application vulnerabilities from architectural and penetration testing approaches. This also demands an understanding of the specific vulnerabilities arising from complex, large-scale J2EE and .Net deployments to which many assessment teams are not exposed.

Marcus has experience in web application development, and has spoken at many conferences, as well as providing the original delivery and co-production of NGS’ Black Hat Database Assessment course.

Before joining NGS, Marcus worked as an advisor to a Vulnerability Assessment Team in the British MoD, originally starting off in the industry as an MSc Physics graduate from the University of Cambridge.

Dafydd Stuttard

Dafydd is a Principal Security Consultant at Next Generation Security Software. He has extensive experience in penetration testing of technical infrastructure and applications.

Dafydd specialises in the security testing of custom-built applications. He has knowledge of most popular development technologies, and has authored a wide range of tools to assist in the testing process. He has broad experience in the secure design, coding and testing of web-enabled applications, and has led penetration tests of many high-profile web applications deployed by online banks and retailers. Dafydd is also highly skilled in the testing of compiled software to identify security vulnerabilities, and has carried out black- and white-box testing on behalf of several of the world's largest software vendors to help secure their products prior to release.

Dafydd is a CESG-certified CHECK Team Leader, and has worked with numerous companies and Government bodies to help secure their critical systems.

Dafydd and Marcus have authored "The Web Application Hackers Handbook: Discovering and Exploiting Security Flaws" which will be published in October 2007.

Register Now

Early: Ends May 1	Regular: Ends July 1	Late: Ends July 31	Late/Onsite: Begins August 1
$2000 USD	$2200 USD	$2400 USD	$2700 USD