Effective Fuzzing: Using the Peach Fuzzing Platform
Michael Eddington, Deja Vu Security
Adam Cecchetti, Deja Vu Security
|
USA 2011 Weekend Training Session //July 30-31
USA 2011 Weekday Training Session //August 1-2
Overview
The entirety of the course is student centric, hands on, and lab intensive. On day one, students will be instructed on the use of the Peach Fuzzing Platform, from a practitioner's perspective, learning the ways in which Peach can be used to fuzz a variety of targets including network protocol parsers, ActiveX/COM interfaces, file parsers, APIs, and web services. Students will also be introduced to new methods by which fuzzing can be utilized to locate security flaws not typically considered detectable by fuzzing, including N-tier applications.
On the second day, students will be exposed to the internals of Peach for a developer's perspective. The Peach architecture and module interfaces will be explained in great detail as to equip students with the skills necessary to extend and adapt Peach to their custom needs. Students will then develop their own Peach extensions in a lab environment to reinforce these concepts.
Upon completion of this course, students will be enabled to create effective fuzzers that target:
- State-aware network protocol parsers
- N-tier applications
- Arbitrary APIs
- File parsers
- COM and Active/X components
- Detect non-classic faults in software
- Extend the Peach Fuzzing Platform by creating custom Transformers, Generators, Publishers, and Monitors.
- Apply these concepts and tools to their unique environment
- Utilize parallel fuzzing to increase fuzzing efficiency
What to bring:
Ability to read/write basic XML Proficient in Python a bonus
Laptop capable of running 2 vmware images at once, minimum 20 GB free disk, 1GB RAM (2GB RAM recommended), DVD reader, Ethernet jack VMWare Player (free)
Trainers:
Michael Eddington is a Principal Security Consultant with Leviathan. Mike has over ten years experience in computer security, with expertise in application security, network security, and threat modeling. Mike's recent security testing and analysis work includes design review, penetration testing, and code review of pre-release operating system features and protocols; penetration testing and code review of a prominent ecommerce purchasing application; and penetration testing of a cross-browser, cross-platform plug-in for delivering next-generation media experiences and rich interactive applications for the Web. Prior to joining Leviathan Security Group, Michael started, ran, and grew the security services practice for one of the Pacific Northwest's most well-known security consultancies. Michael also co-founded the Security Services Center for Hewlett-Packard's services division, developing many of their security methodologies in addition to developing and delivering security training courses. Michael is also an accomplished software developer, having participated in a number of open-source security development projects ranging from threat modeling (e.g. the Trike threat modeling conceptual framework) to fuzzing (e.g. The Peach Fuzzing Platform.)
Adam Cecchetti is an independent consultant and security researcher at Deja Vu Security. Adam specializes in application and hardware penetration testing. He has over 10 years of professional penetration testing experience and is a contributing author to multiple security books, benchmarks, tools, and research projects. Adam holds a masters degree from Carnegie Mellon University in Electrical and Computer Engineering.
|
Early: Ends April 30 |
Regular: Ends Jun 15 |
Late: Ends Jul 29 |
Onsite: |
|
$2400 |
$2600 |
$2800 |
$3100 |