Introduction To Software Exploits
Creator: Corey K.
License: Creative Commons: Attribution, Share-Alike
(http://creativecommons.org/licenses/by-sa/3.0/)
Lab Requirements: Linux VM provided below. Or any Linux VM with the provided vulnerable software examples installed.
Class Textbook: The Shellcoder’s Handbook by Chris Anley et al.
Recommended Class Duration: 2 days
Creator Available to Teach In-Person Classes: Yes
Author Comments:
Software vulnerabilities are flaws in program logic that can be leveraged by an attacker to execute arbitrary code on a target system. This class will cover both the identification of software vulnerabilities and the techniques attackers use to exploit them. In addition, current techniques that attempt to remediate the threat of software vulnerability exploitation will be discussed.
This will be a lab driven class where specific software vulnerability types in particular environments are discussed and then exploited in a lab setting. Examples of lab components of the class as well as specific topics covered include:
•Shellcode development
•Stack overflow exploitation
•Heap overflow exploitation
•Static source code analysis
•Defeating non-executable stack protection
The class will help students be more aware of the specific details and mechanisms of software exploits we see in the wild. This knowledge will enable the students to better analyze their own software for vulnerabilities in an effort to produce more secure code.
Slackware VM with vulnerable software on it (zip password = “Exploits1”)
Youtube video playlist: http://bit.ly/Jg5O2k
Revision History:
05-16-2012 - Day 1 videos released
06-07-2011 - Initial class content upload
If you have used and modified this material, we would appreciate it if you submit your modified version for publishing here, so that all versions can benefit from your changes.
