Overview

The second section of the course will close out our study of basic enumeration by looking at the Windows platform and networking concepts that fit within the basic enumeration methodology. This will include using tools such as Microsoft Attack Surface Analyzer (ASA), Microsoft Sysinternal Suite, ProcDOT and more. This will allow for an in-depth conversation around the important role threat modeling plays in product security assessments and is a crucial first step to reducing the impact of supply chain attacks. Doing threat modeling and answering questions related to product security testing requires sifting through a large amount of data. In this section, we will introduce Exploratory Data Analysis (EDA), a common workflow to conduct analysis used to try to make sense of the data and present the results. Through lectures, demos, and hands-on exercises we will learn how to explore this data using data science tools like Python, Jupyter Notebooks, Pandas DataFrame, and graphical libraries like Matplotlib, among others. Lastly, this section will start to segue into the course’s deeper technical concepts by introducing deep enumeration.

Exercises

• Basic enumeration on Windows
• Initial network traffic profiling with Pandas DataFrame & Jupyter Notebooks
• Investigating network traffic on Android
• Threat modeling products

Topics

Basic enumeration on Windows

• Continuing to build on concepts from the previous section on basic enumeration, this section will look at how to apply basic enumeration to the Windows platform, arguable the most used platform in enterprise make it a critical component to understand. We will cover important concepts related to product security testing, walk through relevant Windows fundamentals, and provide useful tools for performing basic enumeration on Windows.

Basic networking analysis

• This module will introduce network analysis at a basic level as it pertains to basic enumeration. Besides exploring important fundamental networking concepts, this module will leverage some basic data analysis and traffic profiling with Jupyter Notebooks and Pandas DataFrame to help demonstrate how to turn complex analysis into a more simplistic and visual task.

Threat modeling

• Threat modeling is a crucial concept in successful product security testing but even more important is when to perform threat modeling. This module will discuss different types of threat modeling, demonstrate one suggested approach within product security testing, and cover the information required to build a useful model. This module will conclude with a review of how our process up to this point has impacted the way we defend against supply chain attacks.

Deep enumeration

• Section 2 will just begin to explore the concept of deep enumeration. We will introduce deep enumeration, explore how a threat model influences deep enumeration, and discuss when to deploy these techniques. This module will begin increasing the technical depth of the course and push students’ knowledge of finer topics and conclude with a section on networking concepts related to deep enumeration.

Module3:  Binary Code Analysis and Deep Network Analysis

Overview

This section is all about deep enumeration, the process of deeper technical analysis to answer critical questions from a threat model. We will focus on two deep enumeration skills: binary code analysis and network analysis of unknown protocols. In the first half of section 3, we will learn how to use decompiler tools to access the underlying code of an application and unpack archives when needed. This will culminate in a hands-on lab using JetBrain’s dotPeek to answer critical questions related to supply chain attacks regarding how an application is being updated. Network traffic is often a key input to a system and a common entry point for attackers. To dive deeper into network analysis, this section will also take a pause to provide a primer into Scapy, a Python framework designed to manipulate networking packets. Armed with the knowledge and skills covered in this section, you will be better prepared to dissect proprietary or unknown protocols later in the course.

Exercises

• Using APKLab and HTTP Toolkit to defeat cert pinning
• Learning from decompiled source code
• Using Scapy to create a 3-way handshake
• Searching for networking artifacts within payloads
• Bonus: Learning from decompiled source code on Android

Topics

Intro to Deep Network Analysis

• This module will build on the principles discussed during basic network analysis but dive deeper starting with encryption. While encryption is a great tool for security, we will discuss how to verify if it’s implemented in a way that makes it more difficult for an attacker to access your information. This module will include a lab providing the student with hands-on experience bypass encryption used on a popular Android application.

Binary code analysis

• The ground truth to how a target or system works is its source code. Unless the application or device you are auditing is open source, you will not have access to this code. Binary code analysis is the concept of performing a code review without having access to the source code. This module walks through some basic skills to apply binary code analysis during product security testing as one of the two core concepts covered in this course within deep enumeration.

Scapy primer

• In order to dive deeper into network analysis, it is beneficial to be able to programmatically analysis and create networking packets. Scapy is a python module that helps take our analysis and testing to the next level. This module of section 3 will teach the basics of Scapy needed for product security testing.

Understanding proprietary protocols

• We will leverage the knowledge of Scapy acquired in the previous module and apply it to the deep enumeration concept of understanding unknown or proprietary protocols. This last module of section 3 will be an introduction to proprietary protocols that will be continued in section 4.

Module4: Deep Network Analysis and Risk Analysis

Overview

This section will conclude our exploration of deep enumeration and work toward finalizing a product security test project. We begin with a continuation and finalization of dissecting proprietary protocols using Scapy to create custom layers and explain the basics of networking fuzzing. This will bring us to our final risk analysis section where we will focus on creating attack trees and applying risk scoring methods to assess the risk of supply chain attacks, among other risks to the Think Red, Act Blue organization. The section will conclude with important final topics that will allow us to wrap up our product security assessment, such as reporting and vulnerability disclosure.