This 2-day training is a shorter version of the 4-day (In)Secure C++ training. To make that possible this training focuses specifically on finding vulnerabilities and how they can be exploited.

For private trainings, online or on-site, please get in touch for an offer.

Understanding Exploitation and Finding Vulnerabilities

Gain essential knowledge, and hands-on experience, in effective vulnerability detection tools and techniques, and how these vulnerabilities are wielded in exploitation of C++ and C applications. By deepening your understanding of exploitation, the motivations driving mitigations, and the identification of high-risk constructs, you will be able to design software that better meets your security needs.

This training is explicitly targeted at C++ developers, though C developers will also benefit.

Practical information

The training can be done both remotely and on-site.

• Audio/Video - Google Meet + Breakout Rooms (for online trainings)
• Chat - Slack: Will be set up a week in advance to facilitate the resolution of any technical issues, and is used during the training to pace exercises and facilitate discussions.
• Exercises - Individual Ubuntu 22.04 cloud VMs and a Cyber Dojo cloud instance guarantees the same environment for all students.

Some of the topics covered

• Fuzzing and Sanitizers: How to use tools like Address Sanitizer and fuzzers like AFL/libFuzzer to find and fix security vulnerabilities. Here you will use fuzzing to find the Heartbleed vulnerability in OpenSSL. You will also be tasked with fixing Heartbleed, and then reviewing the fix that was shipped at the time, to get a realistic impression of how difficult it can be to analyze and fix vulnerabilities in real life scenarios.
• Exploiting Buffer Overflows with Custom Exploit Shellcode: How to exploit buffer overflows and execute arbitrary code, and the mitigations that can help prevent it from happening. Here you will exploit a program with your own custom shellcode.
• Return Oriented Programming (ROP) and Format Strings: How to bypass stack protection mechanisms using ROP and generated ROP chains. And we’ll use format string vulnerabilities as an example of a completely different way of exploiting applications.

Training Schedule

Day 1 - Finding Vulnerabilities Using Fuzzing

• Introduction and Setup
• Introduction to exploitation, vulnerabilities and specifications
• Mitigations and Tooling: Static and Dynamic Analysis
• Undefined Behaviour and Compiler Optimizations
• Address Sanitizer
• Case Study: Heartbleed
• Fuzzing: AFL and libFuzzer
• Debugging Shellcode in GDB

Day 2 - Exploitation and Writing Shellcode

• Exploitation: Format String Exploitation
• Vulnerability: Stack Buffer Overflow
• Exploitation: Writing and Testing Custom Shellcode
• Exploitation: Return Oriented Programming (ROP)
• Summary and Conclusion

Mod(C++) Fundamentals is a two-day training course. It is tailored to give new hires an introduction to modern C++. For private trainings, online or on-site, please get in touch for an offer.

Introduction to C++

Mod(C++) Fundamentals is ideal for people who have little to no experience in C++, but are proficient in an Object Oriented Programming language, like Java or C#.

Mod(C++) Fundamentals should ideally be taken before Mod(C++) Intermediate, another two-day course which expands on the topics in Mod(C++) Fundamentals. Taken together these two courses will give a good foundation for a modern C++ programmer.

Practical information

The exercises will be done in a CMake based project. The students will need a development environment, a rich IDE is recommended, for example Visual Studio Code and Jetbrains CLion. A GitHub account will be useful.

Students are assumed to be proficient in an Object Oriented Programming language like Java or C#. They should be working in (or looking to work in) a C++ project.

Trainers

The course has been authored by Corentin Jabot, Patricia Aas and Ólafur Waage. Between them they have almost 40 years of experience in C++, working on everything from games to browsers and embedded.

Two-day training

Day 1 - Welcome to C++

• Introduction to C++ and presentation of the project
• Hello world and overview of simple C++
• Using variables, functions and parameters effectively
• Using values, references, auto and const
• An introduction to the compilation model of C++. Build systems, compilation, linkage, headers, translation units and libraries
• Introduction to unit testing using Catch2
• Classes, structs, namespaces and enum class
• Allocation on the stack vs heap, std::unique_ptr, Rule of Zero and RAII

Day 2 - Algorithmic Thinking

• Containers: std::array, and std::vector
• Iterators and Algorithms
• Lambdas and Function Templates
• Algorithmic Thinking
• Introduction to tooling like Clang Tidy, Clang Format, CMake, GDB
• Introduction to sanitizers like AddressSanitizer, Undefined Behavior Sanitizer and Memory Sanitizer

Mod(C++) Intermediate is a two day training course. It is ideal for people who have some C++ experience or that have taken Mod(C++) Fundamentals. For private trainings, online or on-site, please get in touch for an offer.

More advanced topics

Taken together Mod(C++) Fundamentals and Mod(C++) Intermediate will give a good foundation for a modern C++ programmer.

Practical information

The exercises will be done in a CMake based project. The students will need a development environment, a rich IDE is recommended, for example Visual Studio Code and Jetbrains CLion. A GitHub account will be useful.

Students are assumed to have some C++ experience or should have taken Mod(C++) Fundamentals. They should be working in ( or looking to work in) a C++ project.

Trainers

The course has been authored by Corentin Jabot and Patricia Aas. Between them they have almost 30 years of experience in C++, working on everything from games to browsers and embedded.

Two-day training

The Intermediate course gives the students a deeper understanding of how one should think and program in “Modern C++” ( C++11/14/17/20). The exercises will all be based around a 2D graphics game inspired by Ms. Pac-Man. Topics covered in the course include:

Day 1 - Generic programming “thinking”

• Introduction to the training Presentation of the project
• Function overloading
• Operators
• Class templates, function templates, non-type parameters
• Aliases and and alias templates
• std::variant and std::visit
• std::tuple and structured bindings
• Variadic templates, fold expressions and parameter packs

Day 2 -Modern C++ Features

• Ranges
• std::string_view and std::span
• Constexpr and Consteval
• Concepts
• Special member functions (Rule of Five/Zero)
• Pragmatic introduction to move semantics and return value optimizations
• Safety: Riskier constructs in C++ and how to minimize their impact
• Conclusion and review

The 4-day (In)Secure C++ training is designed to provide you with the essential knowledge and tools to effectively find and fix vulnerabilities in your own C++ and C code.

For private trainings, online or on-site, please get in touch for an offer.

Understanding Exploitation to Find and Fix Vulnerabilities

The (In)Secure C++ training is designed to provide you with the essential knowledge and tools to effectively find and fix vulnerabilities in your own C++ and C code. To do this, we demystify exploitation by showcasing that it is a mindset, not just a set of techniques.

You’ll gain insights into the motivations behind mitigations in platforms, languages, and tools by understanding the vulnerabilities they are trying to protect against. You’ll get a deeper understanding of why C++ and C are not easy to reason about. With our training, you’ll learn how to design a more secure product, how to establish a robust CI/CD pipeline that improves the security of your codebase and how to find and fix vulnerabilities in your own codebase before others do. And if others find them first, how to understand their vulnerability reports and how to receive and respond to them in a professional manner.

Throughout the four-day training, you’ll dive deep into various topics, including fuzzing, sanitizers, buffer overflows, remote code execution, custom shellcode, reverse engineering, sandboxing as a security boundary, return-oriented programming (ROP), format string vulnerabilities, heap exploitation, good coding practices and establishing a security culture. Each day is carefully crafted to provide you with practical knowledge, real-world examples, and hands-on exercises.

This training is explicitly targeted at C++ developers, though C developers will also benefit.

Practical information

The training can be done both remotely and on-site.

• Audio/Video - Google Meet + Breakout Rooms (for online trainings)
• Chat - Slack: Will be set up a week in advance to facilitate the resolution of any technical issues, and is used during the training to pace exercises and facilitate discussions.
• Exercises - Individual Ubuntu 22.04 cloud VMs and a Cyber Dojo cloud instance guarantees the same environment for all students.

Some of the topics covered

• Fuzzing and Sanitizers: How to use tools like Address Sanitizer and fuzzers like AFL/libFuzzer to find and fix security vulnerabilities. Here you will use fuzzing to find the Heartbleed vulnerability in OpenSSL. You will also be tasked with fixing Heartbleed, and then reviewing the fix that was shipped at the time, to get a realistic impression of how difficult it can be to analyze and fix vulnerabilities in real life scenarios.
• Exploiting Buffer Overflows with Custom Exploit Shellcode: How to exploit buffer overflows and execute arbitrary code, and the mitigations that can help prevent it from happening. Here you will exploit a program with your own custom shellcode.
• Return Oriented Programming (ROP) and Format Strings: How to bypass stack protection mechanisms using ROP and generated ROP chains. And we’ll use format string vulnerabilities as an example of a completely different way of exploiting applications.
• Memory Managers and Heap Exploitation: How to understand and manipulate the memory layout and exploit heap-based vulnerabilities. Here we will look at things like Heap Spraying, Heap Feng Shui, Use After Free, Heap Buffer Overflow and different techniques for getting code execution on the heap.
• Reverse Engineering and Sandboxing: How to analyze binary code and use sandboxing techniques to isolate untrusted code.
• Secure Coding Practices: How to write more secure C++ code and to avoid common pitfalls.

Training Schedule

Day 1 - Finding Vulnerabilities Using Fuzzing

• Introduction and Setup
• Introduction to exploitation, vulnerabilities and specifications
• Mitigations and Tooling: Static and Dynamic Analysis
• Undefined Behaviour and Compiler Optimizations
• Address Sanitizer
• Case Study: Heartbleed
• Fuzzing: AFL and libFuzzer
• Debugging Shellcode in GDB

Day 2 - Exploitation and Writing Shellcode

• Vulnerability: Stack Buffer Overflow
• Exploitation: Writing and Testing Custom Shellcode
• Reverse Engineering
• Sandboxing on Linux (Examples from Chromium)

Day 3 - Mitigation Evasion and Secure Coding Practices

• Exploitation: Return Oriented Programming (ROP)
• Exploitation: Format String Exploitation
• Secure Coding Practices, Mitigations and Tooling - Part 1

Day 4 - Heap Exploitation

• Vulnerability: Memory Managers and Heap Allocation
• Exploitation: Heap Exploitation
• Case Study: Eternal Exploits
• Secure Coding Practices, Mitigations and Tooling - Part 2
• Practice: Vulnerability Management
• Summary and Conclusion

As the industry is embracing DevOps and security is becoming even more important, how these two should be combined is still something that is being explored and is often referred to as DevSecOps. TurtleSec’s approach to DevSecOps is to automate as much as possible and integrate it into the existing pipeline. This is naturally a very custom process, and we believe it should be implemented by the teams themselves in their normal development workflow.

Mini Workshops and Threat Modeling

Having security as a gatekeeping activity is just another silo and doesn’t scale when push-to-prod is measured in minutes or seconds. TurtleSec will help companies on this path by arranging a series of mini workshops (3 hours each) for the teams involved.

The goal for the first workshop is to establish what threat modeling is and try to do some high level threat modeling for the system. The main goal for this workshop is to get an overview and to chose the first vulnerability to mitigate. This will then be the topic for the next workshop.

The next few workshops will follow a three part structure, first we will review what was done since the last workshop, then go through the topic of the workshop (most likely a type of vulnerability) and the last part is to start planning the work to mitigate the vulnerability.

Integrate into the workflow

The idea is that the team will create normal work-tasks for the work to mitigate the vulnerability, for example put it in Jira, prioritize it, plan it for the next sprint etc. We will discuss possible ways to mitigate it, and the goal is to put in automated mitigations into the existing pipeline, the production environment or the development environment. Examples of this could be configuration changes, monitoring, IDE plugins, scanning tools etc.

Over the course of workshops we will continue to work on threat modeling and try to have that guide us in choosing what to mitigate. As the system threat model becomes more familiar we will begin to figure out how to think about threat modeling when introducing new features.

Goals of the coaching processes

The over all goals of this coaching is to make the system more secure by introducing mitigations, but also to make this type of work second nature to the team and have it be naturally integrated in their day-to-day activities.

A natural extension to this would be to have a TurtleSec consultant work on the teams in question for longer or shorter periods to help them with this work. The DevSecOps coaching does, however, not necessitate this. The coaching is meant to be a guided one, where the teams follow a custom semi-structured path to find out how DevSecOps can be woven into their existing system and processes.

Please reach out if this is something you’d like to hear more about.

(In)Secure C++ is an interactive 4-day training over where participants will learn the basis of exploit development to help them view their code from an attackers’ perspective. They will get a good overview of the specs in this area and look at using alternative programming constructs to replace ones that often occurs in vulnerable code.

Mod(C++) Fundamentals: Introduction to C++ for Programmers

Mod(C++) Fundamentals is a 2-day training tailored to give new hires an introduction to modern C++. Specifically suitable for people who are already proficient in another programming language.

Mod(C++) Intermediate: Filling in the gaps

Mod(C++) Intermediate is a 2-day training ideal for people that have C++ experience, but feel that they do not fully understand things like templates, move semantics, concepts or ranges. It is design to give the students a correct intuition so that they will write code that wields the language and libraries well.

My.Code(): Introduction to Programming through Web Development

Interactive training over 4-days where participants will learn fundamental programming skills with a specific focus on web development. This training does not require that the participants have any technical background. The final aim is that they can make and maintain a website dedicated to their interests. This is a training were spreading it in chunks over weeks or months is a good idea, then the students can practice on their own in between classes.

Information

Please reach out to us for more detailed descriptions.