Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
campusCon at WIT
Options
-
06-12-2011 10:47pm#1
Comments
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
Advertisement
-
-
-
-
Another speaker confirmed! 4 in total now: http://campuscon.hackingwit.com/talks.php
Seems to be gaining momentum now
0 -
If I can go along with some associates we might be able to give a talk/demo on either 802.11 security, LAN/client side exploitation taken to another level or malicious code obfustication. Depends though, it is a fair distance, and I have other considerations to make... Would love to hit the CTF too 0
-
That would be greatly appreciated. Drop me a line if you decide to join us. Where are you based?
Also - We've added another speaker.
Event so far is shaping up as follows.
5 Talks- Introduction to SQL Injection.
- Writing mobile applications with the cloud.
- When I Grow Up I want to be a Cyberterrorist
- The politics of security. What's being done about computer crime and why does it matter?
- C/C++ must die. It's ground hog day.
Events
Team-based hacking challenge. A 3-layered challenge, which awards a team 5 points for each layer compromised. Maximum of 5 people per team. Winners get bragging rights, and whatever else we can muster up
We will also have a few RC cars floating around for amusement, along with a digital forensics display, project areas, refreshments, beers, and much more!
So make sure to mark Jan 21st down in your diaries, and spread the word. The more successful this event is, the more likely we are to make this event an annual one.0 -
I am Galway based, and will know by Jan 2nd (not Jan 1st, will be crippled hungover) if I can make it.
I will likely have a talk prepared on taking MITM/Client side/802.11 attacks to the "next level" (think karmetasploit style stuff, jasager, etc) and how it can be done. I just have to make powerpoint agree with me, test my Middler plugins and MSF aux modules, and then get it ready to roll
If people want, I can always do a quick demo on malware obfustication using simple bits of C, objdump and msfencode (what better shellcode encoder is there?), and perhaps some tricks for hiding payloads (It has been of great interest lately, hiding things...)
Also, I *should* be able to bring along a few people... If anyone from Galway is going drop a line 0 -
-
Another speaker confirmed! 4 in total now: http://campuscon.hackingwit.com/talks.php
Seems to be gaining momentum now
Is it open for anyone to attend or just WIT students?0 -
-
Advertisement
-
-
-
-
-
-
Right, I am working on the slides. Will ye have a projector machine that hooks up via VGA? Netbook I plan to bring only has VGA out. I'll make the powerpoints, write the code, and do up some nice videos covering some of the more interesting ways of owning people via 802.11 networks...
Cannot think of a good name for it though, but the subheader says "in your switches reroutin your b*tches riches!".
Yup, we'll have a projector with a VGA connector.
If you just want to pass me on a brief bio of yourself, and abstract of the talk - I can add it to the website.Also, regarding the CTF.
Are the following permitted?
Web crawlers (to generate lists of URL's or to "feed" a proxy like Burp/RatProxy).
Port Scanning (In my whole career, I never owned anything without nmapping it first).
Directory "brute force" (trying to find the admin folder (if any) or phpmyadmin dir (if any) by using automated techniques.)
Adding users to the box
Potentially crashy local root exploit* (all local roots CAN CAUSE KERNEL PANIC AND BOX CRASH! So be aware of this!)
You won't require any brute force/dictionary attacks. It's doubtful you'll need any web-crawlers either. Exploits are fine, so long as they are manual. So basically, no autopwn with metasploit. No hammering the system, it won't be required. Once you get setup - you'll understand.Obviously rm -rf /* is not allowed, and I assume owning the competitors is not permitted either :P
NoOh, that other thing too... How the hell do I get to the place from the bus station or wherever I land? Will I just call someone/Wander aimlessly/look for a sign? Is there a pub nearby? And will CTF and talks be on @ same time?
There'll be drinks after the event. Depending on what time you get into the bus station, I can collect you if you're stuck. But it will have to be before the event starts, as my hands will be full after that. The location of the campus is on the website, and is about a mile from the city centre. Google maps location is here.*I assume in the CTF... We should document EVERYTHING, no?
Yes, all teams will be required to document their efforts. That way we know if someone isn't cheating
**also, if you are gonna use some non x86 arch box, like, say, a SPARC box, PLEASE INSTALL GCC/CC ON IT. Seriously. I have seen experienced blackhats/pro's accidentally break their intended targets box by using an x86 compiled local root exploit on a SPARC box. No idea how it even ran in the first place, but the box didn't last very long.
We won't be using any obscure OS or architecture, don't worry. Everything you'll need will be available.0 -
Damo2k - I plan to cover fake AP's briefly along with standard MITM, then move on to KARMA and Airpwn methods with metasploit, evilgrade, etc. If a certain German ever emails me back with his code (I tried to replicate it without success so far, the .pdf I got from his talk broke the formatting so badly...) and I get a chance, I will be releasing a new EvilUpdateServer Metasploit Aux module.
Autopwn for MSF, thankfully, has been depracated. It was only useful as a teaching tool anyway - show people how NOT to do it (run an IDS along with a db_autopwn attack and show them how much noise it makes). It WAS useful for showing what exploits MIGHT work though.
dlofnep - I will pass you the info tomorrow when I am online, sister wants the laptop for facebook :P
I understand why no hammering - I ran a small CTF event at the local hackerspace a year ago (everyone rooted the box in 0.5 seconds - we left the real target box at home and had to use a DVL liveCD which had root:toor... Enough said?)
The rules seem fairly simple to understand, though a suggestion - perhaps run Wireshark/TCPdump on the whole attack-network/victim box and then maybe burn the .pcap to a DVD after the event? I am sure some of us will want to see the traffic :P
And thank god it aint gonna be some obscure box! I already am making assumption point of entry is via web... So the port scan is not REALLY useful (except to identify some of the more unusual log injection tricks).
Thanks a million for setting this up (and for putting up with my over 9000 questions... There will doubtlessly be more soon!)
Perhaps send an invite to the guys at Symantec Security Response in Dublin? I sent one to Brian Honan and @securityninja on twitter a while ago, so they *might* show. I will also email the guy at secured.ie in the morning 0 -
That's grand man. I contacted OWASP - we're hoping for them to round up a few troops and send us a speaker also. Do you have the contact details for the Symantec lads? I've contacted all colleges and universities, so anyone else you could suggest would be most welcome.
RE: Entry-point, there are 3 layers to compromise - so there is no one single way to accomplish it It is still not complete yet, so I can make it as complex as need be - but I want to try and find a healthy balance between those who are still getting their feet wet in security, and seasoned vets. 0 -
Advertisement
-
Advertisement