Pentesting with Perl at BlackHat 2010

The course I have been working on for a while now, known as “Pentesting with Perl” was released for the first time this year at BlackHat 2010 in Las Vegas. There was a ton of quality content that I put into the course including many of the techniques I have developed to automate the tedious tasks that need to be performed when conducting a penetration assessment.

What made the course unique was that all of the examples were based on useful techniques that I use on a daily basis. Many people learn best by using example, so I built the course to leverage practical examples when explaining the theories of using Perl.

For example, I built a script which processed a PDML file and coverted the ASCII codes using a hash. This a better example than just using something like: (apple => red, orange => orange), because it demonstrates value which can be applied immediately.

Based on the feedback we received, it looks like people really enjoyed the course. The only thing that the students wanted to change is to have more time for the labs. Therefore, I’m sure I will be teaching this training again but using a two day format instead of one. Pentesting with Perl was a great success and it’s only gonna get better! Ph33r!

Advertisement

Pentesting with Perl

I’m currently working on a new training course I’m planning to give in the near future. By the title of the blog posting, I’m sure you have guessed the title… That’s right, Pentesting with Perl

The object of the course is to cover many of the tasks that need to be performed during a penetration assessment.

• IP/Hostnames reverse, resolve and extract information
• Convert CIDRs to Ranges and Ranges to CIDRs
• Extracting information from: Nmap, Nikto, Sslscan, Dirbuster, and Fierce
• Extracting links and email addresses from a website
• Building a Port-scanner in 10 minutes or less
• Union and intersection of two files
• Building a sniffer to parse PDML (synergy decrypter)
• Performing Phishing attacks with Metasploit (updated)
• Modifying the shellcode of your favorite browser exploit (updated)

This course will help to streamline much of the tedious aspects of pentesting. We will use Perl to get the job done quickly and effectively. The goal of the course is to help everyone to automate many of the tasks they are performing manually, so that they can focus on more complex issues. The ability to automate tasks is critical to being a successful penetration tester. We need to be spending time on the most complex issues that can not be tested through the use of automated tools!

Please let me know what you think. I look forward to your comments and suggestions.

Recommended Reading:

• Programming Perl (ISBN-10: 0596000278, ISBN-13: 978-0596000271)

The requirements for the course are:

• A basic understanding of Perl including scalars, arrays and hashes
• A basic understanding of XML and Object Oriented programming
• A good understanding of TCP/IP and other networking concepts
• Familiarity with Nmap and other penetration testing tools

I’m structuring the course to be roughly 3 hours and to be available at Infosec World 2010.

Regards,
Jabra