PDF mit Faxback - usp MarCom

Agenda
Beginn der Schulung:
Montag, 14. April 2008, 10.00 Uhr
Ende der Schulung:
Freitag, 18. April 2008, 16.00 Uhr
Tagesablauf:
Die Schulung beginnt täglich um 9.00 Uhr
und endet um circa 18.00 Uhr mit der Op -
tion, sich auch nach 18.00 Uhr noch mit
den Übungen zu beschäftigen (open end).
Am Tag der ge mein samen Abendveranstaltung
endet der Schulungstag pünktlich
um 18.00 Uhr.
Tag 1: Discovery/Scanning Basic intro -
duction to important aspects of TCP/IP,
DNS and WHOIS. Target Acquisition, Host
Discovery, Fingerprinting, Service Scanning
and NMAP in depth, Banner Retrieval
and Application Mapping, (TCP)-Tracerouting,
Automated Vulnerability Scanners,
Vulnerability Databases. Putting it all
together – Hands on Exercise.
Tag 2: Web Application Hacking General
Web Server Vulnerabilities and Miscon -
figurations (Attacking Web-based
Authentication, SSL Attacks, Webproxies,
Cookies, IDS Evasion), Web Application
Security (Cross-Site Scripting and „really
cool exploitation of XSS“, (blind and/or
automated) SQL-, XPATH and LDAP-
Injection, Phishing, Session-IDs, -hi -
jacking and -replay, DNS Rebinding, HTTP
Response Splitting, Cross-Site Request
Forgery, Web Services Security and AJAX,
Backend Mining, Local/Remote File In -
clusion), Hands on Excercise, Countermeasures.
Tag 3: Microsoft Windows Profile Windows
Background NT, 2000, 2003 and XP, Target
Identification, Windows Security Model
(LSA and so on), Registry. Active Directory
Security (and vulnerabilities specific to big
company networks), NetBios Hacking,
Enumeration, LDAP Security, Authentication
and Authorization, LSA-Secrets and
Password Cracking, Security of Windows
Services, Attacking Terminal Services and
Kerberos, Local Privilege Escalation,
„20 Things To Do After You Hacked
Admin“, WFP, DEP, Shatter Attacks,
Access Token Manipulation, Passing the
Hash and Hash Injection, Hands on Exercise,
Countermeasures.
Tag 4: Linux/UNIX Introduction to the most
important UNIX commands, Discovery/
Scanning, Target Acquisition, Remote
Information Gathering, Vulnerability
Mapping, Remote Access, Buffer Overflow
Attacks, Local Information Gathering,
Local Privilege Escalation, Hacking
Traditional Unix Services (NFS, NIS...),
Symlink Attacks, File Descriptor Leakages,
Race Conditions, Basics on Buffer
Overflows, Hacking the Next Hop, Hands
on Exercise, Countermeasures.
Tag 5: Datenbanken/Advanced Techniques
Databases: Oracle, MS-SQL, MySQL,
SYBASE – Hacking, Hands on Exercise.
Advanced techniques: Step-by-Step Programming
of Buffer Overflows, Protocoland
Application-based Tunneling, Port
Redirection, Rootkits, Sniffing and Manin-the-Middle,
Keystroke Capturing, TCP
Session Hijacking, GUI Hijacking, DNS
& IP Spoofing, Metasploit Framework,
Hands on Exercise (Final Lab: All OS/
Databases/Advances Techniques).
Referenten
Wir setzen ausschließlich speziell ge -
schulte und erfahrene Ernst & Young
„eXtreme Hacking Class“ Trainer ein. Alle
unsere „eXtreme Hacking Class“ Trainer
haben umfangreiche mehrjährige Erfahrung
im Bereich der technischen IT-
Sicherheit und sind durch kontinuierliche
Weiterbildung stets auf dem neuesten
Stand der Technik und Methodik.
Nähere Informationen zu der Schulungsinhalten
und den Referenten erhalten Sie auf
unserer Webseite:
http://www.de.ey.com/hacking
oder telefonisch unter:
(06196) 996 10246.
ERNST & YOUNG – EXTREME HACKING
3