{"id":435,"date":"2018-06-03T10:05:39","date_gmt":"2018-06-03T10:05:39","guid":{"rendered":"https:\/\/www-new.brucon.org\/2018\/?page_id=435"},"modified":"2018-06-09T13:59:57","modified_gmt":"2018-06-09T11:59:57","slug":"malicious-documents-for-blue-and-red-teams","status":"publish","type":"page","link":"https:\/\/archive.brucon.org\/2018\/brucon-2018-training\/malicious-documents-for-blue-and-red-teams\/","title":{"rendered":"Malicious Documents for Blue and Red Teams"},"content":{"rendered":"

[vc_row][vc_column][vc_column_text]<\/p>\n

Course Description<\/span><\/h2>\n
\n
\n
\n
\n

In this training you will learn to analyse and create malicious documents. PDF exploits and malicious PDF documents have been on the radar for several years now. Together with MS Office files like Word and Excel documents. But do you know how to detect them? And how they are constructed?<\/p>\n

This training will teach you how to analyse MS Office files (both \u201cold\u201d OLE and \u201cnew\u201d XML formats) and PDF files. PDF files that execute code via exploits. MS Office documents that execute code via macros or exploits. Didier Stevens will teach you how to use his Python tools to analyse PDF documents and MS Office documents, and how to use his tools to create such documents for pentesting. Documents that download and execute a payload, and documents that embed a payload. Documents that bypass sandbox detection, and documents that bypass application whitelisting. But you will also learn to create documents that do simple tracking, to be used as a canary or in a phishing simulation engagement.
\nThis is not an exploit development training. In the few cases were exploits are used, it will be known, documented exploits.<\/p>\n

By learning how to analyse malicious documents, you will also better understand how to make your own documents for pentesting. Programming skills are not required, some basic experience with scripting is a plus.<\/p>\n

Attendees will receive also a copy of Didier’s private “Red Booklet”, a collection of red team recipes, several of these never published.<\/p>\n

To get a better idea of the training, you can also view the following YouTube videos.<\/p>\n

PDF analysis:<\/p>\n