B-SIDES TAMPA 2021 TRAINING CATALOG
Friday, March 26, 2021
Web App Penetration Testing
Instructor: Sunny WearTime 9:00 AM (EST) till 1:00 PM (EST)Gain hands-on experience learning how to perform web application penetration testing in this four-hour workshop with the author of the Burp Suite Cookbook and the mobile app, Burp Tool Buddy, Dr. Sunny Wear. Students will learn Injections attacks such as Cross-site Scripting and SQL Injection attacks, brute-forcing tactics, and optimization techniques for Burp Suite including configurations and macros.Requirements:Each student must provide their own Laptop: Operating System: Windows 7 or above (with admin privilege) OR Any Linux Distro OR MAC RAM: Minimum 4GB (but 8GB is preferred) Hard disk: Minimum 50GB free space Oracle Virtual Box.
Customized Honeypots and taming the wild IoTs
Instructor : Kat Fitzgerald1:00 PM (EST) till 4:00 PM (EST)Honeypots AND IoT security, all in one place? Yes, why YES I tell you, and this is it! Oh sure, honeypots are not new, but honeypot customization in the wild world of IoT is what makes this workshop unique. Presented for your viewing pleasure will be IoT specific honeypot configurations, some deployed with k8s (some not) and how they are used to not only trap attacks against your IoT devices but also detect attacks FROM a compromised IoT device.This 3 hour workshop will take you through the exciting world of honeypots and customizing them to annoy the heck out of your attackers. Ok, it helps you detect them too! Honeypots are not useful if they are easily detected by specialized scanners. Here is where the rubber meets the deception.One of the biggest issues with honeypots is not setting them up, but using them the right way. Now referred to as "deception tech", honeypots can provide a level of detection and defense against attacks, many of which are targeted to IoT devices. Course Requirements - A computer configured for virtualization. (Virtualbox preferred) In addition, Docker will be used so should also be installed. Labs will provide enough direction and examples so you don't have to be a virtualization or docker expert. General outline:A. Intro to Honeypots - The BasicsB. Intro to IoT Attack VectorsC. Planning the deceptionD. Your First Honeypot - LabE. Monitoring PlanningF. Monitoring - LabG Designing the Custom DeceptionH. Customization - LabI. Attacking your creations - intro to toolingJ. Finding more decoys - ShodanK. Customization Part 2 - LabL. Logging & Monitoring Part 2 - ReviewM. Automation OptionsN. Wrap UpKey Takeaways - This workshop clearly presents the "Hows and the Whys" of planning and deployment and what to expect from private and hostile environments. Attendees will walk away with real tools and ideas to use right away and not just some theory. Learning about techniques to apply customization is critical to avoid detection of your honeypots. Understanding key pain points and deployment options is what makes Deception Tech one of the most useful tools in the infosec arsenal. With increasing attacks on IoT and their use as pivot points or amplifiers in certain attack scenarios it is important to know how to build your defenses to provide earlier detection.Requirements:A computer configured for virtualization. (VirtualBox preferred) In addition, Docker will be used so should also be installed. Labs will provide enough direction and examples, so you don't have to be a virtualization or docker expert.
Open Source Intelligence 101
Instructor : Brian Markham9:00 AM (EST) till 1:00 PM (EST)OSINT is an important and useful skillset to have as a hacker and security professional. The purpose of this course is to give the student the information and mindset they need to start applying OSINT acquisition skills in their daily lives. We'll cover a methodology for gathering OSINT, basic skills and tools (such as Google Dorking and Maltego), searching for people information, and organizations. We'll do all of this with ethics in mind and a pledge to use these skills for good and to not be creepy. The course will last four hours and include a CTF event for students as the end of the course (to show off what they've learned). This course will be presented in an accessible, n00b friendly manner. All skill levels are welcome and questions are encouraged. Requirements:Mac or Windows laptop with VMware or Virtual Box.
OSINT Investigation : Missing Person
This course, taught by a member of the winning team of the DEFCON28 OSINT Search party and 2nd Place team at HackFest Missing Persons CTF, is designed to hone specifically in on the processes and tools used to perform "People OSINT" in situations where investigators are seeking to find missing people, some of which do not want to be found. This focuses on validating the information discovered and using it to pivot to valuable information, in both a CTF setting (such as Trace Labs' CTFs -https://www.tracelabs.org/getinvolved/ctf/) and law enforcement.Learn more about the course here: https://www.theosintion.com/courses/osint-investigations-people/Link: https://attendee.gototraining.com/r/8663214156563283201Price: $120 with no coupon codeEDU Coupon Code: "BSidesTampaEDU21" (Must use a .edu email to register - it can be faculty, staff, or students) Brings the price to $75Non-EDU Coupon Code: "20BSidesTampa21" Brings the price to $100
Prisma Cloud CTF Workshop [Sold Out]
Join us for this FREE Prisma Cloud Cloud Native Security Camp, a 2 hour virtual workshop for technology professionals who are:• Focused on learning more about how to successfully develop the people, processes and tools necessary to adopt a DevSecOps practice• Interested in gaining hands-on knowledge about Prisma Cloud and how to address security risks throughout the development lifecycleFriday March 26, 2021 10am - 12pm PST ( 1 - 3 PM EDT)Register via the link belowhttps://paloaltonetworks.zoom.us/webinar/register/WN_gfM5rz-ASH6D0XBovdm4TAInstructor:Tim Burby Cloud Security Systems Engineer with Prisma Cloud a Palo Alto Networks company. Tim has helped companies find value in their Cloud Infrastructure investment. Through the full development cycle, from code, to build; from deploy and through runtime I believe that the best tool is a unified one that allows DevOps, Security, Compliance and SOC teams to reduce their time learning a tool and increase their productivity using it. Tim is a Certified AWS Solutions Architect and hold one of the first PCCSE certificates which is Palo Alto Networks Certified, Cloud Security Engineer.
Investigating with Splunk Workshop [Sold Out]
Investigating with Splunk is a modular, hands-on workshop designed to familiarize participants with how to investigate incidents using Splunk and open source intelligence. This workshop provides users a way to gain experience searching in Splunk to answer specific questions related to an investigation. These questions are similar to what would be asked in their own organizations. The workshop leverages the popular Boss of the SOC (BOTS) dataset in a question and answer format. Users will leave with a better understanding of how Splunk can be used to investigate in their enterprise.Register for either of the sessions via the links below:2 Sessions Available:Morning : Friday, March 26, 2021 | 11:00 a.m. - 1:00 p.m. EThttps://go.guidepointsecurity.com/2021_03_26_SE_BsidesTampa_Investigating_Splunk_Workshop_01-Registration-LP.html Afternoon: Friday, March 26, 2021 | 2:00 p.m. - 4:00 p.m. EThttps://go.guidepointsecurity.com/2021_03_26_SE_Bsides-Tampa_Investigating_Splunk_Workshop_01-Registration-LP---PM.html Instructor: Jonathan SingerJonathan Singer has over 14 years of experience as an information technology professional. Prior to joining GuidePoint, Jonathan worked at a Central Florida ISP specializing in web application security, policy and compliance, and RedHat Linux system administration and hardening. Currently, Jonathan leads the SIEM & SOAR Professional Services team for the Southeast Region and is a Certified Splunk Architect. Jonathan participates in many speaking engagements throughout the East Coast, currently holds a CEH and several SANS certifications, and a Master's Degree of Cybersecurity from the University of South Florida.
AWS Game Day
GameDay is a learning exercise that tests skills in implementing AWS solutions to solve real-world problems in a gamified, risk-free environment. This is a completely hands-on opportunity for technical professionals to explore AWS services, architecture patterns, best practices, and group cooperation.Our approach is unconventional compared to other learning formats. Ambiguity and non-prescriptive guidance allow teams the flexibility to think creatively as they navigate a wide array of technical challenges. There is no one right answer; teams pave their own path based on resources we provide them with in live AWS accounts. If you enjoy open-ended challenges without step-by-step instructions, look no further.The setting for every GameDay is our famous (fictitious) narrative. Participants are new hires at Unicorn. Rentals and this is their first day on the job.Unicorn.Rentals New HiresCongratulations on your new position at Unicorn.Rentals! We are the largest provider of mythical creatures in the world, fulfilling the needs of parents who have caved to their childrens' demands of temporary use of a unicorn.As part of our dominance of the Legendary Animal Rental Market (LARM), we understand the importance of our human capital and invest heavily in training programs for our growing team of technical experts. This will be a new hire orientation that you will never forget!
Corelight CTF
When : Friday March 26, 2021 : 1:00 PM till 3:00 PM (EST)Corelight’s popular Capture the Flag (CTF) events have gone digital to support our new work-from-home world. We’re excited to host a private, virtual CTF competition on behalf of Splunk at B-Sides Tampa.Participants can hunt for the CTF crown from the comfort of their home, racing to beat other players and answer dozens of security challenges using Zeek data in Splunk. Players accrue points based on response accuracy and speed and can follow the group leaderboard updates in real time. New to threat hunting, incident response and CTFs? No problem. Participants of all security levels can play thanks to 1:1 private in-game support offered by Corelight’s technical experts. Need help during the game? Just ask. Sign up now to secure your spot!Register via the link belowhttps://www3.corelight.com/ctf/hunt-from-home-bsides-tampa
SecureCode Warrior Tournament
When: March 27th, 9AM - 3:45PM EDTSecure Code Warrior brings you a defensive security-based tournament from a developer's perspective. The tournament allows you to test your skill against the other participants in a series of vulnerable code challenges that ask you to identify a problem, locate insecure code, and fix a vulnerability. You don’t need extensive programming knowledge as this will be a great way to learn the foundations and intermediates of leveraging code that is not only functional but is also secure.Secure Code Warrior brings you a defensive security-based tournament from a developer's perspective. The tournament allows you to test your skill against the other participants in a series of vulnerable code challenges that ask you to identify a problem, locate insecure code, and fix a vulnerability. You don’t need extensive programming knowledge as this will be a great way to learn the foundations and intermediates of leveraging code that is not only functional but is also secure.Register using the link below:https://discover.securecodewarrior.com/BSidesTampa-tournament.htmlYou can find the tournament step-by-step guide here: https://www.youtube.com/watch?v=TwbySIg2z2YThe tournament is run virtually so you can join through your laptop from the most convenient location and time. It should take only a few hours, drop-in as you see fit during the duration of the event to complete all the challenges and win prizes! :first_place: :second_place: :third_place: Instructions for playing:1) Register for the Secure Code Warrior platform here: https://discover.securecodewarrior.com/BSidesTampa-tournament.html2) Check your email for the confirmation and access the unique link to create your profile. [check spam just in case]3) Once logged in: click “Tournaments”4) Join the BSides Tampa Secure Coding TournamentThe Secure Code Warrior platform will be open to everyone. The Secure Code Warrior platform will be open before and after the tournament, so feel free to practice in the “Training” tab.Monitor the live leaderboard to see how you're performing!
Yes, it's okay to send me text messages including confirmations, changes, updates, and/or promotions. Message frequency varies. Message and data rates may apply. View our terms of service & privacy policy.
