Learning: Assembly, Shellcode, Buffer Overflows, Debuggers

jamesleecolemanjamesleecoleman Member Posts: 1,899 ■■■■■□□□□□
Hey there,

I'm having the hardest time learning what's in the title. I've tried youtube video's, looked for books and online reading. Nothing really makes sense to me and even trying to do these things are taking a while for me to even wrap my head around the basics. I'm working on the eCPPT at the moment and I'm not going anywhere as far as these subjects. Feeling kinda dumb lol. Does anyone have any suggestions on learning these subjects?
Booya!!
WIP : | CISSP [2018] | CISA [2018] | CAPM [2018] | eCPPT [2018] | CRISC [2019] | TORFL (TRKI) B1 | Learning: | Russian | Farsi |
*****You can fail a test a bunch of times but what matters is that if you fail to give up or not*****

Comments

  • JasminLandryJasminLandry Member Posts: 601 ■■■□□□□□□□
    I did this course x86 Assembly Language and Shellcoding on Linux and I really thought it was great. At the end of the course, I was even able to submit a shellcode to Exploit-DB. @Jollyfrogs started a great thread about it here http://www.techexams.net/forums/security-certifications/119686-slae-jollyfrogs-tale.html. PentesterAcademy also has courses for x64 Assembly and for Windows Buffer Overflows.
  • globalenjoiglobalenjoi Member Posts: 104 ■■■□□□□□□□
    I am in the same boat actually. I started the ELS material in the System Security section and my brain hurt by the second module. I had a pretty good understanding of buffer overflows, or at least I thought... I'll gladly accept any advice that shows up in this thread.
  • BlackBeretBlackBeret Member Posts: 683 ■■■■■□□□□□
    The SLAE/64 course Jasmin recommended is great. I've started it over twice now because work requirements keep getting in the way of my person study time, but I can't recommend it highly enough. If you purchase the course part of what you get is the GDB course, which covers using GDB as the debugger of choice for the SLAE course. If you're looking for free resources Security Tube's megaprimer series is good as well. It's basically SLAE light. Start with the Linux assembly, then Windows assembly, buffer overflows, and end with exploit research.

    http://www.securitytube.net/groups?operation=view&groupId=5
  • the_Grinchthe_Grinch Member Posts: 4,165 ■■■■■■■■■■
    Great thread with some great info! Definitely going to help with where I am hoping to go! Three weeks to finish my thesis and then it's deep dive time into exploitation :)
    WIP:
    PHP
    Kotlin
    Intro to Discrete Math
    Programming Languages
    Work stuff
  • paul78paul78 Member Posts: 3,016 ■■■■■■■■■■
    Just my 2 cents - but I've always thought that starting with a foundation on assembly language is usually the best way before trying to dive into these topics.

    I usually recommend the classic The Art of Assembly Language Programming by Hyde. I'm not entirely sure about the copyright status but I've seen PDF's available at various universities if you google. Hardcover can be purchased at your favourite book retailer.
  • jamesleecolemanjamesleecoleman Member Posts: 1,899 ■■■■■□□□□□
    Thanks for the input everyone. I'm sure I could get away without all of the stuff I wrote in the title but it's great stuff to know. I did check out the securitytube stuff and the subscription is a little high at the moment so I'm stuck looking for other things. The megaprimer looks great, hopefully it'll help everyone out who needs it.
    Booya!!
    WIP : | CISSP [2018] | CISA [2018] | CAPM [2018] | eCPPT [2018] | CRISC [2019] | TORFL (TRKI) B1 | Learning: | Russian | Farsi |
    *****You can fail a test a bunch of times but what matters is that if you fail to give up or not*****
  • SaSkillerSaSkiller Member Posts: 337 ■■■□□□□□□□
    The best IMO has been the GREM material. I have the SLAE stuff too, but the GREM material is presented really well.
    OSWP, GPEN, GWAPT, GCIH, CPT, CCENT, CompTIA Trio.
  • jamesleecolemanjamesleecoleman Member Posts: 1,899 ■■■■■□□□□□
    Sorry, what is GREM?
    Booya!!
    WIP : | CISSP [2018] | CISA [2018] | CAPM [2018] | eCPPT [2018] | CRISC [2019] | TORFL (TRKI) B1 | Learning: | Russian | Farsi |
    *****You can fail a test a bunch of times but what matters is that if you fail to give up or not*****
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    Sorry, what is GREM?

    I'm assuming he is referring to the GCIA certification. Technically he would than be talking about to the SANS FOR610 course material.
  • BlackBeretBlackBeret Member Posts: 683 ■■■■■□□□□□
    In that case, also check out Practical Malware Analysis. It goes in to Assembly from a malware analysis perspective. It doesn't necessarily teach you to program in it or write exploits, but it does give you a goal for analysing and learning along the way.
  • jamesleecolemanjamesleecoleman Member Posts: 1,899 ■■■■■□□□□□
    I was thinking about checking out Practical Malware Analysis but figured it would be way over my head when I read the title. I'll see if I can find it at the book store.
    Booya!!
    WIP : | CISSP [2018] | CISA [2018] | CAPM [2018] | eCPPT [2018] | CRISC [2019] | TORFL (TRKI) B1 | Learning: | Russian | Farsi |
    *****You can fail a test a bunch of times but what matters is that if you fail to give up or not*****
  • BuzzSawBuzzSaw Member Posts: 259 ■■■□□□□□□□
    So this is going to sound crazy ... but depending on your level of experience, a REALLY great course with high quality content, and even the ability to get a piece of paper is Harvard's free CS50 course. I realize the first few lessons may be pretty basic, but it ramps up quickly, is engaging, and even got me to think differently about some old knowledge I had. While it wont dive deep into malware, and shellcoding, it will give you all the basics and foundation you need to then start to understand those https://www.edx.org/course/introduction-computer-science-harvardx-cs50x
  • SaSkillerSaSkiller Member Posts: 337 ■■■□□□□□□□
    I'm assuming he is referring to the GCIA certification. Technically he would than be talking about to the SANS FOR610 course material.

    I'm talking about GREM, Reverese Engineering Malware, which discusses ASM, shellcode, debuggers. GCIA does not.
    OSWP, GPEN, GWAPT, GCIH, CPT, CCENT, CompTIA Trio.
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    SaSkiller wrote: »
    I'm talking about GREM, Reverese Engineering Malware, which discusses ASM, shellcode, debuggers. GCIA does not.

    Right. Don't shoot the messenger icon_razz.gif
  • SaSkillerSaSkiller Member Posts: 337 ■■■□□□□□□□
    Lol, no biggie. :D
    OSWP, GPEN, GWAPT, GCIH, CPT, CCENT, CompTIA Trio.
  • BlackBeretBlackBeret Member Posts: 683 ■■■■■□□□□□
    GREM, the GIAC certification name tied to the test based on the SANS FOR610 course. That's what everyone here is talking about. NetworkNewb just put GCIA instead of GIAC. To be fair, the test wont teach you much, the FOR610 course will teach it all to you. I hold my position, after seeing both, PMA covers more material, in more depth, with more exercises, for 1/200th of the price. icon_lol.gif
  • BuzzSawBuzzSaw Member Posts: 259 ■■■□□□□□□□
    BlackBeret wrote: »
    The SLAE/64 course Jasmin recommended is great. I've started it over twice now because work requirements keep getting in the way of my person study time, but I can't recommend it highly enough. If you purchase the course part of what you get is the GDB course, which covers using GDB as the debugger of choice for the SLAE course. If you're looking for free resources Security Tube's megaprimer series is good as well. It's basically SLAE light. Start with the Linux assembly, then Windows assembly, buffer overflows, and end with exploit research. http://www.securitytube.net/groups?operation=view&groupId=5
    Megaprimer for the win. -- To the OP: check it out. It's free, short, and pretty easy to absorb.
Sign In or Register to comment.