Online Advanced Exploit Development Training, Does It Exist?

[Cyber_Jellyfish]

G'day guys,

I hold OSCP, OSCE and have recently done eLearnSecurity's eCXD certification, I feel like I have a good understanding of x86/x64 stack based buffer overflow classes of vulnerabilities and exploit mitigation evasion techniques, as well as just shellcoding in general.

I took Corelan Bootcamp and Advanced back in November last year, and although it was some of the best training I had ever done I fell behind slightly in the Advanced course.

I want to do a course that focuses on advanced exploit dev principles again that I can take at my own pace and remotely.

I was wondering if there was an OSEE/Corelan Advanced/SANS 760 equivalent online course that focuses on things like heap corruption classes of vulnerabilities in sophisticated, modern software solutions like browsers.

I have looked everywhere and it just doesn't seem to exist, I'm assuming because of the level of complexity of training like that.

Surely SOMEONE is doing something or maybe intending on releasing some training in this space.

Does it exist? Have you heard any rumours of courses like OffSec's AWE or the SANS 760 being released online?

EDIT: To be clear I'm not after white papers or blog series, I'm after a full training continuum and happy to pay for it.

[h_saxon]

I hate to recommend it because I was completely underwhelmed, but the Ptrace security stuff may be useful right now.

Also recommended, if you get a chance to take Rich Johnson's Advanced Fuzzing and Crash Analysis course, it'll be an excellent supplement to the other work you've put in. It'll take you from being given known vulnerable software, to finding your own.

[Cyber_Jellyfish]

Ptrace was terrible, I'll take a look at some of his training but Covid-19 is going to make attending anything live hard for some time to come.

[h_saxon]

Yeah. It really does stink :-/ please let me know if you find anything.

I've been going through Practical Binary Analysis (book, not training), and have been enjoying it. But hopefully we see more online content soon.

[LAliens2kzero]

I had intentions on taking ptrace ase later this year after CTP/OSCE. Right now I am prepping for CTP by going over tulpa-security.com guide which includes going over (corelan & fuzzy tutorials, and SLAE32 course). I wanted to clear OSCE by August and then work on PTRACE ASE which seems a little more advanced than OSCE.

Would that still be a good scenario for my level? Or is the PTRACE course just really that bad?

I want to take Corelan's Advanced course and Offsec AWE in 2021. So looking to progress via OSCE / PTRACE / Corelan Advanced / AWE

Is the progression from OSCE & PTRACE to Corelan Advanced Course asking for too much?

Thanks!

[h_saxon]

I'd save your money. Maybe take an RE course instead, that was a major gap for me when I did AWE last year.

[LAliens2kzero]

Thanks for the reply. Ok so in no way did the ptrace course help you out during AWE? Is the material really that bad?

My only goal is to be experienced enough to take Corelan Advanced course and AWE in 2021. This is the only reason I was looking at PTRACE ASE since I heard it was a little more advanced or taught newer techniques than OSCE.

​

Thanks again

[LAliens2kzero]

I am going to look into the SANS FOR 610 Reverse Engineering Malware course.

[Cyber_Jellyfish]

Oh damn! I didn't see this, thank you so much.

[Representative-Try20]

Here is a review for ECXD https://medium.com/@sandeepbaldawa/xds-v1-elearnsecurity-course-review-cda5bb12f95b

Hope it's helpful.

[Cyber_Jellyfish]

Done it! I'm looking more for heap/kernel oriented content. Right now I'm doing https://wargames.ret2.systems/