Full Stack Web Attack is not an entry-level course. It's designed to push you beyond what you thought was possible and set you on the path to develop your own workflow for offensive zero-day web research.

This course was developed for web penetration testers, bug hunters and developers that want to make a switch to server-side web security research or see how serious adversaries will attack their web based code.

Students are expected to know how to use web proxies and have a basic understanding of common web attack patterns as well as perform basic scripting using scripting languages such as python, PHP and JavaScript.

Each of the vulnerabilities presented have either been mirrored from real zero-day or are n-day bugs that have been discovered by the author with a focus on not just exploitation, but also on the discovery.

So if you want to learn how to exploit web technologies without client interaction for maximum impact, that is, remote code execution then this is the course for you.

Instructor

Steven Seeley (@steventseeley) is an internationally recognized security researcher and trainer. For the last six years, Steven has reached platinum status with the ZDI and has literally found over a thousand high impact vulnerabilities.

In 2020, Steven teamed up with Chris Anastasio and won the ICS Pwn2Own competition held in Miami. Later on, Steven went on to play in Pwn2Own Vancouver in 2021 targeting Microsoft Exchange Server with an Remote Code Execution and obtained a successful (partial) win.

Currently Steven focuses on cloud security research with Qihoo's 360 Vulcan Team.

FAQs

What must I bring into the event?

An open mind that is ready to focus.
A gitlab.com account, you can register here.
Moderate or advanced skills scripting skills.
Some exposure to container based technologies and *nix operating systems.
A strong understanding of various web technologies such as http(s), client/reverse proxies and browsers.
A foundational understanding of common web vulnerabilities.

Please do not use netbooks or tablets for this course.

Where can I find more information?

An updated syllabus can be found here or feel free to email us at training@srcincite.io.

Will this cover memory corruption vulnerabilities and exploits?

No, that is beyond the scope of this training course.

Where will this event be held?

Online via Zoom.

What's the refund policy?

A minimum of 5 people must sign up for this training to take place. Tickets will be refunded in full if this requirement is not met.

Full Stack Web Attack (FSWA) Training Course 2021