The Truth is in the Network: Reverse Engineering Application-Layer Protocols Via PCAP

Instructor - David Pearson

Pre-Requisites - Familiarity with a network packet capture and analysis tool—such as Wireshark—will provide a solid foundation on which to build. In addition, a basic understanding of lua scripts will be beneficial.

Abstract - Reverse engineering has become an increasingly important element of network security. The ability to break a system down in order to understand its base components and how they interact is critical to understanding not just how the system works, but the ways it can leave your network vulnerable. This is especially true at the application level, where insecure or poorly managed applications can leak sensitive data. In this hands-on workshop, attendees will learn how to reverse engineer real application-layer protocols. During our time together, we'll start at the surface and do a deep technical dive into the network traffic of a common remote access application. Along the way, we'll:

1. Introduce protocol reverse engineering and explain its importance
2. Learn how to discover structured data
3. Determine if data is encoded or encrypted
4. Understand how various protocols interact
5. Uncover secondary communications and information leaks in a hands-on fashion

All materials and content are freely available at https://dl.awakesecurity.com/defcon/nw_re_tools/resources.html and will remain so.

Required Materials - Students will need a laptop with Wireshark installed and access to the Internet. An IDE of choice is also recommended.