Nicky's Journal

Tuesday Oct 2

Took the bus and metro to work
worked
at lunch took stuff to post office
worked
took the metro to the airport
flight delayed, got in later than planned which sucked and i was exhausted and confused and cranky
luckily partner got my badge

mom called and told me i needed to quit and come home and help

Wednesday Oct 3

Class like 8am to 5pm
I did NOT get enough sleep
got starbucks oatmeal and chai for breakfast

We got morning coffee break and afternoon snack break, coffee break ran out of black tea day 1 before i got any and continued that trend :(

Lunch was potbelly
i quit during lunch from work
Dinner was #HackerFoodies (hackerfoodies.com)- Against the Grain

Hung out at Sway in the Hyatt (eveent moved to mariott but they were slow and grumpy and loud so many peeps stuck to hyatt, i even stayed at hyatt still)

Class info below

Application Security: For Hackers and Developers
Course name: Application Security: For Hackers and Developers

Trainer name(s): Michael Fowl and Greg Hatcher (VDA Labs)

Course description: Application Security: for Hackers and Developers, is designed for practitioners to learn about the tools and techniques used to prevent and find bugs in real world software. This class is great for anyone in software, testing, management, hacking/vulnerability research, and so much more.

We begin the class with a brief secure-by-design and strategy session. Next, understanding how and when to audit code is key for both developers and hackers. Students learn to zero in on the important components. Automated tools are employed, but auditing source manually is the key, since verifying results is a required skill even when using automated tools. Spotting and fixing bugs is the focus.

Dynamic investigation of web, mobile, and APIs requires skills with tools like burp. While hunters for bugs in core code (C/C++), often use fuzzing: a runtime method for weeding out or finding exploitable bugs. Both techniques are used by a growing number of product and security organizations.

Another technique hackers use to uncover bugs is reverse software. Managed (.net) and unmanaged code (C and C++) are covered. The IDA pro tool is taught and used throughout. Other tools like Binary Ninja are shown as well. Calling conventions, Assembly-to-C, identifying and creating structures, RTTI reconstruction, etc. are covered. Students will see IDA’s more advanced features such as flirt/flare, scripting, and plug-ins.

Finally, students will walk out of this class knowing how to exploit discovered bugs. This is useful to both developers and hackers. The attack portion will teach students how to exploit common bugs such as: command injection, SQLi, IDOR, stack buffer overflows, function pointer overwrite, heap overflow, off-by-one, integer error, uninitialized variable, use-after-free, double fetch, and more. For the exploits, return overwrites, heap spraying, ROP, and gadget discovery are presented. Shellcode creation/pitfalls and other tips and tricks will all be rolled into the exciting, final component.

Course outline:

Day 1: Managed, C/C++, and Fuzzing

8am – 8:30am

Handout Material

Pass around Thumb drives for VM Setup
8:30am – 10am

Part 1 – Managed Code/Web Vulns

Lecture 1: SDL and Product Security Testing

Lab 1 – iSpyCentral Architecture Review and Reversing
Lab 2 – iSpyCentral Key Exploit
Lab 3 – SAST iSpy
10am – 10:15am

Break 1

10:15am – 12pm

Continue working on first 5 labs

Lab 4 – DAST iSpy
Lab 5 – iSpyCentral RCE
12pm – 1pm

Lunch

1pm – 3pm

Part 2 – Unmanaged/Native Code Vulnerabilities

Lecture 2: Auditing C and C++

Lab 6 – Basic C Bugs
Lab 7 – UV Investigation
Lab 8 – Warm up with C++
Lab 9 – Basic C++ Bugs
3pm – 3:15pm

Break 2

3:15pm – 5pm

Lecture 3: Fuzzing

Pydbg Demo
Lab 10 – Peach fuzzer (file fuzzing)
Lab 11 – In-memory fuzzing
Day 2: Finish Fuzzing, Reversing, and Native Exploits

8am – 8:30am

Work on anything from yesterday

Ask questions about specific things

8:30am – 10am

Lecture 3: Continue Fuzzing

Lab 12 – AFL
Lecture 4: Reversing C and C++

Lab 13 – Easy Crackme
10am – 10:15am

Break 1

10:15am – 12pm

Keep Reversing

Lab 14 – Med Crackme
Lab 15 – Patcher
Lab 16 – C++
12pm – 1pm

Lunch

1pm – 3pm

Last Reversing Lab

Lab 17 – Scripting
Lecture 5: Exploiting Native Programs

Lab 18 – Function Pointer Overwrite
3pm – 3:15pm

Break 2

3:15pm – 5pm

Lab 19 – Windows Server Exploit
Lab 20 – ROP
Student Requirements:

Students are required to provide a laptop for the course. Your laptop should have at least 30GB of free HD space, 4GB+ of RAM and VMware workstation/player for Windows or Fusion for the Mac installed ahead of time.
You will be given a Windows VM. Copy to your hard drive, and pass the portable Media to your neighbor. You will need a USB port and an OS that can read ExFat FileSystem to copy the data. (Most Mac and Windows have that, but with Linux, check for the driver) You may not share course media with non-students.

9/20

tried to call UoT, Thursday from airport right before they closed no luck, try again Monday

9/21

Vanguard Got generic letter and statements from website

Capital One got generic letter and statements from website

Marcus and TD got statements and sent


9/24

Called U of T and they confirmed getting my transcript and diplomas, and that I had nothing else to mail them.

To Do

Marcus Goldman Sachs, and TD Bank letters on the way, scan on arrival

Get September statements 4 banks

digital picture

Proof of relationship ?

current employer employment verification

9/18
CELPIP scores arrived

9/19
Eye doctor will fax supporting document

tried to call UoT, closed, will try Thursday while at airport

Marcus Goldman Sachs, and TD Bank letters on the way

scanned supporting aramark documents, as many as i could, i hope it is enough

scanned diplomas

to do

vanguard letter

capital one letter

6 months statements marcus
6 months statements TD bank
6 months statements vanguard
6 months statements capital one

digital picture

Proof of relationship - TBD

current employer employment verification

Q9
What is a fear that you have and how has it limited you? How do you plan on letting it go or overcoming it in the coming year?

A
Fear of change, risk, the unknown. I seem to deal with it by waiting until I reach my breaking point and then burning everything down because there is not a choice.
This year I am stopping before my breaking point and trying a new country, with a lot of unknown. We will see how it goes.

9/10
Showed up to identigo to get finger prints taken
may have gotten double charged ($25)
they electronically scanned and provided 2 fingerprint cards
i mailed priority mail to the FBI with the email from my online request USPS $7

9/17

got my FBI report electronically (download from website using PIN) and forwarded to my visa source

Q7
How would you like to improve yourself and your life next year? Is there a piece of advice or counsel you received in the past year that could guide you?

A
I want to get back to exercising more regularly.
I want to relearn Ms SQL DBA, Microsoft systems administration, and learn for the first time Linux systems administration.
I would like to be settled in with my primary partner and building a life that I hopefully won't burn down and start over, again.
Perhaps aquesing to my mother's mantra of is it going to kill you? No? Try it.

Q5
Have you had any particularly spiritual experiences this past year? How has this experience affected you? "Spiritual" can be broadly defined to include secular spiritual experiences: artistic, cultural, and so forth.

A
Not really.

Perhaps the closest was attending gencon.
Although it was my first time, it felt like home. Gaming conventions are my people.

Also I pushed boundaries I did not think we're negotiable. It shows perhaps I am not who I think I am. Or perhaps I am not as strong as I thought I was.

Q3 Think about a major milestone that happened with your family this past year. How has this affected you? A We disconnected from a lot of my father's family this year. It was sad to lose more family. We were not particularly close before but still sad. My sister's illness has gotten much more dibilitating it's hard to watch and I am not sure how to help or what to do. My parents are stressed, understandably. Not sure I can handle it either. A family member we adopted, is losing the battle to cancer, she is on pallative care now. That's tough as well.

Q1
Describe a significant experience that has happened in the past year. How did it affect you? Are you grateful? Relieved? Resentful? Inspired?

A
I went to DragonCon
I went to katsucon
I went to gencon

I enjoyed them all, but dragon Con twas too big perhaps? And too social and party. I preferred gencon.

I broke up with two partners, one of which I thought was going to lead to marriage. I was frustrated and disappointed, but I think I am over it now.

I evolved two of my relationships. One friend with benefits became a primary to our surprise. One became a secondary.

There was a being dumped and getting back together with the primary which really pushed us to better define what we wanted and what we were.

I moved to Nova. It is lovely but it isn't where family is, and my primary isn't here.

I sold my house in Blacksburg. It was bittersweet even though that was the plan from the start.

I have lost my friends from Blacksburg mostly which makes me sad.

I started the process of moving to Canada as a permanent resident.

Francis is dying.

My sister is falling apart.

I closed my tea company
I started working for Geico
I left my job at Rackspace

I went to ghc for the first time. It was amazing to go-to a technology conference that was mostly women. It's where I got the job offer from GEICO.

I was a speaker at an information security conference for the first (bsideslv) and second (the Diana initiative) time

Had to put down Chester, he was so stoic. Slack's and he never did get along. He never did make it to Nova, probably for the best.

Visited San Diego again, but this time ended up evolving the friendship I went for into a partner.

Had a lovely vacation in la where friends became partners.

Williamsburg, or was that last year?

Having to move again. Everything is going in storage and I am going to Canada after a stay over in Philly.

Had my first colonoscopy, they did find things, we did decided I didn't have hemerroids or diverticulitis.

Purchased a new car, Subaru Forester. I hate car buying. I miss my Civic but needed the space and it will import into Canada easily.

Finally got to stay at the library hotel in NYC.

Finally got threader earrings. Hopefully I can keep my holes from closing.

Had accupuncture for the first time. It has been helpful.

Finally started having my wrist treated.

Found out how much stress made me ill as many of my health issues, but not all, ended when iquit my job.

I am... Unsure how I feel about the last year. I guess I am thankful it went as well as it did, even with the sad moments.

I realized how accustomed to remote and flexible with I have become, and that it is no longer optional or a nice to have for me.

Today was the medical at 7am

the office it seems she also does cosmetics

Bring to health exam - 3 passport photos
$28+
Because CVS only sells it in sets of 2, I asked about getting 3, but instead had to buy 2 sets of 2 *sigh*
THEN they only used 2 and gave me back the other 2, WTF

i got a bunch of paperwork when i came in, luckily i had my printed medical stuff as usual. i need to work with mom to get that updated.

i had to do a blood test and a urine test, i hate urine tests i don't have enough hands to comply with what they want - spread your labia, get the pee mid stream not start or end, don't touch the inside of the cup or let the cup touch your skin. like i need at least one more hand to hold the lid or something dunno, just me?

1 hour drive each way was gone 6am-10:30am
then a pretty comprehensive exam
$330
She really dug into asking "why" on my glaucoma and was aggravated i couldn't answer her
she also/the exam was also super focused on TB
She demanded a statement fro my eye doctor so I have to go do that, luckily i have an appointment on the 10th
then i had to go to a second facility for a chest xray
$46

the report goes direct to immigration so i guess i don't find out until i get accepted or rejected.