I have not been here for a while. But I dont know any other place this would be apt.

Blackhat server is down and I need a copy of "Practical Malware Analysis" pdf for doing a paper.
http://www.blackhat.com/presentations/bh-dc-07/Kendall_McMillan/Paper/bh-dc-07-Kendall_McMillan-WP.pdf
I was wondering if anyone had a local copy it would be great if you could share. If you can think of any other alternatives, let me know.

This thread is definitely going to be help me as I am teaching myself RE for CREA. I will document my journey once I complete the certification.

Thanks sil.

thanks for pointing out sil... i edited it ...sorry satyr... i meant malware analysis and i really wanted someone to prove me wrong. I dont think packers/protectors are involved in exploit development anywhere except may be in writing shellcodes(encoding, polymorphic)...

I dont know what nelly is(Life; Unmanly, effeminate) ? ..

P.S: Wanted to say this for a long time. Big fan of your long posts sil.  I read ALL your previous posts before even joining the forum and one of the reasons I am still trying to contribute to this forum is because of guys like you taking time to write such awesome posts.

Exploit development and Malware analysis are quiet different topics and each requires its own steep learning curve. At advanced levels both requires to have a good knowledge in reverse engineering and os internals. There are several overlapping topics and few topics like Packers, protectors, anti-reversing techniques are discussed only in malware analysis. In my opinion, its better to start with the exploit development.

I would suggest you to start with the first link in previous post on x86 disassembly. Its packed with a lot of examples and is very newbie friendly. Then move on to reading PVE buffer overflow tutorials. Beware of PVE tutorials, if you dont know the role of function epilogue and function prologue and still did a stack overflow, you have not yet understood it. When you read ret to libc , ROP should be obvious to you, if not, you have not understood it. But that sort of understanding and ability to visualize the stack can be attained only if you have strong hold on the basics. So start with x86 disassembly or atleast read on different calling conventions before jumping into Aleph one's post.

Once you are done with pve's tutorials and comfortable with the debugger,  try heap spraying, heap feng shui(requires knowledge in OS internals) and then move onto reverse engineering following lena's tutorials. Again the basics are important, you should know the PE file format, memory management. This is based on my experience and hope this works for you.

http://en.wikibooks.org/wiki/X86_Disassembly
http://www.microsoft.com/msj/0298/hood0298.aspx

That should probably get you going.. Also try to answer H1t M0nk3y's questions as we can probably guide you better if we know your goals..

The reason I mentioned the conflict, is that, the original poster might be interested in researching and extending the techniques used to detecting the presence of a VM from OS level to the network level.

I knew network latency is not the only thing that is going to hamper the technique thats why I blew my own theory in the post. I just wanted to point out something that can be extended. For instance, what If there is a behavior in a particular VM package that takes notably long time to respond to a specially crafted packet but the delay is not good enough for a detection technique because of other factors like network latency..

Every detection mechanism has a reliability factor (OS detection, service detection etc). If someone is determined to protect the identity of OS/Service from popular tools he/she can. Neither detection nor protecting from detection is 100% possible. Is there a reliable way to determine the OS in a network 100% of the time? No not possible. I was going for something thats detects a VM in a network starting from a theoretical point of view and then that can be practically extended.

I am not proposing a solution, I am pointing to something that can be researched and extended.

Joanna's blue pill and the conflict that rose among security researchers should be noted here.

This sums it up - http://www.zdnet.com/blog/ou/detecting-the-blue-pill-hypervisor-rootkit-is-possible-but-not-trivial/297.

When detecting that your program is running on a VM or not from within a VM is a difficult task, I guess determining a remote system is running under a VM or not, is not entirely out of the plate. One of the common techniques used is timing delay in the response of the OS as it is running on a VM. But adding it up with network latency, the reliability of the technique significantly reduces. I bet a project like that could sure make it to the blackhat conference.

It takes courage and very high self confidence to share failures H1t M0nk3y.  Go on. You will rock.

http://www.exploit-db.com/exploits/7444/

- This is the vulnerability being exploited.

openssl?

Neither of them offers lessons on reversing patches to find vulnerabilities which sans 710 does. Nevertheless they look like excellent courses on exploit development.

There are plenty of reverse shell scripts written in php available online to achieve this task. I dont think you need a link to one 

San 710 - seems to be 2 day course opposed to sans 709 - a 5 day elaborate course on exploit development.
If you are new to exploit development you should start with 709 and move onto 710. sans 710 assumes knowledge of exploit development and teaches reversing microsoft patches and finding undisclosed vulnerabilities which I dont think any other course in the industry offers.

Yes and No. If it steps down to HTTP and pass the cookies in HTTP,  its still vulnerable to session hijacking. For instance, you might think that static images does not require HTTPS, but the request to static images will still contain the cookie header and if it is transmitted in HTTP, then it is vulnerable to session hijacking.

Yes, there are sites that goes between HTTP and HTTPS.


Yes.

 
God bless the forum with newbies or else there is gonna be blood ridiculous topics everywhere.. This should be fun to watch.