Category: Delhi

Combined null/OWASP Delhi November Monthly Meet – 22nd November, 2014 (Saturday) – 04:00 PM IST

When: 22nd November, 2014 (Saturday) – 04:00 PM IST
Where: Adobe Systems
I-1A, City Center, Sector-25A,
Noida – 201301

Nearest Landmark: 200 meters ahead of Spice Mall

How to Reach Venue: 3 KMs from Noida Sector-18 Metro station. Rickshaw from there should cost ~50 rupees

Nearest Metro Stations:
1. Noida Sector 18
2. Noida City Center

Google Maps – http://goo.gl/13WyMa

Note – null meets are free and open to everyone. Prior registrations are mandatory in order to be allowed to attend the meet.

Please RSVP/register here
http://swachalit.null.co.in/events/45-delhi-null-delhi-meet-22-november-2014-combined-null-owasp-delhi-meet

Session Details/Agenda:

4:00 PM – 4:15 PM: Introductions
4:15 PM – 4:30 PM: News Bytes
4:30 PM – 5:30 PM: iOS Security Implementations by Shobhit
Abstract: The presentation would focus on the security features provided by the operating system platform

5:30 PM – 5:45 PM: Tea/Coffee/Networking Break
5:45 PM – 6:45 PM: LAMP Security CTF 6 walk through using OWASP Mantra by Abhi M Balakrishnan

  • Introduction to the OWASP Mantra project
  • Introduction to LAMP Security project
  • LAMP Security CTF 6 walk through using OWASP Mantra
  • Open discussion and coverage of other useful tools and methods

How to become a Millionaire using OWASP Mantra

About OWASP Mantra – OWASP Mantra is a free and open source security tool-kit with a collection of add-ons and scripts based on Firefox.

About LAMP Security – LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach linux,apache,php and mysql security

6:45 PM – 7:00 PM: Feedback and Topic Discussion for Next Mont

In case of any queries or issues please feel free to reach out to the chapter leaders

null Delhi Humla on Malware Techniques Demystified |28th September, 2014

Humla Title – Malware Techniques Demystified

Humla Champion – Adhokshaj Mishra

When – 28th September, 2014 (Sunday) | 10:00 AM IST – 06:00 PM IST (including breaks)

Registration Link – http://swachalit.null.co.in/events/29-delhi-null-delhi-humla-28-september-2014-malware-techniques-demystified/event_registrations/new
Registration Form – http://bit.ly/WYhajI

Note – This is a free but an invite only event. If you are selected you will receive venue and other information via e-mail. (Laptop is mandatory for participation)

About Humla Champion – Adhokshaj Mishra is a hobbyist programmer with some interest in infosec domain. He mostly codes in C, C++, C#, VB .NET and assembly language. His primary domains of interest are cryptography, virology, cryptovirology, kleptography and mutation. He has worked as cyber crime investigator, and trainer of cyber crime investigation for Special Task Force, UP Police. He has also taught hacking (specially malware stuff) in various indian and overseas locations. He can be reached at Facebook (AdhokshajMishra), and Twitter (@adhokshajmishra). He blogs at http://adhokshajmishraonline.in

Details – The workshop is basically about various tactics that are used by malware authors, and how to detect them. All the topics will contain a small proof of concept to reinforce the theory. The following topics will be covered:

1) Monitoring the keyboard and mouse
2) Intro to DLLs
3) DLL Injection Techniques
4) Native Code Injection
5) Anti-Debugging Techniques
6) Anti-Disassembly Techniques
7) Hooking function calls (pre-hooking, post hooking, replacement,parameter poisoning etc)

Prerequisites

Knowledge: Fundamentals of C and C++, structures, classes, pointers, data structures, function pointers
Hardware: Any dual core machine with 4 GB RAM, minimum 20 GB free space.
Software: Windows 7 x64 (some techniques won’t work on 32 bit OS), Visual Studio 2012, Debugging Tools for Windows, Driver Dev Kit for Windows 8, Windows 7 SDK

Note: If you are using Windows 8/8.1, make sure you install DDK and SDK for the same version. Windows 8 DDK is installed on Windows 7 as it integrates WinDBG with Visual Studio. If you are happy with WinDBG as standalone tool, you may use that.

If you prefer some other C/C++ toolchain, you may use that as long as you can tweak the instructions as per your installation.

Useful Links

Visual Studio: http://www.visualstudio.com (You may use Express edition which is available free of cost)
Debugging Tools for Windows: http://msdn.microsoft.com/en-in/library/windows/hardware/ff551063(v=vs.85).aspx
Driver Dev Kit: Same as above
Windows 7 SDK: Same as above

Please reach out to the chapter leaders for any queries

null and OWASP Delhi September Monthly Meet – 20th September, 2014 (Saturday) – 04:00 PM IST

When: September 20th, 2014 (Saturday), 4:00 PM IST

Where: Adobe Systems (Near Spice Mall)
I-1A, City Center, Sector-25A,
Noida – 201301

Google Maps: http://goo.gl/13WyMa
Landmark: 200 meters ahead of Spice Mall
How to Reach Venue: 3 KMs from Noida Sector-18 Metro station. Rickshaw from there should cost ~50 rupees

Note – null meets are free and open to everyone. Prior registrations are mandatory in order to be allowed to attend the meet.

Please RSVP/register here
http://swachalit.null.co.in/events/30-delhi-null-delhi-meet-20-september-2014-combined-null-delhi-owasp-delhi-monthly-meet

Session Details/Agenda:

4:00 PM – 4:15 PM: Introductions by null and OWASP Delhi Team
4:15 PM – 4:30 PM: News Bytes and What’s New by null and OWASP Delhi Team

4:30 PM – 5:15 PM: Detecting Reconnaissance through Packet Analysis by Shashank Nigam
Abstract: The talk would cover the following
– Discussion around the common Packet types (DNS, SMTP, ICMP etc) and their structure with help of wireshark logs.
– Reconnaissance techniques like various types of scans, OS identification, service fingerprinting techniques with live demos and captured packet logs.
– Analyze captured packet logs of wireshark to identify the various reconnaissance activities and attacks on a network.

About the Speaker: Shashank Nigam is a security consultant with Security Compass

5:15 PM – 5:30 PM: Tea/Coffee/Networking Break

5:30 PM – 6:00 PM: Introduction to OWASP CSRF Protector by Minhaz A V
Abstract: The presenter would cover the following as a part of his presentation –
– A quick introduction to the OWASP CSRF Protector
– Discussion and demonstration of how it has been created along with its features and capabilities
– Future plans of the project and Feedback
OWASP CSRF Protector Project is an effort by a group of developers in securing web applications against Cross Site Request Forgery, providing php library and an Apache Module (to be used differently) for easy mitigation.

About the Speaker: Minhaz is a 3rd year Computer Engineering Student, from Delhi Technological University. An open source enthusiast, contributor to OWASP (Phpsec & CSRF Protector project), PhpMyAdmin project & Mozilla foundation. Anything related to information security, javascript animations & SAAS are his area of interest.

6:00 PM – 6:45 PM: To be announced by Rishi Narang
Abstract: To be announced
About the Speaker: Rishi is a researcher, consultant and blogger who is passionate about every aspect of Cyber Security. He works as Lead consultant/researcher with Aujas Networks. He can be found blogging at http://www.wtfuzz.com/

6:45 PM – 7:00 PM: Feedback and Topic Discussion for Next Month by null and OWASP Delhi Team

In case of any queries or issues please feel free to reach out to the chapter leaders

null/OWASP Delhi August Monthly Meet – 31st August, 2014 (Sunday) – 04:00 PM IST

When: August 31, 2014 (Sunday), 4:00 PM to 07:00 PM IST

Venue: Adobe Systems(Near Spice Mall),
I-1A, City Center, Sector-25A, Noida – 201301
How to Reach: 3 KMs from Noida Sector-18 Metro station. Rickshaw from there should cost ~50 rupees.
Google Maps: Click here!

Note: RSVP/Registration is mandatory else Adobe Security Personnel won’t allow you in. Please do so here –
http://swachalit.null.co.in/events/24-delhi-null-delhi-meet-31-august-2014-combined-null-delhi-owasp-delhi-monthly-meet

Session Details/Agenda:

4:00 PM – 4:15 PM: Introductions by null and OWASP Delhi Team
4:15 PM – 4:30 PM: News Bytes and What’s New by null and OWASP Delhi Team
4:30 PM – 5:30 PM: All Your Slot-Tables are Belong to us by Shubham Mittal

Abstract:Shubham will talk about some of tools and tricks which he employed to compromise a network, including hundreds of Domain Accounts and a bunch of servers, in a recent pen-test he performed. His talk will include some of key points which he thinks, might come handy to anyone performing a network pen-test exercise.

About the Speaker: Shubham Mittal is an Information Security Researcher and an active member of null and OWASP community. He can be reached at upgoingstaar@gmail.com and @upgoingstar on Twitter

5:30 PM – 5:45 PM: Tea/Coffee/Networking Break
5:45 PM – 6:45 PM: Android Security & Pentesting 101 by Sunil Anand

Abstract: The presenter would cover the following as a part of his presentation –

  • Problem of security in smart phones.
  • How android handles security.
  • What are areas of interest from hackers perspective.
  • OWASP top 10 (Mobile).
  • Test process.
  • Tools and Technologies.
  • Upcoming trends in Android security.

About the Speaker:Sunil Anand is a Senior Solutions Architect at HCL Technologies and currently heading the application security practice. Sunil has the credit of starting application security practice and Secure SDLC within HCL technologies in the year 2008

6:45 PM – 7:00 PM: Feedback and Topic Discussion for Next Month by null and OWASP Delhi Team

Note: The Slide Decks of the presentations will be uploaded on this page after the meet

In case of any queries or issues please feel free to reach out to the chapter leaders

null Delhi June monthly meet – 28/June/2014 – Adobe (Noida) @ 04:00 PM IST

The null Delhi chapter monthly meet will be held on 28th June, 2014 (Saturday) @ 04:00 PM IST. We are pleased to host this month’s meet at a new venue – Adobe Systems (Noida)

Agenda:

04:00 PM – 04:20 PM Introductions and News Bytes

04:20 PM – 05:20 PMSecure Software Development in Agile

Abstract: Agile is an early feedback system. Cycles/sprints (in Scrum) are very short, usually no more than two to four weeks, and for this reason software development teams find it difficult (if not impossible) to comply with a heavy list of security assurance tasks. This problem was addressed by a SAFECode cross-org. practice paper which was led by Vishal. Presenter will be discussing security flaws and secure development practices in an actionable format for Agile software development.

Speaker: Vishal Asthana (in.linkedin.com/in/vishalasthana)

05:20 PM – 05:40 PMTea Break & Networking

05:40 PM – 06:00 PM Reverse Engineering CTF Walkthrough Session

Brief: Adwiteeya will be discussing the solutions to the Reverse Engineering CTF session held during our last month’s meet.

06:00 PM – 06:30 PMStop Pulling the Plug: Memory Forensics

Abstract: The presenter will be talking about Incident Response concepts and will be demonstrating a live case of memory forensics

Speaker: Kamal Rathaur (linkedin.com/pub/kamal-rathaur/19/a6/9a7)

06:30 PM – 06:45 PMFeedback and Topic Discussion for next month

Registration & Fees – All null meets are FREE for anyone to attend. Just come with an open mind and willingness to share and learn. Please fill the form on the below link to register for the meet.

Registration linkhttp://goo.gl/D4pgwO

Date and Time – 28th June, 2014 (Saturday) @ 04:00 PM (Please be on time)

Venue – Adobe Systems
I-1A, City Center, Sector -25A
Noida – 201301
Nearest metro station: Noida Sector-18
Google Maps: http://bit.ly/Tri3Qy

For any queries, please contact the chapter leaders:

Vishal – vast_at_null_dot_co_in
Sandeep – san_at_null_dot_co_in
Vaibhav – reverser_at_null_dot_co_in

[null] [Delhi] Learn to CTF – Part I (Reverse Engineering Challenge) / 31st May, 2014 (Sat) / TLabs, Noida

Announcing the first part of the “Learn to CTF” program at null Delhi on Reverse Engineering. Participants will be presented with a basic to intermediate level of challenge on reverse engineering which they will have to solve within the specified time frame (3-4 Hours) at venue itself. The participants can team up with several other participants or can solve it individually. They can also seek assistance from the event mods present at the venue in order to move up the ladder.

The idea behind this session is to prepare participants for advanced capture the flag (CTF) challenges and is specially designed for those who have never taken part in any CTF contest or find it difficult to play CTFs.

Note – The next part of this program will address the detailed walk through of the challenge and the strategies and techniques that can be used to solve these types of challenges

“Learn to CTF” – Part I challenge is designed by one of our volunteers Adwiteeya Agrawal.

Registration & Fees – As always this event is FREE for anyone to attend and is conducted as a part of knowledge sharing initiatives. Just come with an open mind with willingness to learn. Please register on the below link to book your place

https://docs.google.com/spreadsheet/viewform?formkey=dDV4NllSV01RQmlQVXRoc3Ixd3NPQWc6MA

Note – The entry is strictly restricted to registered participants only so please register for at the earliest and reserve your place.

Date & Time: 31st May (Saturday), 2014 – 01:00 PM IST – 04:00 PM IST

Venue: Times Internet Limited (Inside Times of India Office)
Tlabs, First floor, FC-6,
Sector 16A, Film City, Noida
(Next to huge Shiv Murti)
Close to Noida Sector 18 Metro Station

Rewards: The rewards for completing the challenge successfully will be announced at the venue itself

Mandatory Tools & Plugins
1.) A debugger loaded with your favorite plugins. (example – Olly)
2.) An IDE for writing code (optional) (example – CodeBlocks)
3.) Intel x86 Instruction reference (Olly Plugin – http://www.thelegendofrandom.com/files/Olly_Plugins/MnemonicHelp_v1.1.rar)
4.) Decompilers (example – dotpeek, jd-gui, uncompyle, p32dasm)
5.) Hex Editor (example – hex workshop)
6.) Disassembler (IDA, Olly)
7.) File Analyzer

Useful Links:
http://thelegendofrandom.com/blog/sample-page
https://tuts4you.com/download.php?list.17
http://thelegendofrandom.com/blog/archives/2100

Know more about the idea behind “Learn to CTF” – http://null.co.in/2014/05/04/the-idea-behind-learn-to-ctf-null-delhi/

In case of any queries reach out to us

Vaibhav – reverser_at_null_dot_co_in
Sandeep – san_at_null_dot_co_in
Vishal – vast_at_null_dot_co_in

null Delhi March, 2014 Meet: 22/March/2014 (Saturday) @ Tlabs, Noida

Hello Folks,

Announcing the null Delhi chapter monthly meet for the month March 2014 on 22nd March, 2014 (Saturday) @ 03:00 PM IST

Registration & Fees: All null meets are FREE for anyone to attend. Just come with an open mind and willingness to share and learn. Please fill the form on the below link to register for the meet:

Registration link: https://docs.google.com/spreadsheet/viewform?formkey=dGJWdHlra2k1clhud0xOaFBWdFU2UlE6MQ

Note: Please register only if you are willing to attend the meet as we have to plan our limited resources accordingly.

Agenda

03:00 PM – 03:15 PM : News Bytes by null Team

03:15 PM – 03:30 PM : Introductions & General Discussion

03:30 PM – 04:15 PM : Bluetooth Hacking by Rajeev Chauhan

The session would briefly touch upon the following
Bluetooth Protocol Basics
Pairing
Step by Step approach of Bluetooth Hacking
Blue Jacking
Blue Snarfing
Countermeasures to protect Bluetooth Hacking

04:15 PM – 04:30 PM : Tea & Networking Break

04:30 PM – 05:15 PM : To CTF or Not? By Vishal

We are planning to host a CTF event in the upcoming chapter meet. This session would be to gauge the interest and knowledge level of the attendees and use the data gathered to prepare a suitable CTF session in accordance. We would also discuss infrastructure related pre-reqs such as connectivity, laptop availability, etc

05:15 PM – 06:00 PM : Legal Discussions by null Team

We have recently identified the need to discuss legal topics as well along with technical discussions. This month we would be focussing on different laws pertaining to the Information Security domain in India and the rest of the world. We would also try to draw a comparison between laws in several countries related hacking and security. The session would also include some case studies from the past and will try to create awareness among attendees about the various aspects of Laws.

06:00 PM – 06:30 PM: Topic Discussion for next month and Feedbacks

Meet Details

Date and Time: 22nd March, 2014 (Saturday) @ 03:00 PM IST (Please be on time)

Venue: Times Internet Limited (Inside Times of India Office)
Tlabs, First floor, FC-6,
Sector 16A, Film City, Noida
(Next to huge Shiv Murti)
Close to Noida Sector 18 Metro Station
Google Maps: Click here!

At the reception, just tell them you want to go to Tlabs office. Please get in touch with the chapter leads in case of any doubts.

Sandeep Singh
8587098100

Vaibhav Gupta
9811747801

Vishal Asthana
9711990988

See you there \m/

null Delhi chapter February meet: 22/February/2014 (Saturday) @ Tlabs, Noida

Hello Folks,

Announcing the null Delhi chapter monthly meet for the month February 2014 on 22nd February, 2014 (Saturday) @ 02:00 PM IST

Registration & Fees: All null meets are FREE for anyone to attend. Just come with an open mind and willingness to share and learn. Please fill the form on the below link to register for the meet:

Registration link: https://docs.google.com/a/null.co.in/spreadsheet/viewform?formkey=dGJWdHlra2k1clhud0xOaFBWdFU2UlE6MQ

Note: Please register only if you are willing to attend the meet as we have to plan our limited resources accordingly.

Agenda

02:00 PM – 02:15 PM : News Bytes by null Team
02:15 PM – 03:30 PM : Introductions & General Discussion

02:30 PM – 04:00 PM : Puliya Workshop – Before a Reverse Engineer is Born by Adwiteeya and Vaibhav

null Puliya is by theme a kind of workshop designed to bridge the skill gap and get our members ready to take on advanced topics covered in null Humla and null Bachaav. This Puliya session on “Before a Reverse Engineer is Born” is to bridge the gap in our members before we conduct an advanced series of null Humla workshops on Reverse Engineering in the upcoming months.

The puliya session would make you aware of
• What is Reverse Engineering
• Concepts of Security Related Reverse Engineering & Reversing in SW Development
• Binaries and Hexes
• Low Level Software (Assembly Language, Compilers, VMs & Bytecodes, OS)
• Are High Level Languages (C, C++, Java, etc.) necessary to lean Reverse Engineering?
• Assembly 101
• Windows Fundamentals
• The Tools (Disassemblers, Debuggers, Decompilers)

Contact the Presenters – Adwiteeya (adwiteeyaagrawal_at_gmail.com)
Vaibhav (reverser_at_null.co.in)

04:00 PM – 04:15 PM : Tea & Networking Break

04:15 PM – 04:45 PM : LoD (Line of Disaster) by Sandeep and Vishal

This is a session in which we will try to highlight what happens when a hacker crosses his/her line. The session would include some recent case studies on arrests followed by some interesting laws around the globe and their implications. The content would be supported by some neurobiology research all over the world on what ticks a hacker to cross their lines. How teens think and act especially according to risk, safety, trust, fraud, and manipulation. We would conclude with some guidelines and best practices to be followed for young professionals when playing with serious stuffs.

Contact the Presenters – Sandeep (san_at_null.co.in)
Vishal (asthana.vishal_at_gmail.com)

04:45 PM – 05:15 PM : The Nirvana @ Goa by null Team

This would be a session which would be a virtual tour of the nullcon V @ Goa which happened from 12th February, 2014 – 15th February, 2014. The attendees would share their experiences and learnings. We would have the best of the learnings and hacks shown there being detailed by the attendees from the Delhi chapter.

05:15 PM – 05:30 PM: nullcon 2014 CTF Discussion/Topic Discussion for next month and Feedbacks

Meet Details

Date and Time: 22nd February, 2014 (Saturday) @ 02:00 PM IST (Please be on time)

Venue: Times Internet Limited (Inside Times of India Office)
Tlabs, First floor, FC-6,
Sector 16A, Film City, Noida
(Next to huge Shiv Murti)
Close to Noida Sector 18 Metro Station
Google Maps: Click here!

At the reception, just tell them you want to go to Tlabs office. Please get in touch with the chapter leads in case of any doubts.

Sandeep Singh
8587098100

Vaibhav Gupta
9811747801

See you there \m/

null Delhi special meet with Joerg Simon

Author: Sandeep Singh

Delhi – The Second Adventure


Joerg Simon was back in Delhi on 27th July (Saturday) which he named his second adventure after a gap of 10 months. The last time he was in Delhi was for NullCon Delhi, 2012 with his talk on Fedora Security lab, OSSTMM. He could not complete his talk last time because he messed up his own time. It was a wonderful opportunity for everyone to meet to meet him personally and share and learn things about Open Source Security.

Joerg Simon is one of the famous names in Open Source Security Testing Industry and not to forget a key member of the Fedora project. He is running and working on some really wonderful projects under the Fedora project and also some other Open Source institutions like ISECOM.

The talk that Joerg was supposed to deliver was a mix and perfect blend of numerous topics (Open Source Security Testing Methodology Manual – OSSTMM Content including RAV and Trust verification, Fedora Security Lab, OSSTMM lab and the Fedora Security Lab Test Bench). I would call it a perfect talk on Open Source Security Testing methods which breaks the conventional way of thinking security. Joerg was accompanied by Fabian Affolter from Berne/Switzerland who was a FAmSCo member in the past and maintainer of the Fedora Security Lab Test Bench.

It was a complete theoretical talk with almost no hands on but it could not have been more interesting. The way it was started and brought to an end by Joerg was completely beyond everyone’s expectations. He did a perfect start by understanding the audience profile and then paced his presentation exactly the way audience could have wanted it to be. Started with introduction to ISECOM, Hackers High School and OSSTMM he explained the differences between OSSTMM and other security testing methodologies which makes OSSTMM a truly next generation security testing framework. The explanation given by him for making people understand the issues with current security solutions and security testing methods specially keeping compliance in mind was excellent and filled the audience with enthusiasm to know more about the upcoming topics. Security is all about common sense and that was demonstrated brilliantly by Joerg Simon from his test cases and examples from movie clips that he showed.

Joerg had plenty of time with him so he explained well the 4PP (Four Point Process) defined in OSSTMM and the attack surface/porosity along with the controls defined in OSSTMM. The 4PP (4 Point Process) was supported with the meaningful use of tools such as theharvester, googledorks, Maltego and XSS techniques as well. The session was followed by short tea break which is the blood of any null meet with the chit chat and the networking.

After the tea break he demonstrated an example of security test using the OSSTMM methods and also shared a test report which was in German but explained in English which was carried out on the basis of same OSSTMM methods. I personally liked the Rav Measurement (The Rav is a scale measurement of an attack surface and the amount of uncontrolled interactions with a target) and the Trust Analysis demonstrated by Joerg.  The ball was passed to Fabian in the end to elaborate the Fedora Security Lab Test Bench. In the end Joerg had some Fedora goodies to distribute and network with people around.

The main attraction of the talk was active discussions in the mid of the talk on privacy and surveillance these days. Joerg had his views and so everyone else which formed a healthy discussion.

Now the time has come to big well deserving gratitude to the speakers (Joerg Simon and Fabian Affolter) and the participants (I know it’s not easy to wake up early on a Saturday morning after a tiring week).

I would like to convey my special thanks to TLabs and Arpit who always makes any kind of event possible at their venue. Tlabs have always been the best in hosting any null event. A big thanks again.

Post Meet

After a long session and chit chats after the session we were planning to head towards our homes but as it was 3 in the afternoon so everyone planned for a lunch but as I was wide awake since past 48 hours due to my never ending works, I decided to go home and Joerg, Fabian, Sandeep (another Fedora contributor) and one more person with them whose name I cannot gather along with Antriksh headed for a Saturday lunch to a nearby mall. Vaibhav who is my friend and co-mod of null Delhi is packed up these days with some sort of exam labs so he also headed towards his home and we came to an end of an awesome experience of a special meet with Joerg and Fabian.