BruCON 2023 Training

Immerse yourself into the world of security by attending the BruCON Training ! BruCON offers world-class, deep-technical training given by the most recognised experts with huge industry experience in their domain. We want to offer courses for anybody interesting in security, ranging from novice to advanced and for red and blue teams !

Spring Training

BruCON 0x0F Spring Training will take place between the 19th until 21st of April 2023. Depending on the courses these will be hosted virtually or will be hosted at the Novotel Mechelen Centre (here) on the same dates.

NOTE : 2-day courses start on the 20th of April

Description: The Corelan “BOOTCAMP” is a truly unique opportunity to learn both basic & advanced techniques from an experienced exploit developer. During these 3 “long” days, students will be able to learn all ins and outs about writing reliable stack based exploits for the Windows platform.  The trainer will share his “notes from the field” and various tips & tricks to become more effective at writing exploits. We believe it is important to start the course by explaining the basics of stack buffer overflows and exploit writing, but this is most certainly not “your average” entry level course. In fact, this is a true bootcamp and one of the finest and most advanced courses you will find on Win32 stack based exploit development.

Instructor: Peter Van Eeckhoutte

Duration: 3-day course

Read More

Description: More than 95% of Fortune 500 companies use Active Directory! Enterprises are managed using Active Directory (AD) and it often forms the backbone of the complete enterprise network. Therefore, to secure an enterprise from an adversary, it is inevitable to secure its AD environment. To secure AD, you must understand different techniques and attacks used by adversaries against it. Often burdened with maintaining backward compatibility and interoperability with a variety of products, AD environments lack ability to tackle latest threats.

This training is aimed towards attacking modern AD Environment using built-in tools and trusted OS resources. The training is based on real world penetration tests and Red Team engagements for highly secured environments.

Instructor: Nikhil Mittal

Duration: 3-day

Read More

Description: This course is a 100% hands-on deep dive into the OWASP Security Testing Guide and relevant items of the OWASP Application Security Verification Standard (ASVS), so this course covers and goes beyond the OWASP Top Ten.

Long are the days since web servers were run by perl scripts and desktop apps written in Delphi. What is common between Walmart, eBay, PayPal, Microsoft, LinkedIn, Google and Netflix? They all use Node.js: JavaScript on the server. What is common between Microsoft Teams, Skype, Bitwarden, Slack and Discord? All of them are written in Electron: JavaScript on the client.

Modern Web and Desktop apps share traditional attack vectors and also introduce new opportunities to threat actors. This course will teach you how to review modern web and desktop apps, showcasing Node.js and Electron but using techniques that will also work against any other web or desktop app platform. Ideal for Penetration Testers, Web and Desktop app Developers as well as everybody interested in JavaScript/Node.js/Electron app security.

Instructor: Abraham Aranguren

Duration: 3-day

Read More

Description: This hands-on CTF-style training focuses on elevating your security knowledge into the cloud. Learn to defend your AWS & Azure cloud infrastructure by building automated detection, alerting and response pipelines for your  workloads by using native cloud services. This training focuses on building  security knowledge on the cloud and for the cloud.

This training takes both  investigator and builder approach towards security. It teaches you the fundamentals of cloud infrastructure security and focuses on building highly scalable threat detection, monitoring, and response tools by  using cloud-native services like serverless, containers, object stores, IAM/AD,  logic apps, SQL/KQL queries and much more.

Instructor: Abhinav Singh

Duration: 3-day

Read More

Description: Updated for 2023, our immersive 2-day Defending Enterprises training is the natural counterpart to  our popular Hacking Enterprises course.  You’ll play a SOC analyst in our Microsoft Sentinel cloud-based lab and try to rapidly locate IOA’s and  IOC’s from a live enterprise breach executed by the trainers in real time.

Whether you’re new to Kusto Query Language (KQL) or a seasoned pro, there’s plenty for you in the  2-days! Yes, we’re using Microsoft Sentinel, but the underlying threat detection theory, logic and  threat hunting approach is transferable into your own environments, whatever your preferred  platform.

We look at the top 10+ methods we use in offensive engagements and show how these can be  caught, along with numerous other examples and methods that go above and beyond these common TTPs!

Instructor: Owen Shearing / Will Hunt

Duration: 2-day (Starting Thursday 20th of April)

Read More

Description: Fuzzing is a technique of identifying software vulnerabilities by automated corpus generation. It has produced immense results and attracted a lot of visibility from security researchers and professionals in the industry, today fuzzing can be utilized in various ways which can be incorporated into your secure SDLC to discover vulnerabilities in advance and fix them.

Finding vulnerabilities in software requires in-depth knowledge of different technology stacks. Modern day software’s have a huge codebase and may contain vulnerabilities. Manually verifying such vulnerabilities is a tedious task and may not be possible in all cases. This training is designed in such a way that it introduces the concept of fuzzing and vulnerability discovery in software’s covering multiple platforms such as Linux & Windows and triage analysis for those vulnerabilities.

During this training, attendees would be emulating techniques which would provide a comprehensive understanding of “Crash, Detect & Triage” of fuzzed binaries or software. In “Deep dive into fuzzing” we will be covering a detailed overview of fuzzing and how it can be beneficial to professionals in uncovering security vulnerabilities with a hands-on approach through focus on labs.

Instructor: Dhiraj Mishra / Zubin Devnani

Duration: 2-day (Starting Thursday 20th of April)

Read More

Overview

Course
Duration
Type
Corelan “BOOTCAMP” by Peter Van Eeckhoutte  3-days In-person
Active Directory Attacks for Red and Blue Teams – Advanced Edition by Nikhil Mittal 3-days Virtual
Hacking Modern Web & Desktop apps: Master the Future of Attack Vectors by Abraham Aranguren 3-days In-person
Cloud Security Masterclass: Defender’s Guide to Securing AWS & Azure Infrastructure by Abhinav Singh 3-days Virtual
Deep Dive into Fuzzing by Dhiraj Mishra and Zubin Devnani 2-days Virtual
Defending Enterprises – 2023 Edition by Owen Shearing and William Hunt 2-days In-person

Conference Training

Conference training is taking place between 25 and 27 September 2023. We will select the courses during our CFP in May and publish around end of June 2023

Additional info

Pricing

The price for 2-day courses is 1500 Euro early bird (+ VAT) per attendee.
The price for 3-day courses is 1800 Euro early bird (+ VAT) per attendee.

As of the 1st of February this will become 1600 Euro (2-day) / 1900 Euro (3-day) (+ VAT) per attendee.

(*) The Corelan trainings are a bit more expensive but consist of 3 long days (+ 10 hours) including dinner.

(**) The IoT Security Bootcamp  is a bit more expensive but each student will be provided with your own IoT Security Hacking Kit to take home with you

Location and dates

In-person courses will be hosted at the Novotel Mechelen Centre (here) or at the conference location Lamot Mechelen. The virtual courses will be handled through Zoom, and a class room will be foresoon in either of the pre-mentioned hotels for people wanting to together. See below for more information

The courses begin promptly at 09h00 and end at 17h00 (CET) (Except Corelan trainings). Out of consideration for your instructor(s) and fellow students, please try to be seated (or joined the Zoom conference) and ready to go by 08h45.

Same price for virtual and in-person training ?

At BruCON we try to keep training affordable whilst making it profitable for our trainers. We will have both in-person and virtual courses during BruCON Spring. We have opted to keep the price the same for both type of courses and will ship the student gifts to all students joining a course virtually.

Why attend a BruCON Training ?

At BruCON, we try to keep our prices affordable, both for the conference and training. We focus on the having smaller classes with enough time to get to learn and exchange experience. We will host a social gathering for students, trainers and crew to meetup over a beer (or more).

Privacy Preferences
When you visit our website, it may store information through your browser from specific services, usually in form of cookies. Here you can change your privacy preferences. Please note that blocking some types of cookies may impact your experience on our website and the services we offer.