While we strongly encourage participants in the society to buy a membership, it's important that interested individuals have the opportunity to trial a session before joining. To that end, we offer one free session a year to non-members.
Our regular sessions are hosted in person and streamed on Blackboard Collaborate, every Monday at 18:00 - 19:30 (ish). Members will be given access to our Blackboard Collaborate Organisation, from which they can view all sessions and recordings.
For step by step instructions on accessing our sessions and recordings, click here.
Please bring a laptop to all sessions unless said otherwise. If you are not able to, please speak to someone on the committee.
This week we will be doing a session on bounty hunting. We'll cover getting set up, where to start, and we'll look at scope and the importance of it.
We will be learning about WiFi and then have a go at hacking an access point.
Looking at password cracking and how to find plaintext passwords from hashes or various services.
Description
Damian Speare: "Policing in the Digital Age" Guest talk covering the implications around the digital revolution on policing. Includes year in industry and career opportunities from the Yorkshire & Humber Regional Organised Crime Unit.
Enumeration/Reconnaissance & EGM
Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Linux Distro)Open Source Intelligence is using publicly available services to collect information about a group or individual. It is an invaluable skill that is the starting point for many attacks as well as being used to find large amounts of accidentally exposed data.
Linux skills and knowledge are very important for security as well as most aspects of computer science. We will cover that as well as begin to touch on linux security.
Our first session of the year will be on web hacking where we will cover some basic web exploits. Please remember to bring a laptop along to have a go at using some of what you have learnt.
We are looking forward to seeing some of you at our PGT Give It a Go session.
We are looking forward to seeing some of you at our Give It a Go session at 4pm today. It will be in Pam Liversidge Building - Design Studio 1 which is on Floor D. Please remember to bring a laptop if you have one and we look forward to seeing you there! (Tickets are free on the SU website.)
Today is our AGM plus a session from James on email security
Today's session will be on preparation for the CTF - we'll look at some challenges from last year and have a quick intro to reverse engineering, so try to download Ghidra (https://ghidra-sre.org/InstallationGuide.html) beforehand
Join us for a session on cryptography and discover the art of encryption. Explore the techniques used to secure information and gain insight into the world of code-breaking before our visit to Bletchley. This session is open to all members of SESH, CompSoc and SWICS.
More advanced web hacking including deserialisation, NoSQL injection, and some cool supply chain attacks.
An estimated 90% of the Global Fortune 1000 use Active Directory. Learn how it works, what its weaknesses are and have ago at exploiting what makes up most companies core infrastructure.
An estimated 90% of the Global Fortune 1000 use Active Directory. Learn how it works, what its weaknesses are and have ago at exploiting what makes up most companies core infrastructure.
We'll teach you some theory and crucial commands, then test some exploits old and new, including Follina, Eternal Blue, and Potato Attacks
Some new web attacks and DVWA
We have a fun mini-CTF for you for our last session of the semester. Christmas jumpers encouraged! Sign up for a https://tryhackme.com account and login to our room at: https://tryhackme.com/jr/seshxmasctf2022
We will be doing a Hack the Box machine (RedPanda) which is still available on free tier HacktheBox but has retired. You'll need an account at https://www.hackthebox.com/. This is a great session for practicing and recapping all the skills from this semester, and will ship with slides summarising everything we've done so far
This week we'll take you over some important networking concepts and let you apply them to a hacking challenge! You can practice your enumeration, shell popping, and SSH tunneling skills before we do our first boot2root next week.
AWS (Amazon Web Services) provides on-demand cloud computing platforms and APIs to individuals and companies. Learning how to utilise them (and cloud services in general) is extremely beneficial both for your career and personal development. We will cover S3, static pages with S3, EC2, how to host a website on EC2 and how to do all this securely.
Exploring what weaknesses there are in the linux operating system and how we can harden it to prevent attacks.
Fundamental Skills
linux-1---navigating-the-file-system.pdfThis week we will be popping and catching shells!
This week we will be learning how you can instantly exploit in-person targets using hardware. We will be programming DigiSparks to emulate a keyboard in order to automate tasks, exploit targets and learn how these types of attacks can be mitigated or prevented.
Software / Link Requirements (These will need to be installed or registered prior to the Session)
Arduino IDEThis week's session will be on Enumeration. This will go over some of the most common tools and services and will be an interactive session which will use Hack The Box, and will require prior setup. There is also an EGM this week which will take place for the final half hour.
Fundamental Skills
misc---setting-up-a-virtual-machine.pdfDependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills, mandatory)Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Linux Distro)Come along to our first guest talk of the year and find out about the work of the Yorkshire and Humber Regional Organised Crime Unit (YHROCU) and their internship opportunities.
An introduction to Unix-based operating systems and the tools you will use as an ethical hacker A linux instance is not required as we are using SSH as it is a beginner session, but if you have it already any distro is fine.
Fundamental Skills
linux-1---navigating-the-file-system.pdfSoftware / Link Requirements (These will need to be installed or registered prior to the Session)
VMWare (Optional / Not Required)Our first session on web hacking methodologies, tools, and simple attacks.
Fundamental Skills
web-1---inspecting-a-webpage.pdfOur Web Hacking Give it a Go session, where we'll teach you some basic Web Application attacks and methodologies!
Fundamental Skills
Recognising Common Encodings.pngOur introduction to the society, including our goals for the year. Made for the Department of Computer Science intro week talks for students in Intro Week.
2nd part of a 2 session series on Red and Blue teaming. Watch a certified Blue teamer discover how the red teamer compromised the system, tools for logging and post-compromise response.
1st part of a 2 session series on Red and Blue teaming. Watch an OSCP certified penetration tester exploit an application, see how they discover vulnerabilities and compromise the target.
We talk about anonymising technologies, and elect next year's committee
TBC - we may run a HTB session over Easter if people are interested
Dependent Sessions (Recap may be needed)
Hack The BoxWe'll teach you everything you need to know about Capture the Flag competitions, ahead of our GroceryTF CTF challenge this weekend!
Dependent Sessions (Recap may be needed)
CTF Competition can include anything from previous yearWe'll be learning about some more complex exploits, such as Server-Side Template Injection, Server-Side Request Forgery, Remote File Inclusion, and more to prepare you for the CTF!
Dependent Sessions (Recap may be needed)
Intro to Web HackingLearn the basic theory of cryptography and run some attacks against RSA, hashes, and more!
This session covers Wi-Fi security, various attacks and tools, and practising password cracking. New to the society? Come to your first session for free, just message a committee member!
Mike Jones, a reformed ex-anonymous hacker, will be demonstrating how we can use RF (Radio Frequency) to exfiltrate data. The session will be on BlackBoard and will require a membership to join. New to the society? Come to your first session for free, just message a committee member!
Instantly exploit in-person targets using hot pluggable attacks with a BadUSB. We will be programming DigiSparks to emulate a keyboard in order to automate tasks and exploit targets!
Dependent Sessions (Recap may be needed)
Social Engineering (Related Topic)Software / Link Requirements (These will need to be installed or registered prior to the Session)
Arduino IDEA look at the most common corporate network infrastructure, and how to break it! This is an info-packed session, and you may find it easier to follow if you've looked at our Reconnaisance, Shells, OS Security and Privilege Escalation sessions - but you should be fine without!
Dependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills, mandatory)Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Recommended Distro)A quick recap of last semester and a fun TryHackMe Boot2Root
Dependent Sessions (Recap may be needed)
Recap Session, goes over basics of last semesterTBD
TBD
Come and learn Windows and Linux local enumeration and privilege escalation
Dependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills are mandatory)Kali VM recommended, as well as TryHackMe account. Linux Command Line Fundamental Skills will be useful!
Dependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills are mandatory)Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali LinuxDependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills, would be handy)Software / Link Requirements (These will need to be installed or registered prior to the Session)
DockerTBD
Dependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills, would be handy)Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Recommended Distro)TBD
Exploring how we can harden Windows and Linux operating systems from attacks.
Dependent Sessions (Recap may be needed)
Linux Introduction (Basic Linux Skills, would be handy)Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Recommended Distro)DS Spinks will be giving you an insight into fighting Cyber Crime and will be talking about a year in industry placement opportunity.
Automation in cyber security.
Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Recommended Linux Distro, any distro however is fine)Our first session on web hacking methodologies, tools, and simple attacks.
A GIAG session that aims to give a quick introduction to Linux the power that it holds.
Software / Link Requirements (These will need to be installed or registered prior to the Session)
Kali Linux (Recommended Distro)Our Web Hacking Give it a Go session, where we'll teach you some basic Web Application attacks and methodologies!
Our introduction to the society, including our goals for the year. Made for the Department of Computer Science intro week talks
Our bakery-themed CTF, featuring challenges for players of all skill levels, and a chance to win a Raspberry Pi and a SESH hoodie!
An exploration of the airwaves! Come along to learn some Wireshark snooping, MAC spoofing, and WiFi cracking.
A look into reverse engineering and modifying binaries.
Mike Jones, a reformed ex-member of the Anonymous hacking group talks about his experiences! You won't want to miss this talk
Vote for the next committee members!
A quick dive into reverse engineering games and making them misbehave. You might want to brush up on your assembly for this one.
A deeper dive into some web hacking techniques covered in first semester, and some brand new ones - from SSTI to Deserialisation!
A guide to creating and deploying a Capture the Flag challenge using AWS and Flask!
A walkthrough of the Academy machine on HTB.
An overview of assembly code & computer memory, and a couple of demos!
Focussing mainly on phishing, this session will show you techniques used for launching an effective phishing campaign and then how to best prevent one.
A look at the technologies behind VPNs and Tor, their vulnerabilities, and how to setup your own.
Our final session of the semester! We'll tackle TryHackMe's advent of cyber challenges in a laid-back session, and there may even be some prizes up for grabs...
Put your skills to the test! Drawing together everything you’ve learned from throughout the semester, join our committee in an applied hacking challenge from Hack The Box. Come ready to contribute ideas or even with your own machine to follow along!
Open Source Intelligence and social engineering are often one of the most important parts of cyber attacks and defense. Join us to learn about various tools and take part in a CTF.
What would happen if a user can access the administrator control? This week, we will look into what privilege escalation is, what is the purpose of this attack and what are the ways of doing it. We will also explore some demos about getting root access on Linux.
Dive into the world of enumeration - from discovering devices and services on a network and scoping out a way in, to finding paths for lateral movement and escalation vectors, we'll show you some of the most crucial tools and techniques.
This week we will be looking into the different kinds of shells that are available on Linux, what they do, how they work and how we can use them to gain access to remote machines. We will also be looking into port forwarding and the capabilities of Metasploit!
Hacking as a discipline wouldn’t really exist if you had to cart a keyboard with you to every machine you wanted to break into – computer networks enable remote machines to communicate with each other and make things like the Internet possible. This session will explore both the theory behind these networks and some of the practical tools for exploring and understanding them.
This week we’ll be looking at automation, one of the most crucial tools for cybersecurity; whether it’s repeating menial tasks, or rebuilding a common tool to understand how it works. We will take you over some tools we have written, and show you how they can be used on things like Juice Shop!
Chris will be in this week to talk us through some of the career opportunities available with the police! Make sure to come along to this one to hear about an exciting area of work and make some new links with industry professionals! You can sign up with this link if you are not already a member. If you are a member, you should be able to see the room in Blackboard Collaborate.
OWASP (Open Web Application Security Project) Juice Shop is an intentionally vulnerable web application that shows off multiple common and advanced exploits that can appear in web applications. Learn how the vulnerabilities exist and how to exploit them yourself. This will be a more advanced follow up from the GIAG session.
Learn how to use the Linux terminal, a vital tool of developers and cybersecurity professionals alike. Control local and remote machines by mastering the fundamental commands and test your newfound skills by breaking into the Bandit machines hosted by OverTheWire.
OWASP (Open Web Application Security Project) Juice Shop is an intentionally vulnerable web application that shows off multiple common and advanced exploits that can appear in web applications. Learn how the vulnerabilities exist and how to exploit them yourself. More details here