1. Corp VPN's will block google docs very regularly 2. Some people refuse to use google services 3. It shouldn't take you to a different domain to read the learning material
It's simply too easy to use other means of delivery.
Look at drive by: https://attack.mitre.org/techniques/T1189/
In most cases the only thing exploited is the sites hosting their malware (typical joomla/wp sites).
Spear phishing attachment: https://attack.mitre.org/techniques/T1193
I see about 3 examples out of 40 that use exploits.
Spearphishing link: https://attack.mitre.org/techniques/T1192/
2/20
https://attack.mitre.org/techniques/T1190/ only 5 examples for public facing asset exploit,mostly sql injection.
Mitre is not a complete list but they do a good job of keeping up with APT techniques. The most famous ones indeed use 0days and that is one of the reasons they're famous. But the end of the day they should be noteworthy based on damage done not "coolness" of the hack.
Software exploitation is a thing but not only is it seen less and less, modern mitigations are making a lot of the techniques obsolete. Look at the fall of exploit kits as an example.
Watering holes can be depending on how the malware is delivered once the user visits the site. If it just tries to download it and hope they click, that is not advanced IMO.
I do agree that this is what most organizations face as threats though. Resources like these are for people who want to eventually sell exploits, hunt for bugs, or learn enough to analyze them effectively. I do not think these are for teaching someone to teach corp users to not run docms.
If you have some examples of criminal groups using zero days in hard targets, I'm very interested. From what I see, no one's mobile phones are getting hit with ransomware via fresh vulns. That behavior is generally reserved for nation states with the ability (financial and legal) to purchase the exploits.
https://blog.ret2.io/2018/09/11/scalable-security-education/ These guys have built an epic b0f research education platform - could be also sold as a cloud-based research platform for vuln developers
Another one is https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/vid... for mostly C/C++ overflow type education
You'd have a tough time getting any public Cloud provider to allow you to run known vulnerable software, on purpose, on their network and then exposing it to the Internet.
If you kept it under a decent amount of network security and heavily restricted access it might work.
I would suspect you'd need permission to set this up, though.
I'm just in the beginning phases of learning pen testing. I want to move from DevOps to DevSecOps to PT.
I'm keen to see what labs exist out there already and how I can build my own complex labs (consisting of complete virtual networks) that I can hack against. A real wargame.
- Wechall
- OverTheWire
- SmashTheStack.org
- CryptoPals.com
- Google Gruyere appspot
In my opinion that is.
