|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/offensive-thick-client-penetration-testing/
课程评论：没有评论
课程名称：进攻性厚客户端渗透测试 概述：厚客户端应用程序在主流安全培训中常被忽视，但它们在金融、医疗、政府和企业网络等关键系统中发挥着重要作用。这些应用程序直接与后端服务器交互，通常使用专有协议、传统认证方法以及未保护的本地存储，这为能够利用这些漏洞的攻击者提供了丰富的机会。进攻性厚客户端渗透测试旨在填补这一空白。 本课程为实践导向，您将学习如何通过结构化的进攻性方法识别、分析和利用厚客户端应用程序中的安全漏洞。您将学习拦截和操控客户端与服务器之间的流量、反向工程二进制文件、绕过认证、利用不安全的存储并注入恶意代码以控制应用程序逻辑。我们将涵盖关键攻击矢量，如DLL注入、不安全的序列化、自定义协议模糊测试、本地权限升级和业务逻辑操控。 您将使用真实世界的工具，如Burp Suite、Wireshark、Ghidra、dnSpy、Procmon等。无论您是红队成员、漏洞赏金猎人还是安全研究人员，本课程都将帮助您掌握应用安全中一个关键但未被充分探讨的领域。如果您准备好提升技能，超越网页和API的利用，课程将成为您成为全面的进攻安全专家的下一步。
Thick client applications are often overlooked in mainstream security training, yet they power some of the most critical systems in finance, healthcare, government, and enterprise networks. These applications interact directly with backend servers, often using proprietary protocols, legacy authentication methods, and unprotected local storage-making them a goldmine for attackers who know how to exploit them.Offensive Thick Client Penetration Testing is designed to bridge that gap.In this hands-on course, you'll learn how to identify, analyze, and exploit security flaws in thick client applications through a structured offensive approach. You'll intercept and manipulate traffic between the client and the server, reverse engineer binaries, bypass authentication, exploit insecure storage, and inject malicious code to take control of application logic.We'll cover key attack vectors like DLL injection, insecure serialization, custom protocol fuzzing, local privilege escalation, and business logic manipulation. You'll work with real-world tools such as Burp Suite, Wireshark, Ghidra, dnSpy, Procmon, and more.Whether you're a red teamer, bug bounty hunter, or security researcher, this course will help you master a critical but underexplored area of application security.If you're ready to level up and go beyond web and API exploitation, this course is your next step in becoming a complete offensive security expert.
