Story Mode Sample Submission

Note to reader: This talk is mostly made up for a general example. It's designed to provide ideas of information to include the lowest level of detail to use, and overall flow of a good submission. The Detailed Outline (#9) doesn’t need to be formatted as it is in this sample, but it should contain enough information to convince us of the merits of your talk. This should be above and beyond the information contained in the Short Abstract (#8).

1. Email address

youremail@domain.com

2. Name or Handle

Your Name

3. Talk Title

Goat Simulators

4. Talk options are Level Up, Story Mode, and Training Mode

Story Mode

5. Twitter Handle

@YourTwitter

6. Speaker Bio(s)

Your name is an Offensive Security Engineer who enjoys breaking code and mitigating risks. In her spare time she volunteers in the local security community.

7. Length of Talk or Training

45 Minutes

8. Short Abstract

Who I Am

Serverless Goat by OWASP

Lambda Function pwning

AWS CLI resources

Cloud Goat by Rhino Security

Cloud Goat Walkthrough

Cloud Goat Scenarios

Lessons Learned

9. Detailed Outline

Who I Am - I am a person. I am a metal head and overall nerd whose hobbies include (D&D, war-gaming, reading, video games, Go, and learning new things)

Serverless Goat by OWASP - Serverless goat is a vulnerable lambda function created by OWASP for developers to train in security and learn about the common flaws found in a lambda function and how they can be abused.

AWS CLI resources – Basic and useful commands for testing AWS lambda functions. Overview of the knowledge and resources necessary to solve all Serverless Goat challenges. My serverless goat walkthrough includes details on Lambda function pwning laid out as it was logically solved.

Cloud Goat by Rhino Security – Is a vulnerable by design AWS environment created to teach AWS Security risks. It can be deployed and shut down at will and with a free tier account may be used without incurring any costs. consists of several vulnerable AWS scenarios.

Cloud Goat Walkthrough – includes installation steps as well as uninstallation steps for each scenario to prevent any unnecessary costs. It does not provide any of the actual answers, but it does provide a comprehensive guide of the logic used to complete each of the 6 scenarios.

Cloud Goat Scenarios – Each cloud goat scenario is complete with a goal. Once achieved the scenario is solved and can be removed. iam_privesc_by_rollback is a scenario which starts with limited user credentials and escalates to admin privileges by rolling back an iam policy version. iam_privesc_by_attachment is a scenario which also starts with limited user privileges which must be escalated in order to achieve the goal. cloud_breach_s3 is a scenario which requires the attacker to download confidential files from an S3 bucket. ec2_ssrf requires the attacker to discover how to execute a lambda function they don’t have permissions for. rce_web_app is a scenario with a RDS database secret which needs to be discovered and can be solved in multiple ways as different users. Codebuild_secrets is another RDS Database scenario requiring the attacker to obtain a pair of secret strings.

Lessons Learned – One of the first things I learned was that professionals who create these attack scenarios often leave out details which would be helpful for more novice users. Having a guide which include installation from various OS’ as well as steps to remove the scenarios would go a long way in assisting users who are new to cloud concepts.

10. Past Speaking/Training Experience (if any)

Aside from giving presentations on security tools during college I have none.

11. Have you given this Talk or Training anywhere before?

12. Special Requirements

None