SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usConnect, learn, and share with other cybersecurity professionals
Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders
Become a member for instant access to our free resources.
Sign UpMission-focused cybersecurity training for government, defense, and education
Explore industry-specific programming and customized training solutions
Sponsor a SANS event or research paper
We're here to help.
Contact UsFast-track your success with an intensive week of top-tier training at SANSFIRE 2025. Whether you're just starting or sharpening advanced skills, this event is built to elevate your expertise with hands-on labs, real-world techniques, and guidance from some of the best minds in cybersecurity. You'll leave not just better prepared but armed with certifications that set you apart.
In a field that never stands still, staying ahead is more than important—it’s a necessity. This is more than just training; it’s your chance to transform your career, deepen your knowledge, and connect with a network of industry leaders who share your passion for growth and innovation.
Choose from over 40 courses tailored for every practitioner, from foundational skills to cutting-edge innovations, that dive deep into topics like:
and many more!
Plus, enjoy bonus after-class extras like hands-on workshops, expert-led talks, and networking events that extend value far beyond the classroom.
Your evolution begins here. Join SANS and transform your future.
SANS creates a one-of-a-kind learning experience providing world-class training and fascinating opportunities to network and gain new perspectives from your peers!
The instruction at SANS is top-notch. I have been to several SANS training courses and they never disappoint. The instructors bring real life experiences and show the students how the material can be applied.
The labs are giving me a chance to see the course content first hand and interact with it. It's doing a good job of letting me play with it and really seeing how the tools and methodologies work.
SANS training keeps individuals up-to-date with relevant cyber security information. I can now apply the skills learned towards further maturing my program.
Hear from SANS expert instructors, during our keynote session and during SANS@Night talks for the latest techniques.
Learn MorePut your skills to the test in an adrenaline-pumping competition! Join your classmates at Core or Cyber Defense NetWars Tournament for an exclusive challenge included free with your course registration.
Learn MoreOnce SANS Alumni, Always SANS Alumni. Step into the ultimate cybersecurity gathering where your community awaits! Whether it’s your first SANS event or a return to your roots, Community Night is your chance to connect, celebrate, and grow with the industry’s brightest minds. Enjoy an evening filled with networking, bites, beverages, exciting giveaways, and thought-provoking discussions. This isn’t just an event—it’s your gateway to meaningful connections and shared passion with the support of a thriving cybersecurity family. #FindYourPeople
Learn MoreJoin us in Washington, D.C at SANSFIRE and unlock special savings when you register to attend in-person. A $3,240 value!* Unlock the OnDemand Bundle which includes 4-months of course and lab learning access after your training with live SME support. Plus, free access to play in the Core NetWars Tournament during your training week on Thurs, July 17 - Fri, July 18. Compete against your classmates in the ultimate multi-disciplinary cyber range that powers up the most diverse cyber skills. *Offer limited. Available while supplies last.
Looking for Group Training? Contact Sales
2 Free practice tests when you add a certification exam attempt to your course. Available for select courses below.
Add 4 months of OnDemand access to your course purchase. Only available for courses with an OnDemand option.
Free with purchase of a 4, 5 or 6 day in-person course. Instructions to confirm your spot will be shared on site.
Monta Elkins is currently "Hacker-in-Chief" for FoxGuard Solutions, an ICS patch provider. A security researcher and consultant; he was formerly Security Architect for Rackspace, and the first ISO for Radford University.
Learn moreRich is a seasoned cybersecurity professional with over two decades of experience in the cyber domain. He has participated in offensive and defensive cyber operations for the Department of Defense (DoD) in more than 17 countries.
Learn moreJohn redefined modern SOC operations by engineering globally adopted blue team strategies and co-creating the GSOC cert. Through the Blueprint podcast and SANS leadership, he’s unified thousands of defenders around real-world detection tactics.
Learn moreFrank Kim is the Founder of ThinkSec, a security consulting and CISO advisory firm. He leads the Cybersecurity Leadership and Cloud Security curricula at SANS, as well as authors and instructs multiple SANS courses.
Learn moreA former U.S. Air Force cyber warfare officer, Robert led the NSA’s first mission targeting threats to industrial infrastructure. Now at Dragos, he spearheads global defense of critical systems, shaping national policy and industry threat response.
Learn moreDr. Johannes Ullrich is the Dean of Research for SANS Technology Institute, a SANS Faculty Fellow, and founder of the Internet Storm Center (DShield.org) which provides a free analysis and warning service to thousands of Internet users and organizations.
Learn moreEngage in extra learning and activities during SANS events.
Hands-on competitions to test and sharpen your cybersecurity skills.
Network and collaborate with cybersecurity professionals.
Kick off your SANSFIRE 2025 experience at the Welcome Reception. Be a part of this kickoff event and join the industry’s most powerful gathering of cybersecurity professionals. Share stories, make connections, and learn how to make the most out of your training this week in Washington, DC. Beverages (adult and otherwise) and bites will be served. Hope to see you there!
Join us for a special "Community Night" at SANSFIRE 2025. This gathering is open to all cybersecurity professionals and designed to foster connections across the entire spectrum of our community — from newcomers to seasoned experts.
For security operations, distractions can be dangerous. A “denial of service” against a defender often leads to missed alerts and compromise. The tool must never be the focus but the results the tool provides should determine the value of the tool. AI tools are currently in the “new and cool” phase of the hype cycle. There is no week without a major new AI development. As a result, defenders tend to spend a lot of time trialing new tools and little time properly integrating them into security operations. During this presentation, we interview several defenders to learn what turned out to be just a distraction, or what tools turned out to be a game changer for operations once properly integrated.
Presented by
Dr. Johannes Ullrich
Fellow
Join us for an exclusive evening of connection and inspiration at SANSFIRE 2025 Women’s Connect, hosted in partnership with Women in CyberSecurity (WiCyS). This special gathering is open to SANS students and members of the local cybersecurity community — from CISOs to early-career practitioners.
Speakers: Internet Storm Center Handlers, Guy Bruneau and Jesse La Grew
Become part of the largest, oldest, and most open sensor network on the internet. Learn how to build, configure, and operate your very own honeypot. We will provide up to twenty honeypots free on a first-come basis. You are also welcome to bring your own Raspberry Pi, n100, or similar system (or cloud account).
This is a hands-on session and requires some familiarity with Linux. Once deployed, the three honeypots submitting data most consistently for the first three months will have a yet-to-be-announced prize.
Buckle up for a lively ride through the wild world of cybersecurity! Sure, today’s tech landscape is all about AI, quantum computing, and other fancy buzzwords that make your head spin but guess what? None of that cutting-edge stuff means squat if you’re ignoring the good old basics. In this upbeat, interactive session, we’ll dive into why the tried-and-true fundamentals (think password hygiene, patch management, and access controls) are the secret sauce to surviving and thriving in the age of ever-evolving cyber threats. Prepare for real-life “oops” moments, plenty of laughs, and hands-on tips you can actually use. This is not your buttoned-up, corporate snooze-fest: you’ll leave inspired, empowered, and ready to fortify your digital defenses with good vibes and rock-solid basics. Let’s have some fun getting back to what really matters!
Presented by
Rich Greene
Certified Instructor
Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About Core NetWars: The most comprehensive of the NetWars ranges, this ultimate multi-disciplinary cyber range powers up the most diverse cyber skills. This range is ideal for advancing your cybersecurity prowess in today's dynamic threat landscape. The winning team and the top five solo players from every Core NetWars tournament throughout the year are offered a chance to compete in the annual SANS Core NetWars Tournament of Champions.
Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About Cyber Defense NetWars: Focused on preventing, analyzing, and defending against complex real-world attack scenarios, including brute-force attacks and ransomware campaigns.
In this demo of hardware hacking, we'll introduce PulseView - the 'Wireshark of hardware hacking' - and demonstrate a technique to unlock a keypad safe. Our method? A Side-Channel Timing Attack, which relies on the timing discrepancies in the user interface.
Using an affordable logic analyzer (priced under $15), we'll capture microsecond changes in response times tied to incorrect passcodes. By leveraging this side-channel data, we will carefully decipher the true passcode of the safe. Unique Approach: Traditional hacking often focuses on software vulnerabilities to exfiltrate sensitive data.
In this demonstration, we will show how the timing of system responses can leak data without any traditional vulnerabilities. This approach emphasizes the power and subtlety of side-channel attacks in extracting valuable information. Insights for Attendees: Understand how a side-channel timing attack works to reveal sensitive data.
Learn about the key functionality of logic analyzers and the PulseView software, often called the 'Wireshark of hardware hacking.' Gain practical knowledge on how to utilize changes in response time to recover the passcode of a keypad safe. Join us for this insightful session to explore the intricacies of hardware hacking and enhance your cybersecurity skill set with real-world applications and techniques.
Presented by
Monta Elkins
Principal Instructor
Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About Core NetWars: The most comprehensive of the NetWars ranges, this ultimate multi-disciplinary cyber range powers up the most diverse cyber skills. This range is ideal for advancing your cybersecurity prowess in today's dynamic threat landscape. The winning team and the top five solo players from every Core NetWars tournament throughout the year are offered a chance to compete in the annual SANS Core NetWars Tournament of Champions.
Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About Cyber Defense NetWars: Focused on preventing, analyzing, and defending against complex real-world attack scenarios, including brute-force attacks and ransomware campaigns.
A special discounted rate of $207.00 S/D plus applicable taxes will be honored based on space availability. When booking through the links below, the $25 daily resort fee will be waived. A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.
These rates include Internet in your room, complimentary access to the fitness center, and are only available through Friday, June 20, 2025.
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.
Discover a contemporary urban retreat located in the heart of D.C.'s most desirable neighborhoods. Steeped in history, this hotel has hosted presidents, notable figures, and prestigious events since 1965. Enjoy a seasonal outdoor heated pool with spectacular views of the Washington Monument. Discover local flavors in four exceptional on-site dining venues.
- Self-Parking: $56.00 *Rates subject to change. Please contact the venue for the most up to date information. Alternative Parking Options SANS recommends researching nearby parking facilities for more affordable options. Below are some popular parking apps that can help you locate and reserve space during your training are SpotHero, ParkMobile, and ParkWhiz. Distances from Nearby Airports - Ronald Reagan Washington National Airport (DCA): Approximately 7.9 miles. - Dulles International Airport (IAD): Approximately 29.0 miles. - Baltimore-Washington International Airport (BWI): Approximately 33.9 miles.
Unlock Hilton Gold Status with staying 8 nights in a 90-day period. Did you know by staying just 8 nights in a 90-day period with Hilton, you can status match your current loyalty program to Hilton Gold Status? Hilton Gold Status provides exclusive perks such as a daily food and beverage credit, premium internet access, potential room upgrades based on availability, and many more benefits.
The discount ranges from 1% - 10% depending on the origin airport. When making the flight reservation, use the code - 'ZQ33173387'. Please Note: This discount applies to flights with United Airlines and other codeshare airlines and does not apply to basic economy fares. Call the United Meetings Reservation Desk at (800) 426-1122 for booking assistance.
Delta Air Lines is pleased to offer special flight discounts for SANS Institute customers! Depending on fare type, domestic discounts range from 2- 10%. Use Meeting Event Code 'NM47F' during booking. You may also call Delta Meeting Network® at 1.800.328.1111* Monday-Friday, 8:00 a.m.- 6:30 p.m. (EST) *Please note there is not a service fee for reservations booked and ticketed via the reservation 800 number. Discounts valid on Delta and applicable Codeshare flights.