Offensive Development Practitioner Certification Course (ODPC) - White Knight Labs - DCTSG2027
Description
Name of Training: Offensive Development Practitioner Certification Course (ODPC)
Trainer(s): White Knight Labs
Skill Level: Intermediate, Advanced
Dates: March 5 – March 7, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$3,300 (incl. GST, until Dec 31, 2026)
Regular Cost: S$3,600(incl. GST)
Short Summary
Learn how to design, build, and operate custom offensive tooling including shellcode loaders, reflective payloads, process injection techniques, AMSI and ETW bypass, API unhooking, EDR evasion strategies, payload staging, and Command and Control integration inside a private AWS lab environment protected by modern defenses.
Course Description
The Offensive Development Practitioner Certification (ODPC) provides hands-on training in designing, building, and operating custom offensive security tooling against modern endpoint defenses. Students work with shellcode loaders, reflective payloads, process injection, AMSI and ETW bypass techniques, API unhooking, EDR evasion strategies, payload staging, and Command and Control integration within a private AWS lab environment.
Students deploy and manage their own lab directly through the WKL student portal using AWS access keys, providing the flexibility to build, test, rebuild, and destroy environments as needed while managing compute costs and lab controls. Successful completion validates practical offensive development skills applicable to red teams, security consultants, and internal security teams conducting advanced adversary simulation and endpoint evasion testing.
Course Outline
View full outline
Hide outline
Day 1 - Morning
- Lab Setup & Development Fundamentals
- Course Introduction and Environment Setup
- Deploying and Managing the Private AWS Lab
- Offensive Development Fundamentals
- Introduction to Shellcode and Payload Development
- Building and Testing Shellcode Loaders
Day 1 - Afternoon
- Payload Execution & Process Injection
- Reflective Payload Techniques
- Payload Staging and Execution
- Process Injection Techniques
- Windows API Fundamentals
- Hands-On Payload Development and Testing
Day 2 - Morning
- Windows Defense Evasion
- Understanding Modern Endpoint Defenses
- AMSI Bypass Techniques
- ETW Bypass Techniques
- API Unhooking
- Testing Against Modern Security Controls
Day 2 - Afternoon
- EDR Evasion & Advanced Development
- EDR Evasion Strategies
- Detection and Evasion Considerations
- Refining Custom Offensive Tooling
- Payload Modification and Testing
- Hands-On Evasion Exercises
Day 3 - Morning
- Command and Control Integration
- Command and Control Fundamentals
- Integrating Custom Tooling with C2 Infrastructure
- Payload Staging and Delivery
- Operational Testing in the AWS Lab
- Combining Development and Evasion Techniques
Day 3 - Afternoon
- Practical Application & Course Review
- End-to-End Offensive Development Scenario
- Building, Deploying, and Testing Custom Tooling
- Evaluating Tooling Against Modern Defenses
- Troubleshooting and Refinement
- Key Takeaways and Course Wrap-Up
Difficulty Level
Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.;Advanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.
Suggested Prerequisites
Students should be comfortable with C, C++, or C#, understand Windows internals, and have prior exposure to shellcode, loaders, or process injection concepts.
What Students Should Bring
TBD
What the Trainer Will Provide
All students are onboarded into the White Knight Labs student portal, where all certification content is delivered in Markdown format.
Trainer(s) Bio
TBD
Proficiency Exam
Validated Offensive Development Expertise Proves the ability to design, build, and deploy custom offensive tooling against modern defenses Certification badge reflects practical tooling execution and evasion, not attendance or progress only Demonstrates skill in bypassing EDR, Windows defenses, and application control through custom development
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
