1. Pen Testing with Iron Andrew Wilson Trustwave SpiderLabs

2. Ubiquitous Hello Application Security Consultant Ex-Software Developer– Microsoft MVP Long walks on the beach Dancing in the rain

3. Goals Why Bother? Introduction to the DLR & CLR Getting Running Examples: Reflection and Disassembly Leveraging Existing Tools Driving Applications with Scripts

4. Why Bother? Best of Both Worlds Deeper Reach Simplification

5. Python & Ruby: Make Developers Security Testers Happy! Awesome at Scripting & Interactive Development (read: rapid prototyping) Incapable (normally) of interaction with.NET 

6. .NET Framework Is: Awesome in library, connectivity, and tooling Commonly used by companies you test Sucky at scripting and interactive programming

7. CLR <3 Focuses concerns against business problems Handles: Memory Management Metadata JIT Common Type System

8. DLR <3

9. Expression Trees Translate code from one language to MSIL Introduced in.Net 3.5 via Linq

10. DLR+CLR Peace Love & Harmony Bi-Directional support: DLR – CLR (Ex. Python – CLR) CLR – DLR (Ex. CLR – Embedded Python)

11. IronPython Significantly more mature (circa 2006) Better support for existing Python applications Loads apps by being manually added to lib

12. IronRuby Needs your support Just obtained Visual Studio Support Loads assemblies via igem (instead of gem) install

13. Getting Started You will need: IronRuby OR IronPython Language tools are optional Visual Studio Express OR MonoDevelop Reflector

14. Use Cases: Disassembly / Reflection Existing Tooling Driving Applications via Scripts

15. No Disassemble!

16. Reflection::noitcelfeR.NET has reflection– but it sucks Ruby has reflection– and it rules Always Cheat, Always win.

17. Use Existing Tools

18. Some things aren‘t 100% supported Workarounds are in progress & inevitable Gains are still decent & getting better

19. THE POWER OF GRAYSKULL!!

20. When Not To Use: When You Can’t Testing Web Applications You Can Debug Natively When Native Tools Are Better

21. Closing Thoughts No Free Lunches Offers Unique Opportunities Projects In Transition

22. QA