WEBVTT

00:00:02.440 --> 00:00:03.880
You've just completed the course.

00:00:04.120 --> 00:00:05.170
Wohoo!

00:00:05.640 --> 00:00:06.770
Before I let you go,

00:00:06.770 --> 00:00:09.230
let's check out some additional information to take

00:00:09.230 --> 00:00:11.370
your Merlin skills to the next level.

00:00:13.840 --> 00:00:17.050
In this course, we focus on HTTP/3.

00:00:17.540 --> 00:00:21.770
However, Merlin also supports attacks over HTTP/2.

00:00:22.640 --> 00:00:25.100
For more information on version 2 attacks,

00:00:25.250 --> 00:00:26.830
check out Russell's white paper,

00:00:26.900 --> 00:00:30.220
a Practical Approach to Detecting and Preventing Web

00:00:30.220 --> 00:00:33.350
Application Attacks over HTTP/2.

00:00:34.040 --> 00:00:34.580
To note,

00:00:34.580 --> 00:00:37.270
all of these links can be viewed within the Additional

00:00:37.270 --> 00:00:39.650
Resources section within the course notes.

00:00:42.240 --> 00:00:43.880
Merlin has a modules feature,

00:00:43.890 --> 00:00:46.960
which allows you to save time by running pre‑bundled attacks.

00:00:47.050 --> 00:00:49.050
This is a huge timesaver.

00:00:51.040 --> 00:00:55.570
While we've primarily focused on Linux, Merlin has extensive Windows support.

00:00:55.940 --> 00:00:59.250
For example, the Merlin Agent can be executed as a DLL.

00:00:59.250 --> 00:01:03.580
For additional context and an example of running the DLL

00:01:03.590 --> 00:01:07.460
without persisting the agent to disk, please check out Russell's blog post.

00:01:10.640 --> 00:01:14.220
For additional background on Merlin, I recommend checking out this link,

00:01:14.300 --> 00:01:17.150
which houses a variety of blog posts and videos.

00:01:17.540 --> 00:01:20.360
You'll find information on the Merlin JavaScript Agent,

00:01:20.400 --> 00:01:22.550
as well as guides on how to use Merlin.

00:01:25.240 --> 00:01:27.760
Let's turn our focus onto some broader topics.

00:01:28.140 --> 00:01:31.140
The C2 channel in this course, HTTP/3,

00:01:31.140 --> 00:01:34.950
is an example of the web protocols sub‑technique.

00:01:35.640 --> 00:01:39.260
For more information on these types of attacks, check out the MITRE link.

00:01:41.640 --> 00:01:45.450
I'm going to provide a few resources on the core technology behind Merlin.

00:01:45.840 --> 00:01:50.550
To take a deeper dive into HTTP/2, check out this Google article.

00:01:52.540 --> 00:01:58.960
When compared to HTTP/2, there isn't as much information available on HTTP/3.

00:01:59.340 --> 00:02:01.770
Well, at least at the time of this recording.

00:02:02.340 --> 00:02:04.620
If you'd like to learn more about HTTP/3,

00:02:04.620 --> 00:02:08.160
I recommend reading this doc from the QUIC working group.

00:02:10.240 --> 00:02:11.960
Well, that's a wrap.

00:02:12.440 --> 00:02:15.490
I hope this course was useful and allowed you to see the power

00:02:15.490 --> 00:02:17.860
of Merlin within your red team workflow.

00:02:18.180 --> 00:02:20.360
As always, I'd love to stay in contact.

00:02:20.840 --> 00:02:25.970
If you'd like to contact me personally, please go to my website zachroofsec.com,

00:02:26.340 --> 00:02:28.650
and also, feel free to follow me on Twitter.

00:02:29.140 --> 00:02:31.060
I look forward to interacting with you.