Targeted Takedowns - Minimizing Collateral Damage Using Passive DNS
Explore how Passive DNS can help investigators minimize collateral damage during cyber criminal takedowns, ensuring precise targeting and avoiding harm to innocent parties.
Server-Side Template Injection - RCE for the Modern Web App
Explore techniques to recognize and exploit template injection vulnerabilities, leading to remote code execution in web applications. Learn automated detection methods and application-specific exploits.
Emanate Like A Boss - Generalized Covert Data Exfiltration With Funtenna
Explore Funtenna, a software technique for covert data exfiltration through electromagnetic emanations in various computing devices, including its mechanisms, implementations, and implications for network security.
Exploiting the DRAM Rowhammer Bug to Gain Kernel Privileges
Explore the DRAM Rowhammer bug's security implications, from bit flips to kernel privilege escalation. Learn about exploit techniques, mitigations, and the physics behind this hardware vulnerability.
Repurposing OnionDuke - A Single Case Study Around Reusing Nation State Malware
Explore the process of reverse engineering and repurposing OnionDuke, a suspected Russian government malware, for use in other tools. Learn about malware analysis and ethical considerations in cybersecurity research.
TrustKit - Code Injection on iOS 8 for the Greater Good
Explore iOS 8's new code packaging rules and their impact on security. Learn about TrustKit, an open-source library for easy SSL public key pinning implementation in iOS apps without source code modification.
Bring Back the Honeypots
Explore modern honeypot techniques for enhanced network security. Learn about application traps, booby-trapped documents, and cloud-based deception to detect and prevent breaches effectively.
Big Game Hunting - The Peculiarities of Nation-State Malware Research
Explore nation-state malware research, focusing on attribution challenges and novel techniques for linking binaries. Gain insights into the complexities of threat intelligence and state-sponsored cyber espionage.
Stagefright - Scary Code in the Heart of Android
Exploring Android's Stagefright framework vulnerabilities, focusing on discovery techniques, OS internals, and security implications. Demonstrates proof-of-concept code and discusses mitigation strategies.
Dance Like Nobody's Watching - Encrypt Like Everyone Is - A Peek Inside the Black Hat Network
Explore the inner workings of the Black Hat network, one of the most hostile environments created. Learn about its planning, deployment, and maintenance, as well as the unique challenges it faces.
The Lifecycle of a Revolution
Exploring the evolution of the internet, from idealistic beginnings to current challenges, and examining future trends in digital security, privacy, and freedom.
Bringing a Machete to the Amazon
Explore AWS security challenges, vulnerabilities, and solutions. Learn assessment techniques and tools to protect your cloud infrastructure and applications.
Lights Off - The Darkness of the Smart Meters
Explore security vulnerabilities in smart power meters, including remote control capabilities and potential risks. Learn about device reverse engineering and its implications for connected home technology.
Exploring Yosemite - Abusing Mac OS X 10.10
Comprehensive analysis of Mac OS X 10.10 Yosemite's security features, demonstrating vulnerabilities, offensive techniques, and introducing a new security tool for detecting rootkits and abnormalities.
C++11 Metaprogramming Applied to Software Obfuscation
Explore advanced C++11 metaprogramming techniques for software obfuscation, including compile-time code generation, polymorphism, and practical applications like string encryption and call obfuscation.
Two Factor Failure
Explore vulnerabilities in Two-Factor Authentication systems, including a new attack on mobile TOTP. Learn best practices for secure 2FA deployment in enterprise and web applications.
PDF Attack - A Journey from the Exploit Kit to the Shellcode
Explore advanced PDF exploitation techniques, from obfuscated JavaScript analysis to shellcode extraction. Learn to modify and obfuscate malicious PDFs for pentesting and understand cybercriminals' latest tricks.
Evasion of High-End IDPS Devices at the IPv6 Era
Explore IPv6 security vulnerabilities and evasion techniques against high-end IDPS devices, with demonstrations and proposed mitigation strategies for network protection.
Scala Security - Examining the Play and LiftWeb Frameworks
Explore security aspects of Scala's Play and LiftWeb frameworks, including OWASP Top 10 vulnerabilities, exploitation mitigations, and a new Scala library for SSRF prevention.
Attacking the Linux PRNG on Android
Explore vulnerabilities in Android's Linux PRNG, focusing on early boot attacks and real-world exploitation vectors. Learn about potential security risks and mitigations for embedded platforms.
Reflected File Download - A New Web Attack Vector
Explore a new web attack vector that allows attackers to download malicious files from trusted domains without uploading them, potentially bypassing security measures and spreading across social networks.