Is This My Domain Controller? A New Class of Active Directory Protocol Injection Attacks
Explore new Active Directory protocol injection attacks, focusing on NTLM and Kerberos vulnerabilities. Learn about attack scenarios, mitigation strategies, and essential tips for defenders.
With Friends Like eBPF, Who Needs Enemies?
Explore eBPF's evolution from network monitoring to a powerful Linux kernel observability tool, its security implications, and potential misuse by attackers.
Compression Oracle Attacks on VPN Networks
Explore compression oracle attacks on VPN networks, including browser requests and ESP compression. Learn detection methods, setup requirements, and potential future threats.
Attacking and Defending the Microsoft Cloud - Office 365 & Azure AD
Explore common attacks on Microsoft Cloud, learn effective defenses, and gain insights into securing Office 365 and Azure AD environments. Applicable to other cloud providers.
The Cost of Complexity - Different Vulnerabilities While Implementing the Same RFC
Exploring security vulnerabilities in DNS implementations due to complexity and ambiguity in RFC 1035, focusing on message compression and its impact on TCP/IP stacks.
Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet
Explore remote code execution vulnerabilities in physical security systems, learning to exploit and disarm alarms through reverse engineering and network protocol analysis.
Circumventing the Guardians - How the Security Features in State-of-the-Art TLS Inspection Solutions Can Be Exploited for Covert Data Exfiltration
Unveiling a stealthy data exfiltration method that bypasses TLS inspection security solutions. Learn about SNIcat and how it circumvents perimeter defenses, with insights on mitigation and detection strategies.
BLEEDINGBIT - Your APs Belong to Us
Explore BLEEDINGBIT vulnerabilities in BLE chips, allowing unauthenticated network penetration. Learn attack methods, packet structures, and prevention strategies for enterprise wireless access points.
For the Love of Money - Finding and Exploiting Vulnerabilities in Mobile Point of Sales Systems
Explore security vulnerabilities in mobile payment systems, focusing on economic implications, fraud risks, and outdated card standards. Learn about testing methods and potential attack vectors.
Internet Plumbing for Security Professionals - The State of BGP Security
Explore BGP security, its vulnerabilities, and practical countermeasures to build trust in the Internet's foundation. Learn about routing leaks, hijacking risks, and implementation strategies for a more secure network infrastructure.
DTM Components - Shadow Keys to the ICS Kingdom
Explore vulnerabilities in industrial control system components, focusing on DTM technology used in critical industries. Learn about security flaws and their implications for field devices.
OpenStack Cloud at Yahoo Scale - How to Avoid Disaster
Learn strategies to secure large-scale OpenStack deployments, including hardening techniques, compromise mitigation, and network architecture considerations, based on Yahoo's experience managing massive cloud infrastructure.
ICSCorsair - How I Will PWN Your ERP Through 4-20 mA Current Loop
Explore vulnerabilities in industrial control systems, from low-level protocols to high-level applications. Learn about ICSCorsair, an open hardware tool for auditing and exploiting ICS networks across multiple layers.
Targeted Takedowns - Minimizing Collateral Damage Using Passive DNS
Explore how Passive DNS can help investigators minimize collateral damage during cyber criminal takedowns, ensuring precise targeting and avoiding harm to innocent parties.
Dance Like Nobody's Watching - Encrypt Like Everyone Is - A Peek Inside the Black Hat Network
Explore the inner workings of the Black Hat network, one of the most hostile environments created. Learn about its planning, deployment, and maintenance, as well as the unique challenges it faces.
Evasion of High-End IDPS Devices at the IPv6 Era
Explore IPv6 security vulnerabilities and evasion techniques against high-end IDPS devices, with demonstrations and proposed mitigation strategies for network protection.
Abusing Software Defined Networks
Explore vulnerabilities in Software Defined Networks, including clear-text protocols, weak authentication, and open APIs. Learn to identify, exploit, and protect against these weaknesses in leading SDN platforms.
Industrial Control Systems - Pentesting PLCs 101
Hands-on workshop exploring penetration testing techniques for industrial control systems, focusing on PLCs. Learn to identify vulnerabilities and attack Siemens and Schneider devices.
The Hidden Architecture of Our Time - Why This Internet Worked, How We Could Lose It
Exploring the Internet's success, its underlying principles, and the potential threats to its architecture. Emphasizes the importance of cryptography, open networks, and hacking in shaping a functional global network.
New and Newly - Changed Fully Qualified Domain Names - A View of Worldwide Changes to DNS
Innovative approach to monitoring DNS changes, enabling better detection of security threats, phishing, and malicious behavior. Practical examples and demo included.
VOIP Wars - Destroying Jar Jar Lync
Explore vulnerabilities in Microsoft Lync/Skype for Business, including VoIP attacks, security design flaws, and client-side threats. Learn about attack vectors and practical threats with live demonstrations.