Exploring Yosemite - Abusing Mac OS X 10.10
Comprehensive analysis of Mac OS X 10.10 Yosemite's security features, demonstrating vulnerabilities, offensive techniques, and introducing a new security tool for detecting rootkits and abnormalities.
C++11 Metaprogramming Applied to Software Obfuscation
Explore advanced C++11 metaprogramming techniques for software obfuscation, including compile-time code generation, polymorphism, and practical applications like string encryption and call obfuscation.
Two Factor Failure
Explore vulnerabilities in Two-Factor Authentication systems, including a new attack on mobile TOTP. Learn best practices for secure 2FA deployment in enterprise and web applications.
PDF Attack - A Journey from the Exploit Kit to the Shellcode
Explore advanced PDF exploitation techniques, from obfuscated JavaScript analysis to shellcode extraction. Learn to modify and obfuscate malicious PDFs for pentesting and understand cybercriminals' latest tricks.
Evasion of High-End IDPS Devices at the IPv6 Era
Explore IPv6 security vulnerabilities and evasion techniques against high-end IDPS devices, with demonstrations and proposed mitigation strategies for network protection.
Scala Security - Examining the Play and LiftWeb Frameworks
Explore security aspects of Scala's Play and LiftWeb frameworks, including OWASP Top 10 vulnerabilities, exploitation mitigations, and a new Scala library for SSRF prevention.
Attacking the Linux PRNG on Android
Explore vulnerabilities in Android's Linux PRNG, focusing on early boot attacks and real-world exploitation vectors. Learn about potential security risks and mitigations for embedded platforms.
Reflected File Download - A New Web Attack Vector
Explore a new web attack vector that allows attackers to download malicious files from trusted domains without uploading them, potentially bypassing security measures and spreading across social networks.
Ret2dir - Deconstructing Kernel Isolation
Explore kernel exploitation technique ret2dir, bypassing isolation protections by leveraging direct-mapped memory. Learn about vulnerabilities, attack models, and mitigation strategies for Linux kernels.
Gyrophone - Eavesdropping Using a Gyroscope
Explore how smartphone gyroscopes can be exploited to eavesdrop on nearby speech, bypassing microphone permissions and posing privacy risks. Learn about potential attacks and defenses.
Next Level Cheating and Leveling Up Mitigations
Explore sophisticated attacks on anti-cheat systems in multiplayer gaming, including practical demonstrations and implications for game security and the future of cheat prevention.
Freeze Drying for Capturing Environment-Sensitive Malware Alive
Innovative techniques for capturing and analyzing environment-sensitive malware through "freeze drying" and live process migration, enabling dynamic analysis of sophisticated threats like Citadel and ZeuS/GameOver.
Abusing Software Defined Networks
Explore vulnerabilities in Software Defined Networks, including clear-text protocols, weak authentication, and open APIs. Learn to identify, exploit, and protect against these weaknesses in leading SDN platforms.
Hadoop Security - Seven Ways to Kill an Elephant
Explore Hadoop security challenges and solutions in Big Data environments. Learn seven key strategies to mitigate risks and protect sensitive information in Hadoop ecosystems.
Industrial Control Systems - Pentesting PLCs 101
Hands-on workshop exploring ICS security, focusing on PLC vulnerabilities. Learn to assess and exploit industrial control systems using real-world examples and practical techniques.
Industrial Control Systems - Pentesting PLCs 101
Hands-on workshop exploring penetration testing techniques for industrial control systems, focusing on PLCs. Learn to identify vulnerabilities and attack Siemens and Schneider devices.
Revisiting XSS Sanitization
Explore XSS vulnerabilities in popular WYSIWYG editors and learn an effective sanitization technique using minimal characters and regular expressions to prevent attacks across various contexts.
Counterfeiting the Pipes with FakeNet 2.0
Explore network simulation for malware analysis using FakeNet 2.0. Learn to mimic protocols, configure settings, and capture network signatures efficiently in this hands-on workshop.
WebKit Everywhere - Secure or Not?
Explore WebKit security, vulnerabilities, and exploitation techniques across platforms. Learn about security enhancements, mitigation strategies, and advanced exploit methods with real-world demos.
Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers
Explore XSS-based attacks on browser password managers, their vulnerabilities, and potential solutions. Learn about password field usage on popular websites and get recommendations for protection.
Certificate Bypass - Hiding and Executing Malware from a Digitally Signed Executable
Innovative technique for concealing malware within digitally signed files, evading detection by security solutions. Explores PE file structure, certificate table manipulation, and memory-based execution without disk writing.