One Year in Security - What Was That Thing Called Again?
Explore a security professional's first-year journey, covering challenges like imposter syndrome, burnout, and continuous learning in the fast-paced cybersecurity field.
Diggin Deep into Newly Created Domains
Explore techniques for investigating newly registered domains, uncovering potential threats, and enhancing cybersecurity through proactive domain analysis.
Why InfoSec Needs Rookies Like Us
Discover the importance of newcomers in InfoSec, addressing skills shortages, diversity, and stakeholder management while exploring strategies to attract and retain talent.
Stop Training, Start Marketing
Discover effective strategies to transition from training to marketing, focusing on essential techniques for impactful communication and audience engagement.
Recreating an iOS 0-Day Jailbreak Out of Apple's Security Updates
Detailed walkthrough of recreating an iOS jailbreak from security updates, covering vulnerability discovery, exploit development, and jailbreak creation. Includes practical demonstration and insights.
Never Gonna Give You Up, Never Gonna Let You Down
Explore 30 years of hacking evolution and its impact on cybersecurity. Learn key insights and prepare for future challenges in the rapidly evolving landscape of digital security and cyberwarfare.
A Pre-Auth RCE on Leading SSL VPNs
Unveiling critical vulnerabilities in leading SSL VPNs, including pre-auth RCEs and backdoors. Demonstrating exploitation techniques, post-exploitation strategies, and discussing mitigation measures for enterprise security.
Advanced Mutation Fuzzing Method for Wireless Protocols
Explore advanced mutation fuzzing techniques for wireless protocols, covering basics, new fuzzer development, and smart payload mutation. Includes demos on mobile, IoT, and automotive vulnerabilities.
4G to 5G - New Attacks
Explores vulnerabilities in 5G/4G protocols affecting network operators and consumer devices. Demonstrates new hijacking, bidding down, and battery draining attacks using low-cost tools. Discusses worldwide testing results and potential fixes.
Scare - Static Code Analysis Recognition Evasion
Explore techniques to evade static code analysis tools, including covert data flow, deep call stacks, and taint laundering. Learn how malicious code can be camouflaged to avoid detection.
Abusing Over-The-Air Client Provisioning
Uncovers vulnerabilities in major phone brands' network settings, allowing attackers to manipulate user data. Demonstrates attack flows and discusses vendor mitigations for these security risks.
Perfidious - Make PE Backdooring Great Again
Explore PErfidious, a Python tool for PE file manipulation and shellcode injection. Learn about its capabilities in bypassing endpoint detection systems and its potential as a modern PE file analysis library.
How to Detect Fake Faces - Manipulated Images Using CNNs
Explore CNN-based methods for detecting manipulated facial images, including Deepfakes and face merging. Learn effective techniques using low-level and high-level features for automatic detection of facial manipulation.
Hacking Object Detectors Is Just Like Training Neural Networks
Explore techniques for deceiving object detectors by comparing the attack process to neural network training. Learn how applying training techniques can improve adversarial attacks on state-of-the-art systems.
Car Hacking Made Easel
Demonstrating a systematic approach to reverse engineer and exploit car systems through CAN bus communication protocol analysis, packet spoofing, and payload crafting within a month-long prototype build.
Underrated Security Bugs
Explore underrated security bugs with code snippets, exploitation examples, and impact assessments. Learn to identify and understand these overlooked vulnerabilities for better cybersecurity practices.
Activities of the Tick Cyber Espionage Group Over the Last 10 Years
Comprehensive analysis of the Tick cyber espionage group's decade-long activities, focusing on their tactics, malware, and impact on East Asian targets, particularly in Korea and Japan.
Closing Ceremony & CTF Prize Giving Ceremony
Closing ceremony and prize-giving event for the Hack In The Box Security Conference, featuring awards for the Capture The Flag competition winners.
Panic On The Streets Of Amsterdam - PanicXNU 3.0
Explore advanced kernel fuzzing techniques for macOS, including syscall and IOKit fuzzing. Learn about PanicXNU v3's features and its effectiveness in uncovering critical vulnerabilities in Apple's kernel.
Persisting with Microsoft Office - Abusing Extensibility Options
Explore techniques for exploiting Microsoft Office add-ins to achieve persistence on compromised systems. Learn advantages, deployment complexity, and detection methods for various mechanisms.
Hide Yo Keys, Hide Yo Car - Remotely Exploiting Connected Vehicle APIs and Apps
Explore vulnerabilities in connected vehicle APIs and apps, focusing on Subaru's STARLINK. Learn remote exploitation techniques and discuss security improvements for car manufacturers in the IoT era.