Responsible Disclosure - Who Cares
Explore real-world experiences of security researchers attempting responsible disclosure, highlighting challenges, vendor responses, and lessons learned in vulnerability reporting.
Going AUTH the Rails on a Crazy Train
Explore common authentication and authorization pitfalls in Rails applications, and learn about a new dynamic analysis tool for security researchers and developers.
Barbarians at the Gateway - An Examination of the Attacker’s Tool Box
Explore DDoS attack tools, methods, and motivations. Gain insights into attacker patterns and progression for better protection against cyber threats.
Toppling Domino - Testing Security in a Lotus Notes Environment
Explore Lotus Notes/Domino security vulnerabilities and learn effective penetration testing techniques for web servers, native servers, and client-side exploits.
Big Game Hunting
Discover simple techniques for bug hunting on AIX and IBM products, building on "Breaking The Links" methodology and exploring new vulnerabilities.
DGA Detection & Optimization
Explore advanced machine learning for network-level DGA detection and the latest crimeware evasion techniques. Learn about botnet elements, forensics, and new detection technologies.
PinPadPwn
Explore vulnerabilities in payment terminals, including memory corruption and code execution risks. Learn about attack surfaces, research approaches, and potential payloads in chip-and-pin systems.
Malware Analysis as a Hobby
Learn to create an efficient, automated environment for analyzing suspected malicious sites and software, even with limited time and budget.
I'm the Guy Your CSO Warned You About
Explore modern social engineering tactics and tools used by cybercriminals, with live demonstrations and practical defense strategies for individuals and organizations.
Why Integrity Is Left Alone and Not Given the TLC It Deserves
Exploring the neglected aspect of data integrity in information security, its importance for business decisions, and practical solutions for ensuring data accuracy.
House of Cards - How Not to Collapse When Bad Things Happen
Discover how to build resilient enterprise security by actively testing defenses, validating controls, and learning from simulated scenarios to prepare for real-world threats and challenges.
How to Explain Post-Quantum Cryptography to a Middle School Student
Demystifying post-quantum cryptography: Learn about five families of crypto systems resistant to quantum computing, explained through simple analogies and everyday objects like Rubik's Cubes and braids.
Pwning the Nerf Gun
Reversing and hijacking a remote-controlled Nerf tank gun through hardware, firmware, and RF analysis. Includes live demonstration of taking control and potentially shooting the conference organizer.
Weak Analogies Make Poor Realities
Exploring the shift from viewing cybersecurity as risk to security debt, challenging traditional paradigms and proposing a new approach to articulate and measure software security benefits.
Security Module for PHP7 - Killing Bugclasses and Virtual-Patching the Rest
Explore Snuffleupagus, a new PHP security module for killing bug classes and virtual-patching vulnerabilities without modifying application code. Learn its features and implementation.
Bypassing Port-Security In 2018 - Defeating MacSEC and 802.1x-2010
Explore novel techniques for bypassing 802.1x-2010 and MacSEC, discussing weaknesses in EAP and demonstrating improved methods for network penetration using the open-source tool Silent Bridge.
Kill All Humans - Bugs - Machine Learning to the Rescue of Code Review
Explore machine learning techniques for efficient security code reviews, reducing false positives and automating vulnerability classification in large-scale applications.
Reverse Engineering and Bug Hunting on KMDF Drivers
Explore reverse engineering and bug hunting techniques for KMDF drivers, focusing on entry points, IO queues, and implementation vulnerabilities. Gain practical skills for analyzing driver security.
They're All Scorpions - Successful SecOps in a Hostile Workplace
Explore innovative approaches to SecOps in challenging business environments. Learn new security practices and research to effectively manage operations despite limited resources and organizational resistance.
Automating Myself Out of a Job - A Pentesters Guide to Left Shifting Security Testing
Explore techniques for integrating automated security testing into the development process, enabling faster releases while maintaining a strong understanding of application risks.
So You Want to Red Team?
Explore red teaming skills, career paths, and the Fortis open-source lab for simulating enterprise environments. Learn to transition from pen testing and develop advanced cybersecurity techniques legally.