Hook, Line and Sinker - Pillaging API Webhooks
Explore techniques for exploiting API webhooks, including SSRF attacks that can lead to cloud compromise, and learn about unique attack vectors in modern web services.
I Thought Writing a Technical Book Was Supposed to Be Fun?
Explore the journey of writing and publishing a 400-page security book, from initial concept to final product, with insights into the realities of the process.
From the Cluster to the Cloud and Back to the Cluster - Lateral Movements in Kubernetes
Explore Kubernetes lateral movements, identity types, and cluster-to-cloud authentication methods. Learn about real-world misconfigurations leading to cluster takeovers and prevention strategies.
Privacy-Friendly QR Codes for Identity
Explore secure QR code frameworks for identity verification, focusing on privacy features that allow selective attribute disclosure. Learn about SMART Health Cards and a new open-source specification.
Public, Verifiable, and Unbiasable Randomness - Wassat?
Explore randomness types, their importance, and applications. Learn about drand, a distributed randomness software, and its role in providing public, verifiable randomness as a service.
Passive Recon & Intelligence Collection Using Cyber-Squatted Domains
Explore passive intelligence gathering through domain squatting, including low-cost techniques, data analysis, and defensive strategies against this cyber threat.
Tell Me Where You Live and I Will Tell Your Password
Explores factors influencing password quality across countries, revealing literacy levels and internet usage impact. Aims to understand macrosocial protection factors for adapting password lists.
What Lies Behind Canada's Internet Regulation Reversal?
Exploring Canada's shift from pro-innovation to regulatory approach in Internet policy, covering broadcast, news media, online harms, and privacy regulations. Unpacks recent developments and government plans.
Advanced Process Injection Techniques
Hands-on workshop exploring APT tactics for privilege escalation and persistence. Learn to develop stealthy implants through 7 labs on Windows process injection techniques.
Web Application Firewall Workshop
Hands-on workshop exploring Web Application Firewall bypass techniques, including encoding, SQL injection, protocol switching, and syntax alternatives. Practical exercises with in-depth explanations for each method.
Request Smuggling 101
Explore HTTP Request Smuggling attacks, risks, and payloads. Learn to detect and mitigate vulnerabilities in load balancers and proxies. Includes live demonstration and practical mitigation strategies.
Burnout - Destabilizing Retention Goals and Threatening Organizational Security
Explore strategies to prevent burnout in cybersecurity professionals, improve talent retention, and maintain organizational security through effective mental health support and skill development.
Security Metrics That Matter
Learn to identify and utilize security metrics that truly matter for effective organizational protection, focusing on improvement and smart resource allocation.
Forensicating Endpoint Artifacts in the World of Cloud Storage Services
Explore key forensic artifacts in cloud storage services like OneDrive and Dropbox, focusing on data exfiltration detection and acquisition techniques for endpoint investigations.
What Are Containers Exactly and Can They Be Trusted?
Explore container technologies, their evolution, security features, and management tools. Compare application and system containers, and learn to choose the right container for your needs.
Homeward Bound - Scanning Private IP Space with DNS Rebinding
Explore DNS Rebinding attacks, their resurgence, and tools for network reconnaissance from inside browsers. Learn about a "localhost census" page that enumerates HTTP services on visitors' computers.
Smart Contract Vulnerabilities
Explore famous smart contract vulnerabilities, including the DAO hack and Parity wallet issues. Learn Ethereum's quirks and general principles of smart contract security.
Only an Electron Away from Code Execution
Explore security vulnerabilities in Electron framework, focusing on XSS risks in desktop applications. Learn about attack vectors, CVEs, and see live demos of exploiting vulnerable Electron apps.
Attacking Linux Moose Unraveled an Ego Market
Unraveling a large-scale botnet conducting social media fraud through honeypots and HTTPS man-in-the-middle attacks. Explores technical details, methodology, and market dynamics behind social media fraud.
Deep Dive Into Tor Onion Services
Explore Tor onion services: their evolution, security improvements, and critical applications. Learn about the new design's enhanced privacy, scalability, and development status.
Modern Reconnaissance Phase by APT - Protection Layer
Evolving APT reconnaissance techniques using malicious documents and watering hole attacks. Detailed analysis of obfuscation methods, scripting languages, and mitigation strategies for enhanced cybersecurity.