Blended Web and Database Attacks on Real-Time, In-Memory Platforms
Explore innovative attack vectors on real-time, in-memory platforms, blending web and database vulnerabilities. Learn about new SQL injection techniques, server-side JavaScript exploits, and R-based attacks in SAP HANA.
Hack Your ATM with Friend's Raspberry Pi
Explore ATM vulnerabilities and hacking techniques using Raspberry Pi, focusing on device interfaces and communication protocols. Learn about potential security risks and countermeasures in ATM systems.
Network Attached Shell - N.A.S.ty Systems that Store Network Accessible Shells
Explore critical vulnerabilities in network storage devices, their impact on data security, and potential for network exploitation. Learn about attack techniques and implications for IT professionals and consumers.
Charge Your Device with the Latest Malware
Exposición de vulnerabilidades USB en sistemas Android personalizados, con demostración de ataque y escenario práctico, revelando implicaciones y logrando acceso root.
The Power of Pair - One Template that Reveals 100+ UAF IE Vulnerabilities
Discover a unique fuzzing strategy that revealed over 100 IE use-after-free vulnerabilities. Learn about the vulnerability hunting system and techniques used to find critical browser security flaws.
Man in the Binder - He Who Controls IPC, Controls the Droid
Explore Android's Binder IPC system, its security implications, and potential vulnerabilities through a POC rootkit demonstration and in-depth analysis of low-level Binder operations.
Bypassing HTTP Strict Transport Security
Explore vulnerabilities in HTTP Strict Transport Security (HSTS) and learn how attackers can exploit inter-operation weaknesses to bypass this protection and launch SSLStrip attacks.
Cellular Exploitation on a Global Scale - The Rise and Fall of the Control Protocol
Explore hidden cellular device controls, their vulnerabilities, and potential for global exploitation. Learn reverse engineering techniques and gain insights into Over-the-Air code execution across major platforms.
Next Generation Disassembly Framework
Explore next-gen disassembly framework for multi-architecture binary analysis. Learn about Capstone engine's features, design challenges, and potential applications in reversing, exploit development, and malware detection.
Server-Side Template Injection - RCE for the Modern Web App
Explore techniques to recognize and exploit template injection vulnerabilities, leading to remote code execution in web applications. Learn automated detection methods and application-specific exploits.
Attacking the Linux PRNG on Android
Explore vulnerabilities in Android's Linux PRNG, focusing on early boot attacks and real-world exploitation vectors. Learn about potential security risks and mitigations for embedded platforms.
Ret2dir - Deconstructing Kernel Isolation
Explore kernel exploitation technique ret2dir, bypassing isolation protections by leveraging direct-mapped memory. Learn about vulnerabilities, attack models, and mitigation strategies for Linux kernels.
Revisiting XSS Sanitization
Explore XSS vulnerabilities in popular WYSIWYG editors and learn an effective sanitization technique using minimal characters and regular expressions to prevent attacks across various contexts.
Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers
Explore XSS-based attacks on browser password managers, their vulnerabilities, and potential solutions. Learn about password field usage on popular websites and get recommendations for protection.
Exploiting Adobe Flash Player in the Era of Control Flow Guard
Explore techniques for exploiting Adobe Flash Player vulnerabilities, bypassing Control Flow Guard, and executing data-only attacks without shellcode or ROP on Windows systems.
Going Auth The Rails On A Crazy Train
Explore common authentication and authorization pitfalls in Rails applications, and learn about a new dynamic analysis tool for penetration testing and securing large-scale Rails projects.
Continuous Intrusion - Why CI Tools Are An Attacker's Best Friends
Explore how CI tools can be exploited for attacks, including command execution, credential theft, and privilege escalation, with live demonstrations on popular open-source and proprietary platforms.
Commix - Detecting and Exploiting Command Injection Flaws
Automated tool for detecting and exploiting command injection vulnerabilities in web applications. Covers various exploitation scenarios and reveals 0-day vulnerabilities across different platforms.
Hey Man, Have You Forgotten to Initialize Your Memory?
Exploiting uninitialized memory in 64-bit IE to bypass ASLR, CFG, and EPM sandbox. Techniques for remote code execution and privilege escalation on Windows 8.1 demonstrated through Pwn2Own contest example.
FileCry - The New Age of XXE
Explore critical XXE vulnerabilities in enterprise software, including 0-day exploits in Java and Internet Explorer. Learn detection, exploitation, and prevention techniques.
Bypass Control Flow Guard Comprehensively
Analyze CFG's weaknesses and explore a new technique to bypass it, enabling previously prevented exploit methods and opening avenues for developing more advanced exploit techniques.