Fuzzing Android - A Recipe for Uncovering Vulnerabilities Inside System Components in Android
Explore a fuzzing approach to uncover vulnerabilities in Android's core system components. Learn about data generation, test execution, logging, and triage mechanisms for effective vulnerability detection.
Exploiting Adobe Flash Player in the Era of Control Flow Guard
Explore techniques for exploiting Adobe Flash Player vulnerabilities, bypassing Control Flow Guard, and executing data-only attacks without shellcode or ROP on Windows systems.
Defending Against Malicious Application Compatibility Shims
Explore advanced techniques for creating and detecting malicious application compatibility shims, including in-memory patching, obfuscation, and system subversion. Learn defensive strategies and tools for protection.
In-Security of Backend-As-A-Service
Explore the vulnerabilities in Backend-as-a-Service solutions for mobile apps, revealing widespread security flaws and potential data breaches in cloud-based storage systems.
Implementing Practical Electrical Glitching Attacks
Explore non-invasive electrical glitching techniques to bypass software protections and create exploitable conditions in target devices, including clock and voltage manipulation methods.
How to Break XML Encryption - Automatically
Explore automated attacks on XML Encryption, including vulnerability detection and exploitation techniques. Learn about recent developments, implementation challenges, and practical security implications.
LTE & IMSI Catcher Myths
Explore LTE security vulnerabilities and IMSI catcher techniques. Learn how popular phones can be exploited on 4G networks, with live demonstrations and in-depth analysis of baseband software weaknesses.
Hiding In Plain Sight - Advances In Malware Covert Communication Channels
Explores recent malware techniques using steganography and covert channels to evade detection. Analyzes real-world examples from cybercrime and targeted attacks, detailing implementation and discussing implications.
Going Auth The Rails On A Crazy Train
Explore common authentication and authorization pitfalls in Rails applications, and learn about a new dynamic analysis tool for penetration testing and securing large-scale Rails projects.
Continuous Intrusion - Why CI Tools Are An Attacker's Best Friends
Explore how CI tools can be exploited for attacks, including command execution, credential theft, and privilege escalation, with live demonstrations on popular open-source and proprietary platforms.
Your Scripts In My Page - What Could Possibly Go Wrong?
Explore the security risks of cross-domain script inclusion, including potential data leaks and account compromises. Learn detection methods and defensive measures to protect against these vulnerabilities.
Lessons From Defending The Indefensible
Optimizing infrastructure to defend against DDoS attacks: techniques, experiences, and lessons learned from protecting HTTP/S and DNS services at scale.
Is Your Timespace Safe? - Time and Position Spoofing Opensourcely
Explore GPS spoofing techniques affecting smartphones and smartwatches, including map apps and LBS vulnerabilities. Learn about time spoofing and other positioning methods like WiFi and BLE, with prevention strategies.
Commix - Detecting and Exploiting Command Injection Flaws
Automated tool for detecting and exploiting command injection vulnerabilities in web applications. Covers various exploitation scenarios and reveals 0-day vulnerabilities across different platforms.
Unboxing the White-Box - Practical Attacks Against Obfuscated Ciphers
Explore practical attacks on obfuscated ciphers, focusing on White-Box Cryptography. Learn techniques to assess security, understand vulnerabilities, and evaluate robustness against key extraction in software implementations.
Hey Man, Have You Forgotten to Initialize Your Memory?
Exploiting uninitialized memory in 64-bit IE to bypass ASLR, CFG, and EPM sandbox. Techniques for remote code execution and privilege escalation on Windows 8.1 demonstrated through Pwn2Own contest example.
Cybercrime in the Deep Web
Explore automated detection of cybercrime in anonymous networks beyond TOR, including I2P and FreeNET. Learn about DeWA system for identifying emerging threats in the Deep Web.
Authenticator Leakage Through Backup Channels on Android
Explore Android authentication vulnerabilities through backup channels. Learn about security risks, attack vectors, and mitigation strategies for app developers and protocol analysts.
Watching the Watchdog - Protecting Kerberos Authentication With Network Monitoring
Explore advanced Kerberos attack detection techniques and learn to protect Windows networks using network monitoring. Includes a novel "Diamond PAC" attack variant and the "Kerberos Leash" tool.
Exploit Delivery With Steganography and Polyglots
Explore innovative exploit delivery techniques using steganography and polyglots, focusing on encoding browser exploits in image files for undetectable payload transmission.
The Tactical Application Security Program - Getting Stuff Done
Aprenda a implementar um programa de segurança tático e eficaz, focando em avaliações ágeis, resposta a incidentes e gerenciamento de bugs. Descubra por que abordagens táticas podem ser mais efetivas que estratégias de longo prazo.