Trusts You Might Have Missed
Demystifying domain trusts: Enumeration, visualization, and exploitation techniques for red teams. Learn to leverage trust relationships for domain takeover without exploits.
Light at the End of the Tunnel - Hope for Team Defence
Exploring emerging strategies and positive developments in cybersecurity defense, offering hope and practical solutions for improving security posture in an offense-dominated landscape.
Software Defined Networking - SDN Security
Explore SDN security implications, attack surfaces, and vulnerabilities with live exploit demos. Learn about efforts to enhance SDN controller security and future developments.
Exploiting 64 Bit IE on Windows 8.1 - The Pwn2Own Case Study
Detailed exploration of vulnerabilities and exploit techniques used to compromise 64-bit Internet Explorer on Windows 8.1, including ASLR & CFG bypass and sandbox escape, as demonstrated at Pwn2Own 2015.
Responsible Disclosure - Who Cares
Explore real-world experiences of security researchers attempting responsible disclosure, highlighting challenges, vendor responses, and lessons learned in vulnerability reporting.
Going AUTH the Rails on a Crazy Train
Explore common authentication and authorization pitfalls in Rails applications, and learn about a new dynamic analysis tool for security researchers and developers.
Barbarians at the Gateway - An Examination of the Attacker’s Tool Box
Explore DDoS attack tools, methods, and motivations. Gain insights into attacker patterns and progression for better protection against cyber threats.
Toppling Domino - Testing Security in a Lotus Notes Environment
Explore Lotus Notes/Domino security vulnerabilities and learn effective penetration testing techniques for web servers, native servers, and client-side exploits.
DGA Detection & Optimization
Explore advanced machine learning for network-level DGA detection and the latest crimeware evasion techniques. Learn about botnet elements, forensics, and new detection technologies.
PinPadPwn
Explore vulnerabilities in payment terminals, including memory corruption and code execution risks. Learn about attack surfaces, research approaches, and potential payloads in chip-and-pin systems.
Malware Analysis as a Hobby
Learn to create an efficient, automated environment for analyzing suspected malicious sites and software, even with limited time and budget.
I'm the Guy Your CSO Warned You About
Explore modern social engineering tactics and tools used by cybercriminals, with live demonstrations and practical defense strategies for individuals and organizations.
House of Cards - How Not to Collapse When Bad Things Happen
Discover how to build resilient enterprise security by actively testing defenses, validating controls, and learning from simulated scenarios to prepare for real-world threats and challenges.
Pwning the Nerf Gun
Reversing and hijacking a remote-controlled Nerf tank gun through hardware, firmware, and RF analysis. Includes live demonstration of taking control and potentially shooting the conference organizer.
Weak Analogies Make Poor Realities
Exploring the shift from viewing cybersecurity as risk to security debt, challenging traditional paradigms and proposing a new approach to articulate and measure software security benefits.
Security Module for PHP7 - Killing Bugclasses and Virtual-Patching the Rest
Explore Snuffleupagus, a new PHP security module for killing bug classes and virtual-patching vulnerabilities without modifying application code. Learn its features and implementation.
Bypassing Port-Security In 2018 - Defeating MacSEC and 802.1x-2010
Explore novel techniques for bypassing 802.1x-2010 and MacSEC, discussing weaknesses in EAP and demonstrating improved methods for network penetration using the open-source tool Silent Bridge.
Kill All Humans - Bugs - Machine Learning to the Rescue of Code Review
Explore machine learning techniques for efficient security code reviews, reducing false positives and automating vulnerability classification in large-scale applications.
Reverse Engineering and Bug Hunting on KMDF Drivers
Explore reverse engineering and bug hunting techniques for KMDF drivers, focusing on entry points, IO queues, and implementation vulnerabilities. Gain practical skills for analyzing driver security.
They're All Scorpions - Successful SecOps in a Hostile Workplace
Explore innovative approaches to SecOps in challenging business environments. Learn new security practices and research to effectively manage operations despite limited resources and organizational resistance.
Automating Myself Out of a Job - A Pentesters Guide to Left Shifting Security Testing
Explore techniques for integrating automated security testing into the development process, enabling faster releases while maintaining a strong understanding of application risks.