NoJITsu - Locking Down JavaScript Engines
Explore data-only attacks on JavaScript engines and learn defensive strategies to secure JIT compilers against modern threats in web browsers and interactive applications.
Blockchain Autopsies - Analyzing Ethereum Smart Contract Deaths
Explore Ethereum smart contract vulnerabilities, reverse engineering techniques, and new tools for analyzing blockchain attacks through real-world examples and practical demonstrations.
Reversing a Japanese Wireless SD Card - From Zero to Code Execution
Discover how to reverse engineer a wireless SD card's firmware using open-source tools, uncovering its architecture and operating system to achieve code execution.
ACSploit - Exploit Algorithmic Complexity Vulnerabilities
Explore techniques to identify and exploit algorithmic complexity vulnerabilities, focusing on inefficient worst-case scenarios and their impact on program performance and security.
Do You Speak My Language? Make Static Analysis Engines Understand Each Other
Explore a novel framework for cross-language taint-flow analysis, enabling detection of critical security vulnerabilities across multiple codebases and programming languages.
Abusing XSLT for Practical Attacks
Explore XSLT vulnerabilities and practical attacks on XML systems, including arithmetic manipulation, code logic failure, and compromising user confidentiality in web browsers.
Blended Web and Database Attacks on Real-Time, In-Memory Platforms
Explore innovative attack vectors on real-time, in-memory platforms, blending web and database vulnerabilities. Learn about new SQL injection techniques, server-side JavaScript exploits, and R-based attacks in SAP HANA.
PDF Attack - A Journey from the Exploit Kit to the Shellcode
Explore PDF-based attacks, from exploit kits to shellcode analysis. Learn to extract and analyze obfuscated JavaScript, modify malicious PDFs, and understand cybercriminal techniques using peepdf tool.
Next Generation Disassembly Framework
Explore next-gen disassembly framework for multi-architecture binary analysis. Learn about Capstone engine's features, design challenges, and potential applications in reversing, exploit development, and malware detection.
C++11 Metaprogramming Applied to Software Obfuscation
Explore advanced C++11 metaprogramming techniques for software obfuscation, including compile-time code generation, polymorphism, and practical applications like string encryption and call obfuscation.
Scala Security - Examining the Play and LiftWeb Frameworks
Explore security aspects of Scala's Play and LiftWeb frameworks, including OWASP Top 10 vulnerabilities, exploitation mitigations, and a new Scala library for SSRF prevention.
WebKit Everywhere - Secure or Not?
Explore WebKit security, vulnerabilities, and exploitation techniques across platforms. Learn about security enhancements, mitigation strategies, and advanced exploit methods with real-world demos.
The Perl Jam 2 - The Camel Strikes Back
Exploring critical vulnerabilities in Perl's core modules and CGI frameworks, demonstrating fundamental language issues through 0-days, and challenging the "developer's fault" narrative.
Exploit Delivery With Steganography and Polyglots
Explore innovative exploit delivery techniques using steganography and polyglots, focusing on encoding browser exploits in image files for undetectable payload transmission.
Attacking ECMAScript Engines With Redefinition
Explore vulnerabilities in ECMAScript engines through function redefinition, examining implementation differences and strategies for identifying security issues in various targets.
Hey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcelization Vulnerabilities in Android
Explore Android's Binder IPC vulnerabilities through fuzzing and exploitation techniques. Learn to identify, analyze, and exploit "BadParcel" issues for privilege escalation in high-privilege processes.
PLC-Blaster - A Worm Living Solely in the PLC
Demonstration of a self-contained PLC worm targeting Siemens S7-1200 PLCs, showcasing network scanning, self-propagation, and remote control capabilities while evading detection.
Over the Edge - Silently Owning Windows 10's Secure Browser
Exploiting Windows 10's memory deduplication feature to silently compromise Microsoft Edge, bypassing security measures and gaining arbitrary memory access through JavaScript-based attacks.
Client-Side Protection Against DOM-Based XSS Done Right
Comprehensive analysis of Chrome's XSS Auditor, revealing vulnerabilities and proposing an improved filter design using client-side taint tracking for robust DOM-XSS protection.
Untangling the DOM for More Easy-Juicy Bugs
Explore dynamic JavaScript analysis with Hookish!, an open-source Chrome extension for penetration testing. Learn to uncover DOM-based vulnerabilities and enhance web app security assessments.
Tracking App Behaviors With - Nothing Changed - Phone For Evasive Android Malware
Explore advanced techniques for tracking and analyzing evasive Android malware behaviors, including obfuscation, dynamic code loading, and native-level monitoring, without modifying the phone's OS.