COMpromise - Remote Code Execution in Windows Development Environments
Explore how viewing untrusted code in Windows IDEs can lead to remote code execution through COM vulnerabilities, with practical exploit chains for Visual Studio demonstrated.
The Unbearable Lightness of BMCs
Explora vulnerabilidades críticas en dispositivos de gestión remota de centros de datos, revelando riesgos de ejecución de código y movimiento lateral entre servidores y BMCs.
Ruler - From Exchange to DA
Exploración de vulnerabilidades en Microsoft Exchange y Outlook, demostrando nuevos vectores de ataque y ejecución de código remoto a través de VBScript payloads indetectables.
SAP HANA Under the Hood - Attacks and Countermeasures
Exploración de vulnerabilidades y ataques a SAP HANA, incluyendo XSS y ejecución remota de código. Aprende a prevenir y detectar amenazas en sistemas SAP para proteger información crítica empresarial.
Serverless Security - Attack & Defense
Explore serverless security vulnerabilities, attack techniques, and defense strategies through live demos, covering NPM package exploits, RCE, privilege escalation, and insecure defaults in serverless frameworks.
The Silent Spy Among Us - Modern Attacks Against Smart Intercoms
Explore vulnerabilities in smart cloud-based intercoms, including remote code execution and unauthorized access to video streams. Learn about VOIP protocols and security implications in modern intercom systems.
From Zero to Zero Day
Journey from coding challenges to discovering a critical Edge browser vulnerability, with insights on JIT type confusion and browser exploitation.
Messenger Hacking - Remotely Compromising an iPhone through iMessage
Detailed exploration of a remote iPhone exploit via iMessage, covering vulnerability analysis, exploitation techniques, and mitigation strategies for mobile OS and messenger security.
Blue Team Fundamentals
Explore effective strategies to counter common cyber attacks, including credential stuffing, phishing, and RCE attempts, with practical takeaways to enhance your organization's security posture.
Abusing WCF Endpoint for RCE and Privilege Escalation
Explore WCF vulnerabilities in .NET programs, focusing on privilege escalation and remote code execution. Learn to identify and exploit these bugs through a real-world case study.
Repo Jacking - How Github Usernames Expose Projects to RCE
Explore 'repo jacking', a widespread supply chain vulnerability affecting 70,000+ open-source projects. Learn its causes, exploitation methods, and mitigation strategies to protect your GitHub-dependent projects.
How We Analyzed and Built an Exploit PoC for CVE-2022-24086, a Magento RCE - Catalin Filip - DefCamp - 2022
Explore the analysis and exploit development for CVE-2022-24086, a critical Magento RCE vulnerability, presented by a security researcher at DefCamp 2022.
Messenger Hacking- Remotely Compromising an iPhone through iMessage - Deutsche Übersetzung
Detaillierte Einblicke in die Ausnutzung einer iMessage-Sicherheitslücke zur Kompromittierung von iPhones ohne Nutzerinteraktion. Beleuchtet Techniken, Gegenmaßnahmen und Empfehlungen für verbesserte mobile Sicherheit.
Smart Vacuum Cleaners as Remote Wiretapping Devices - Easterhegg - 2019
Exploración de vulnerabilidades en aspiradoras inteligentes Neato Botvac Connected, incluyendo extracción de firmware y ejecución remota de código, con implicaciones para la privacidad y seguridad del hogar.
Snuffleupagus - Killing Bugclasses in PHP 7, Virtual-Patching the Rest
Explore Snuffleupagus, an open-source PHP security module that kills bug classes, implements virtual-patching, and enhances protection against vulnerabilities without modifying application code.
Remote Code Execution via Java Native Deserialization
Explore Java deserialization vulnerabilities, focusing on remote code execution through XML and binary deserialization. Learn about CVEs, tools, and future research in this area.
Bypassing Microsoft Defender for Identity
Explore techniques to bypass Microsoft Defender for Identity, executing high-impact attacks across the kill chain while avoiding detection in on-premises Active Directory environments.
Fuzzing the Phone in the iPhone
Explore iPhone baseband security through fuzzing, revealing vulnerabilities in iOS-baseband interface. Discover unexpected effects on device identity, SMS handling, and location services.
Finding New Bluetooth Low Energy Exploits via Reverse Engineering Multiple Vendors' Firmwares
Explore Bluetooth Low Energy vulnerabilities through firmware reverse engineering, uncovering remote code execution exploits at the protocol's lowest levels without authentication or pairing.
Don't Ruck Us Too Hard - Owning All of Ruckus AP Devices
Explore vulnerabilities in Ruckus AP devices, including pre-authentication remote code execution exploits. Learn about research methods, discovered CVEs, and a framework for cross-architecture analysis.
Contextomy - Let's Debug Together
Explore a critical iOS design flaw allowing remote code execution through debug session hijacking. Learn about the vulnerability's discovery, research, exploitation, and Apple's fix.