Portable Data exFiltration - XSS for PDFs
Explore PDF vulnerabilities and learn how a single HTTP link can compromise PDF contents, exposing security risks in widely-used document formats and generators.
This is for the Pwners - Exploiting a WebKit 0-day in PlayStation 4
Explore WebKit exploitation techniques for PlayStation 4, focusing on browser vulnerabilities as entry points for full-chain attacks. Learn about hardening challenges and cutting-edge exploit development.
The Most Secure Browser? Pwning Chrome from 2016 to 2019
Explore Chrome browser security vulnerabilities and exploitation techniques from 2016 to 2019, presented by researchers who successfully pwned Nexus 6P in Mobile Pwn2Own 2016.
Dark Fairytales from a Phisherman Vol II
Explore advanced phishing techniques, leveraging tools like Phishing Frenzy and BeEF for effective campaigns. Learn from real-world statistics and engaging hacking stories to enhance your cybersecurity skills.
HTTPS Can Byte Me
Explore HTTPS vulnerabilities and security implications with industry experts, gaining insights into potential risks and mitigation strategies for secure web communication.
PHP WAF - Intercept and Monitor Application Attacks
Explore integrating WAF capabilities into PHP applications for enhanced security. Learn to intercept attacks, monitor user activity, and implement a skeleton security framework.
What Do You Mean My Security Tools Don't Work on APIs?
Explores techniques for securing APIs and modern service-based web applications, discussing challenges and innovative approaches like security instrumentation for vulnerability identification and protection.
The Self Healing Cloud - Protecting Applications and Infrastructure with Automated Virtual Patching
Explore automated virtual patching for cloud security, protecting apps and infrastructure through innovative techniques like web application firewalls and network intrusion detection.
How NOT to Implement Cryptography for the OWASP Top 10 Reloaded
Learn common cryptography implementation mistakes and best practices for securing applications against OWASP Top 10 vulnerabilities with expert Anthony J Stieber.
Beauty and the Beast - Diverting Modern Web Browsers to Build Unique Browser Fingerprints
Explore how modern web technologies enable unique browser fingerprinting, its effectiveness on various devices, and potential privacy implications in the evolving digital landscape.
Signing Me onto Your Accounts through Facebook and Google - A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services
Explores security vulnerabilities in popular web-based single sign-on systems, uncovering critical flaws that allow unauthorized access to user accounts on major platforms.
Does Certificate Transparency Break the Web? Measuring Adoption and Error Rate
Exploring Certificate Transparency adoption, challenges, and impact on web security. Analyzes deployment strategies, error rates, and lessons for future large-scale security implementations.
Fingerprinting the Fingerprinters - Learning to Detect Browser Fingerprinting Behaviors
Explore techniques to detect and analyze browser fingerprinting behaviors, enhancing online privacy protection and understanding digital tracking methods.
ARBITRAR - User-Guided API Misuse Detection
Explore user-guided techniques for detecting API misuse, enhancing software reliability and security through advanced analysis methods.
Spook.js - Attacking Chrome Strict Site Isolation via Speculative Execution
Explore a novel attack on Chrome's Strict Site Isolation, leveraging speculative execution to bypass security measures and potentially compromise user data.
Spring Security for N00bz - A Quick Introduction for the Terminally Insecure
Comprehensive introduction to Spring Security, covering defense-in-depth strategies and live coding demonstrations for securing applications using open-source tools.
Designing Secure APIs
Improve API security design using tools and guidelines. Learn about JSON complexities, schemas, JWTs, rate-limiting, and enforcing rules with OpenAPI and static analysis tools.
The Past, Present, and Future of Cross-Site - Cross-Origin Request Forgery
Explore the evolution of Cross-Site Request Forgery attacks, their impact on applications, and effective defense strategies for both traditional and API-based systems.
Web Cache Deception Attack
Explore the Web Cache Deception attack, a new vector exposing sensitive user data through server and caching manipulation. Learn about risks, conditions, and mitigation strategies.
Game of Chromes - Owning the Web with Zombie Chrome Extensions
Explore how malicious Chrome extensions can create botnets, distribute themselves, and exploit vulnerabilities. Learn about attack patterns, extension capabilities, and security measures.
How to Leak a 100-Million-Node Social Graph in Just One Week
Exploración de vulnerabilidades en OAuth 2.0 para redes sociales, demostrando cómo la suplantación de aplicaciones puede llevar a la filtración masiva de datos de usuarios y gráficos sociales.