Black Hat Courses

How to Grow a TREE from CBASS

Innovative binary analysis toolset for cross-platform programs. Integrates with IDA Pro, enabling interactive visualization and on-demand analysis for efficient reverse engineering and vulnerability detection.

• YouTube
• 56 minutes
• Self-Paced
• Conference Talk

Pass the Hash and Other Credential Theft - Reuse - Mitigating Risk

Explore Pass the Hash attacks and Microsoft's recommended mitigations, including credential theft prevention, authentication policies, and platform changes for enhanced cybersecurity.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Hot Knives Through Butter - Bypassing Automated Analysis Systems

Explores advanced techniques used by malware to evade automated analysis systems, including extended sleep calls, mouse click triggers, and timed activation. Provides insights for security professionals on evolving threats.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

BlackBerryOS 10 from a Security Perspective

Comprehensive analysis of BlackBerryOS 10's security architecture, exploring attack surfaces, privilege escalation, remote entry points, rootkit persistence, and the effectiveness of BlackBerry Balance.

• YouTube
• 52 minutes
• Self-Paced
• Conference Talk

Using Online Activity as Digital Fingerprints to Create a Better Spear Phisher

Explore data mining and NLP techniques to profile online activity, creating digital fingerprints for enhanced social engineering. Learn to analyze user interactions, vocabulary, and communication patterns.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

OptiROP - Hunting for ROP Gadgets in Style

Discover efficient ROP gadget hunting with OptiROP, a tool using semantic queries for quick, precise results across executable formats on x86/x64 architectures. Simplify shellcode development.

• YouTube
• 1 hour 7 minutes
• Self-Paced
• Conference Talk

CreepyDOL - Cheap, Distributed Stalking

Explore a low-cost distributed sensing system for personnel tracking and analysis, discussing ethical implications and potential misuse of easily accessible surveillance technology.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Password Hashing - The Future is Now

Explore the future of password hashing, its challenges, and the Password Hashing Competition initiative to develop improved methods for securing digital systems.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Bochspwn - Identifying 0-Days via System-Wide Memory Access Pattern Analysis

Innovative approach to discovering kernel vulnerabilities using CPU-level instrumentation and memory access pattern analysis. Introduces "Bochspwn" project, which identified numerous Windows kernel vulnerabilities.

• YouTube
• 56 minutes
• Self-Paced
• Conference Talk

Mobile Malware - Why the Traditional AV Paradigm Is Doomed

Explore mobile malware threats, limitations of traditional antivirus methods, and innovative approaches like cloud-based screening and hardware-supported security solutions for protecting mobile devices.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

CMX - IEEE Clean File Metadata Exchange

Explore IEEE's CMX system for efficient software whitelisting, reducing false positives in security through metadata exchange without copyright concerns.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Javascript Static Security Analysis Made Easy with JSPrime

Explore JSPrime, a user-friendly tool for JavaScript static security analysis. Learn about its features, including library-aware scanning, variable tracing, and minimal false positives, to enhance your code security.

• YouTube
• 1 hour
• Self-Paced
• Conference Talk

Malicious File for Exploiting Forensic Software

Exploiting vulnerabilities in forensic software file viewers through malicious files, demonstrating code execution and DoS attacks. Includes fuzzing techniques, vulnerability analysis, and countermeasures.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

The Web Is Vulnerable - XSS Defense on the BattleFront

Comprehensive analysis of real-world XSS vulnerabilities and attacks, presenting advanced protection methods and introducing detectXSSlib, a new tool for real-time XSS detection.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

End-to-End Analysis of a Domain Generating Algorithm Malware Family

Comprehensive analysis of a Domain Generating Algorithm malware family, covering deobfuscation, DGA analysis, sinkholing, and attribution of the malware's author and accomplices.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk