Black Hat Courses

How Your E-book Might Be Reading You - Exploiting EPUB Reading Systems

Uncover security vulnerabilities in e-book reading apps through analysis of EPUB format, revealing potential privacy risks and exploitation techniques across various platforms and devices.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

One Glitch to Rule Them All - Fault Injection Attacks Against the AMD Secure Processor

Explore fault injection attacks on AMD's Secure Processor, revealing vulnerabilities in CPU security and discussing implications for system integrity and trust.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Lost in the Loader - The Many Faces of the Windows PE File Format

Explore Windows PE file format intricacies, parser differentials, and a custom language for modeling loaders. Learn analysis techniques to aid reverse-engineering tasks.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Hand in Your Pocket Without You Noticing - Current State of Mobile Wallet Security

Uncover security flaws in popular mobile payment services, exploring potential fraud scenarios and vulnerabilities in contactless transactions for public transport and retail.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

The Art of Exploiting UAF by Ret2bpf in Android Kernel

Explore Android kernel exploitation techniques, focusing on a Use-After-Free vulnerability in xt_qtaguid. Learn about KASLR bypass, rooting methods, and security measures against such attacks.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Achieving Linux Kernel Code Execution Through a Malicious USB Device

Explore Linux kernel exploitation via malicious USB devices, focusing on CVE-2016-2384 vulnerability. Learn about USB-based attacks, payload delivery, and mitigation strategies.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Owfuzz - WiFi Nightmare

Explore WiFi security vulnerabilities and attack surfaces using Owfuzz, a fuzzing tool for detecting protocol flaws in WiFi implementations, including WIFI6 and WPA3.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

They Hacked Thousands of Cloud Accounts Then Sent Us Weird GIFs

Explore cloud security threats, including crypto-mining worms and innovative techniques targeting AWS, Kubernetes, and other providers. Learn about hackers' methods, persistence strategies, and potential impacts on cloud environments.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

APTs Go Teleworking - The Rise of VPN Exploits

Explore the rise of VPN exploits amid increased remote work, focusing on Pulse Secure vulnerabilities, incident response challenges, and threat actor tactics in cyber espionage campaigns.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Practical HTTP Header Smuggling - Sneaking Past Reverse Proxies to Attack AWS and Beyond

Explore HTTP header smuggling techniques to bypass security measures, attack web applications, and exploit vulnerabilities in proxy servers and AWS services.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Certified Pre-Owned - Abusing Active Directory Certificate Services

Explore AD CS vulnerabilities for credential theft, persistence, and domain escalation. Learn offensive and defensive techniques to secure Active Directory PKI implementations.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Bypassing Windows Hello for Business and Pleasure

Explore vulnerabilities in Windows Hello's face recognition, demonstrating how attackers can bypass this passwordless authentication using a crafted USB device.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

A New Class of DNS Vulnerabilities Affecting Many DNS-as-Service Platforms

Explore novel DNS vulnerabilities affecting major cloud providers, their impact on corporate networks, and potential information leakage. Learn about root causes, exploitation methods, and mitigation strategies.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Bridging Security Infrastructure Between the Data Center and AWS Lambda

Explore secure integration of serverless technology with data center services, focusing on workload identity in AWS Lambda and bridging identity between on-premises and cloud environments.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Breaking Secure Bootloaders

Explore techniques to bypass secure bootloaders, including signature verification vulnerabilities, memory analysis, and firmware update exploits. Learn to identify and exploit weaknesses in modern device protection mechanisms.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk