Hack In The Box Security Conference Courses

Summer of Fuzz - MacOS

Explore overlooked attack surfaces on macOS through fuzzing techniques. Learn to bypass security protections, debug effectively, and use new tools for crash triage in Apple core apps and services.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Exploiting UAF by Ret2bpf in Android Kernel

Exploiting a 10-year-old Use-After-Free vulnerability in Android's xt_qtaguid kernel module, demonstrating local privilege escalation on Mi9 device using ret2bpf technique to bypass protections.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

Make JDBC Attacks Brilliant Again

Explore advanced JDBC attack techniques, including 0day vulnerabilities in popular systems. Learn about XXE and RCE issues, and gain insights from experienced security researchers.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

SHADOWPAD - Chinese Espionage Malware-as-a-Service

Comprehensive analysis of SHADOWPAD malware: its origin, usage patterns, and business model. Explores its impact on Chinese cyber espionage and the evolving threat landscape.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Dissecting Phishing Techniques of CloudDragon APT

Análisis detallado de las sofisticadas técnicas de phishing del grupo APT norcoreano CloudDragon, incluyendo casos reales, métodos para evadir la autenticación de dos factores y propagación a sistemas Android.

• YouTube
• 57 minutes
• Self-Paced
• Conference Talk

A QEMU Black Box Escape Via USB Device

Exploring a QEMU virtual machine escape technique using USB device vulnerabilities, focusing on black box scenarios without prior system information for enhanced cloud security.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

The Rise of Potatoes - Privilege Escalation in Windows Services

Exploring advanced privilege escalation techniques in Windows services, including a new 0day NTLM relay attack. Covers recent methods, Windows Service Hardening, and the RemotePotato0 attack vector.

• YouTube
• 1 hour
• Self-Paced
• Conference Talk

Hack Out of the Box - Discovering 10+ Vulnerabilities in VirtualBox

Discover 10+ VirtualBox vulnerabilities through custom fuzzing techniques. Learn about attack surfaces, exploit primitives, and see a live box escape demonstration.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Mind the Bridge - A New Attack Model for Hybrid Mobile Applications

Unveils a novel attack model for hybrid mobile apps, exploiting JavaScript bridges. Presents vulnerability models, explores embedded browser architecture, and proposes mitigation strategies for enhanced security.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

The State of Mobile Security

Exploración del panorama actual de la seguridad móvil, incluyendo amenazas recientes, técnicas de detección, investigación forense y la iniciativa FreeTheSandbox para mejorar el acceso y control de los usuarios sobre sus dispositivos.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

One Stop Anomaly Shop

Comprehensive machine learning framework for anomaly detection in datasets. Enables custom preprocessing, enhances accuracy on small datasets, and targets security threats efficiently.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Utilizing Lol-Drivers in Post Exploitation Tradecraft

Exploring kernel-mode attack techniques using signed drivers for post-exploitation, including credential dumping, process injection, and C2 communication. Demos showcase practical applications for red teams.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

MacOS Security - Escaping The Sandbox & Bypassing TCC

Explore macOS security measures, including sandboxing and TCC, and learn about potential vulnerabilities and bypass techniques in third-party applications and system components.

• YouTube
• 55 minutes
• Self-Paced
• Conference Talk

Should You Be Afraid of Hands-On Payment Devices?

Unveiling vulnerabilities in Point of Sale terminals: from anti-tampering mechanisms to cloning. Explore the lifecycle of popular devices and the hacking techniques used to compromise payment security.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Grid Computing Attacks on Streaming Services

Uncovers vulnerabilities in grid computing-based live streaming platforms, demonstrating potential for screen manipulation, unauthorized access, and system compromise. Highlights risks in popular Korean services.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk