Black Hat Courses

Chained to Hit - Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software

Unveiling critical vulnerabilities in SAP enterprise software through analysis of the "P4" protocol, demonstrating tactics and techniques for remote and root access exploitation in mission-critical business systems.

• YouTube
• 36 minutes
• On-Demand
• Conference Talk

Zero-Touch-Pwn - Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones

Uncover vulnerabilities in Zoom's Zero Touch Provisioning for desk phones, exploring potential remote attacks and security implications in cloud communication platforms.

• YouTube
• 31 minutes
• On-Demand
• Conference Talk

Unveiling the Cracks in Virtualization - VMware Workstation Escape

Explore VMware Workstation vulnerabilities, focusing on USB controller exploits. Learn about information leakage, arbitrary read/write, and bypassing Windows protections in virtualization escapes.

• YouTube
• 37 minutes
• On-Demand
• Free Video

URB Excalibur - New VMware All-Platform VM Escapes

Unveils groundbreaking research on VMware hypervisor vulnerabilities, focusing on virtual USB controllers. Demonstrates novel VM escape techniques using URB, showcasing a critical heap out-of-bounds write vulnerability across all VMware platforms.

• YouTube
• 39 minutes
• On-Demand
• Free Video

Escaping Modern Web-Based App Sandboxes - Site Isolation Vulnerabilities

Explore Chrome's site isolation vulnerabilities in web-based apps, revealing how attackers can bypass security measures to execute malicious actions and compromise user data.

• YouTube
• 36 minutes
• On-Demand
• Free Video

The Key to Remote Vehicle Control - Autonomous Driving Domain Controller

Explore security risks in autonomous driving controllers, including hardware structure, testing methods, and potential vulnerabilities. Learn to extract AI models and control vehicles remotely.

• YouTube
• 33 minutes
• On-Demand
• Free Video

The Dark Side of EDR - Repurposing EDR as an Offensive Tool

Explore innovative attack vector transforming EDR into stealthy malware. Learn to bypass security features, exfiltrate data, and establish persistent control, focusing on Palo Alto Networks Cortex XDR.

• YouTube
• 43 minutes
• On-Demand
• Free Video

The Fault in Our Metrics - Rethinking How We Measure Detection and Response

Rethinking cybersecurity metrics: Learn to develop meaningful measurements for detection and response capabilities, avoiding pitfalls of traditional metrics and motivating teams effectively.

• YouTube
• 41 minutes
• On-Demand
• Free Video

SystemUI as EvilPiP - Hijacking Attacks on Modern Mobile Devices

Reveals new Android attack surface 'PiP', exploiting vulnerabilities to bypass security measures and perform stealthy hijacking attacks on modern devices without permissions or user awareness.

• YouTube
• 33 minutes
• On-Demand
• Free Video

Magicdot - A Hacker's Magic Show of Disappearing Dots and Spaces

Explore Windows vulnerabilities related to file naming, leading to hidden files, process concealment, and remote code execution. Learn unprivileged rootkit techniques and attack chains.

• YouTube
• 37 minutes
• On-Demand
• Free Video

LLM4Shell - Discovering and Exploiting RCE Vulnerabilities in LLM-Integrated Frameworks

Uncover critical RCE vulnerabilities in LLM-integrated frameworks and apps. Learn automated exploitation methods, potential impacts, and essential mitigation strategies for securing AI-powered systems.

• YouTube
• 36 minutes
• On-Demand
• Free Video

LLMs at the Core - From Attention to Action in Scaling Security Teams

Explore practical tools leveraging LLMs to scale security teams, streamline workflows, and enhance decision-making in complex environments. Gain insights on automating tasks and improving security processes.

• YouTube
• 43 minutes
• On-Demand
• Free Video

How to Get the Most Out of Python Decompilers Uncompyle6 and Decompyle3

Explore Python bytecode decompilers Uncompyle6 and Decompyle3. Learn tips, tricks, and novel techniques for recreating source code from bytecode, applicable to other languages and potential machine learning applications.

• YouTube
• 44 minutes
• On-Demand
• Free Video

From BYOVD to 0-Day - Unveiling Advanced Exploits in Cyber Recruiting Scams

Unveiling sophisticated cyber-attacks disguised as job recruitment, featuring 0-day exploits and advanced rootkit capabilities. Explores novel attack methods targeting Asia, bypassing security measures.

• YouTube
• 37 minutes
• On-Demand
• Free Video

EDR Reloaded - Exploiting Endpoint Security Vulnerabilities for Remote Data Erasure

Unveils critical vulnerability allowing remote data deletion in endpoint security products. Demonstrates attack vectors, explains root cause, and showcases bypass of Microsoft patch, impacting databases and system logs.

• YouTube
• 40 minutes
• On-Demand
• Free Video