Black Hat Courses

Heap Layout Optimisation for Exploitation

An automatic black-box search optimizes heap layouts through allocator interactions to create useful corruption conditions for exploitation.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Fed Up Getting Shattered and Log Jammed - A New Generation of Crypto Is Coming

Explore SHA-3’s sponge construction and SHAKE, then see how these modern hash functions underpin cryptographic protocols and handshakes.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Exposing Hidden Exploitable Behaviors in Programming Languages Using Differential Fuzzing

Differential fuzzing exposes undocumented behaviors in several programming languages that can lead to exploitable vulnerabilities.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Automatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing

Targeted protocol fuzzing exposes how differing interpretations of network traffic let attacks evade NGFW and IPS inspection.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

How to Rob a Bank Over the Phone - Lessons Learned from an Actual Social Engineering Engagement

Explore real-world social engineering tactics and defense strategies through an actual bank heist phone call, offering valuable insights for both attackers and defenders in cybersecurity.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

Passive Fingerprinting of HTTP - 2 Clients

A study of passively identifying HTTP/2 clients from connection fingerprints across tens of thousands of user agents and hundreds of implementations.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

Evil Bubbles or How to Deliver Attack Payload via the Physics of the Process

Explore innovative attack vectors in industrial control systems, focusing on exploiting physical processes to bypass security measures and deliver malicious payloads.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages

Explore a novel SSRF exploit technique targeting URL parsers in popular programming languages. Learn about vulnerabilities in Python, PHP, Java, and more, uncovering inconsistencies between parsing and requesting.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

New Adventures in Spying 3G and 4G Users - Locate, Track & Monitor

Unveiling vulnerabilities in 3G/4G networks, introducing novel attack vectors for user tracking and monitoring, and discussing potential privacy implications for mobile users worldwide.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

When IoT Attacks - Understanding the Safety Risks Associated with Connected Devices

Explore the potential physical safety risks of IoT devices being repurposed for malicious attacks, going beyond known cybersecurity threats to examine real-world dangers.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Offensive Malware Analysis - Dissecting OSX/FruitFly via a Custom C&C Server

Explore malware analysis techniques using a custom C&C server for OSX/FruitFly. Learn to decode, monitor, and understand malware behavior for enhanced cybersecurity skills.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Breaking Electronic Door Locks Like You're on CSI - Cyber

Learn techniques for bypassing electronic door locks, exploring vulnerabilities and hacking methods used in popular media depictions of cybersecurity.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Orange is the New Purple - How and Why to Integrate Development Teams with Red - Blue Teams to Build More Secure Software

Explore a new paradigm for integrating development teams with offensive and defensive teams to enhance software security throughout the development lifecycle, fostering knowledge sharing and strengthening defenses.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Hack Microsoft Using Microsoft Signed Binaries

Explore advanced hacking techniques using Microsoft-signed tools, including PowerShell and debuggers, to achieve various attacks and persistence on Windows systems.

• YouTube
• 55 minutes
• Self-Paced
• Conference Talk

CTX - Eliminating BREACH with Context Hiding

Explore advanced techniques to mitigate BREACH attacks in web applications using compression and encryption. Learn about Context Hiding and its implementation in practical scenarios.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk