Black Hat Courses

Delegate to the Top - Abusing Kerberos for Arbitrary Impersonations and RCE

Explore Kerberos delegation vulnerabilities in Windows networks, learning techniques for unauthorized impersonation and remote code execution. Gain insights into potential security risks and mitigation strategies.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Attack on Titan M, Reloaded - Vulnerability Research on a Modern Security Chip

Vulnerability research on Google’s Titan M security chip, combining firmware fuzzing and emulation to uncover a zero-day enabling code execution and StrongBox key leakage.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Attacks From a New Front Door in 4G & 5G Mobile Networks

Investigates how API exposure in 4G and 5G networks creates attack paths into IoT platforms, devices, and critical infrastructure.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

AAD Joined Machines - The New Lateral Movement

Explore lateral movement between Azure AD joined machines through a new authentication protocol, Pass-the-Certificate attacks, and network-based detection.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Better Privacy Through Offense - How to Build a Privacy Red Team

Learn how privacy red teams differ from security red teams and how to build operations that uncover privacy weaknesses.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Whip the Whisperer - Simulating Side Channel Leakage

Use pre-silicon power simulation to find and localize side-channel leakage in cryptographic hardware before fabrication.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Bug Bounty Evolution - Not Your Grandson's Bug Bounty

An examination of how bug bounty programs have evolved, where their incentives and labor practices fall short, and how organizations can build more mature vulnerability coordination.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Taking Kernel Hardening to the Next Level

A technical talk on advancing kernel defenses with pointer-authentication-based control-flow integrity and scalable use-after-free protection.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Bypass CFG in Chrome

An examination of whether established Control-Flow Guard bypass techniques still work against Chrome.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

ChaosDB - How We Hacked Databases of Thousands of Azure Customers

A technical walkthrough of ChaosDB, chaining Azure Cosmos DB vulnerabilities to escape a Jupyter container, access internal services, and compromise customer databases.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

TeamTNT - Explosive Cryptomining

A chronological analysis of TeamTNT’s cryptojacking campaigns, from Redis exploitation to Docker and Kubernetes targeting, credential theft, lateral movement, and rootkits.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Recertifying Active Directory Certificate Services

Learn to defend Active Directory Certificate Services by auditing certificate templates, detecting abuse, and planning incident response for certificate-based domain attacks.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Zen and the Art of Adversarial Machine Learning

Operational guidance for attacking machine-learning models through extraction, evasion, inversion, membership inference, poisoning, and adversarial ML assessment.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

HTTP/2 - The Sequel is Always Worse

Explores HTTP/2 downgrades, tunneling, and malformed requests that enable request smuggling, cache poisoning, and cross-user response attacks.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures

Explores Windows Defender’s Attack Surface Reduction rules and undocumented signature formats, showing how their implementation can be analyzed and bypassed during security audits.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk