Black Hat Courses

The Devil is in the GAN - Defending Deep Generative Models Against Adversarial Attacks

Examines training-time backdoor attacks on deep generative models and defenses for detecting compromised models.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Enter Sandbox

Explores automatically generating Linux seccomp filters from source code and binaries to sandbox applications and block exploitation techniques.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Give Me a SQL Injection, I Shall PWN IIS and SQL Server

Shows how SQL injection and Microsoft JET vulnerabilities can turn IIS and SQL Server into remotely exploitable attack surfaces.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Threat Hunting in Active Directory Environment

Explore how attackers abuse Active Directory for covert persistence and privilege escalation, and how defenders can detect and hunt these techniques.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Domain Borrowing - Catch My C2 Traffic if You Can

Explains domain borrowing, a CDN-based technique for hiding command-and-control traffic from HTTPS inspection and firewall detection.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Reverse Engineering Compliance

Apply reverse-engineering questions and threat modeling to compliance standards, using PCI as a case study to move beyond checkbox security.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

The B-MAD Approach to Threat Modeling

Learn how the “bring me a diagram” approach creates conflict, and how collaborative system modeling and clearer expectations can improve organizational threat modeling.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

How I Can Unlock Your Smart Door - Security Pitfalls in Cross-Vendor IoT Access Control

Exposes how cross-cloud delegation flaws in smart-home IoT access control can let attackers retain or expand access to locks and other devices.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

The Price of Compatibility - Defeating macOS Kernel Using Extended File Attributes

Examines how macOS extended file attributes and FAT compatibility flaws can expose kernel memory and enable attacks through crafted filesystem data.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

The Motion Sensor Western - The Good, the Bad, and the Ugly

Examines how accelerometers and gyroscopes in IoT devices can be attacked to compromise device security and user privacy, including speech recovery and keylogging.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

HTTP/2 - The Sequel is Always Worse

An advanced look at HTTP/2 implementation flaws, downgrade attacks, and request smuggling techniques that expose vulnerabilities across web infrastructure.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Cross-Site Escape - Pwning macOS Safari Sandbox the Unusual Way

A case study of exploiting Safari and privileged macOS WebViews through IPC and JavaScript injection to achieve sandbox escape and native code execution.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

The Hunt for Major League IoT-ICS Threats - A Deep Dive into IoT Threat Terrain

A deep dive into automated, large-scale threat hunting for IoT and ICS, from hunting-engine architecture to malware analysis, IoC generation, and attack-trend detection.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Attacking IOBluetoothFamily HCI and Vendor-Specific Commands

Explore how fuzzing and reverse engineering exposed vulnerabilities in macOS’s IOBluetoothFamily HCI and vendor-specific command handling.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Bypassing NGAV for Fun and Profit

An explainability-guided adversarial attack modifies PE features to make malware evade next-generation antivirus classifiers while preserving functionality.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk