Black Hat Courses

Multiple Bugs in Multi-Party Computation - Breaking Cryptocurrency's Strongest Wallets

This talk exposes practical attacks against multi-party computation and threshold-signature schemes used to secure enterprise cryptocurrency wallets.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Healthscare – An Insider's Biopsy of Healthcare Application Security

A dissection of healthcare applications exposing design flaws, credential weaknesses, privilege escalation, and patient-data and privacy risks.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Spectra - Breaking Separation Between Wireless Chips

Researchers demonstrate how wireless coexistence interfaces can let compromised Bluetooth firmware attack a phone’s Wi-Fi chip.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Lateral Movement and Privilege Escalation in GCP - Compromise Organizations without Dropping an Implant

Demonstrates how GCP’s ActAs permission enables service-account compromise, privilege escalation, lateral movement, and organization-wide project compromise.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

You Have No Idea Who Sent That Email - 18 Attacks on Email Sender Authentication

Analyze 18 attacks that exploit inconsistencies in SPF, DKIM, and DMARC to spoof email senders and forge authenticated messages.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

An Unauthenticated Journey to Root - Pwning Your Company's Enterprise Software Servers

A technical case study of unauthenticated SAP vulnerabilities enabling remote code execution and root access across connected enterprise servers.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

HTTP Request Smuggling in 2020 - New Variants, New Defenses and New Challenges

Analyzes emerging HTTP request smuggling variants and presents a lightweight socket-layer firewall approach to defending proxies and web servers.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Engineering Empathy - Adapting Software Engineering Principles and Process to Security

A role reversal between security and runtime engineers shows how security teams can scale by adopting software engineering principles, planning, feedback, and DevOps culture.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Hacking the Supply Chain - The Ripple20 Vulnerabilities Haunt Tens of Millions of Critical Devices

A technical deep dive into exploiting Ripple20’s CVE-2020-11901 in the Treck TCP/IP stack, from DNS parsing flaws to arbitrary payload execution.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Stealthily Access Your Android Phones - Bypass the Bluetooth Authentication

A technical presentation of BlueRepli, a Bluetooth vulnerability that bypasses Android authentication to access phonebooks and messages without user interaction.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Web Cache Entanglement - Novel Pathways to Poisoning

Investigate hidden web-cache inconsistencies, parameter cloaking, and cache-key tricks that turn minor flaws into cache-poisoning exploit chains.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

My Cloud is APT's Cloud - Investigating and Defending Office 365

Examine how targeted threat actors compromise, persist in, and exfiltrate data from Microsoft Office 365—and how defenders can detect and disrupt these attacks.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

IMP4GT - IMPersonation Attacks in 4G Networks

An analysis of the IMP4GT attack, showing how missing LTE user-plane integrity protection and IP reflection enable user and network impersonation.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

A Framework for Evaluating and Patching the Human Factor in Cybersecurity

A framework for measuring users’ security awareness and resilience across social engineering attacks using objective behavioral data.

• YouTube
• 21 minutes
• Self-Paced
• Conference Talk

Demystifying Modern Windows Rootkits

A hands-on walkthrough of building a Windows kernel rootkit, including driver loading, network-stack hooking, command execution, and stealth techniques.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk