Black Hat Courses

Advanced IC Reverse Engineering Techniques - In Depth Analysis Of A Modern Smart Card

Explore advanced IC reverse engineering techniques through in-depth analysis of a modern smart card, focusing on hardware attacks, proprietary algorithms, and efficient analysis methods.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Cloning 3G - 4G SIM Cards With A PC And An Oscilloscope - Lessons Learned In Physical Security

Reveals vulnerabilities in 3G/4G SIM cards, demonstrating how to clone them using differential power analysis. Discusses implications for mobile network security and showcases practical experiments.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Abusing Windows Management Instrumentation - WMI

Explore WMI's potential for stealthy, persistent attacks on Windows systems. Learn offensive techniques, backdoor creation, and defense strategies against WMI-based threats.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

Remote Exploitation of an Unaltered Passenger Vehicle

Comprehensive exploration of remote vehicle hacking, demonstrating real-world attacks on unaltered cars and pivoting through hardware to send CAN bus messages affecting critical systems.

• YouTube
• 52 minutes
• Self-Paced
• Conference Talk

Remote Physical Damage 101 - Bread and Butter Attacks

Explore cyber-physical attacks on industrial systems, including generic "bread and butter" techniques and mitigation strategies beyond network security.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Abusing XSLT for Practical Attacks

Explore XSLT vulnerabilities and practical attacks on XML systems, including arithmetic manipulation, code logic failure, and compromising user confidentiality in web browsers.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

When IoT Attacks - Hacking a Linux-Powered Rifle

Explore the security vulnerabilities of a Linux-powered precision rifle, including reverse engineering, attack surfaces, and implications of network-connected firearms.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Web Timing Attacks Made Practical

Explore practical web timing attacks, improving data collection and statistical analysis for more effective penetration testing. Learn adaptive techniques and open-source tools for identifying cryptographic vulnerabilities.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Breaking HTTPS With BGP Hijacking

Explore BGP hijacking's impact on HTTPS security, revealing vulnerabilities in Internet routing and SSL/TLS PKI. Learn about potential exploits and prevention strategies.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Targeted Takedowns - Minimizing Collateral Damage Using Passive DNS

Explore how Passive DNS can help investigators minimize collateral damage during cyber criminal takedowns, ensuring precise targeting and avoiding harm to innocent parties.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

Server-Side Template Injection - RCE for the Modern Web App

Explore techniques to recognize and exploit template injection vulnerabilities, leading to remote code execution in web applications. Learn automated detection methods and application-specific exploits.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

Emanate Like A Boss - Generalized Covert Data Exfiltration With Funtenna

Explore Funtenna, a software technique for covert data exfiltration through electromagnetic emanations in various computing devices, including its mechanisms, implementations, and implications for network security.

• YouTube
• 55 minutes
• Self-Paced
• Conference Talk

Exploiting the DRAM Rowhammer Bug to Gain Kernel Privileges

Explore the DRAM Rowhammer bug's security implications, from bit flips to kernel privilege escalation. Learn about exploit techniques, mitigations, and the physics behind this hardware vulnerability.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Two Factor Failure

Explore vulnerabilities in Two-Factor Authentication systems, including a new attack on mobile TOTP. Learn best practices for secure 2FA deployment in enterprise and web applications.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Reflected File Download - A New Web Attack Vector

Explore a new web attack vector that allows attackers to download malicious files from trusted domains without uploading them, potentially bypassing security measures and spreading across social networks.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk