Black Hat Courses

Xenpwn - Breaking Paravirtualized Devices

Explore vulnerabilities in paravirtualized devices using Xenpwn, a hypervisor-based memory access tracing tool, to discover critical security flaws in Xen hypervisor drivers.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It

Explore Windows 10's AntiMalware Scan Interface (AMSI) for script-based attack prevention. Discover its effectiveness, limitations, and potential workarounds through live demonstrations and expert analysis.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Crippling HTTPS with Unholy PAC

Explore how malicious Proxy AutoConfiguration can compromise HTTPS security, leak sensitive data, and enable cross-platform attacks, even on secure networks and browsers.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

Intra-Process Memory Protection for Applications on ARM and X86 - Leveraging the ELF ABI

Explore intra-process memory protection techniques for ARM and X86 architectures using ELF ABI. Learn about ELFbac system implementation, policy enforcement, and practical applications in software security.

• YouTube
• 52 minutes
• Self-Paced
• Conference Talk

Ways to Die in Mobile OAuth

Comprehensive analysis of OAuth vulnerabilities in mobile apps, revealing widespread implementation flaws and security risks. Offers insights for developers to enhance mobile OAuth security.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Viral Video - Exploiting SSRF in Video Converters

Exploiting SSRF vulnerabilities in video converters using HLS playlists, potentially leading to critical security breaches in cloud-based services. Includes demonstration of attacks on major platforms.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Auditing the Compression Algorithm Weapon Cache

Explore decompression bomb attacks, their impact on applications, and strategies for prevention. Learn about various compression algorithms and their vulnerabilities in this security-focused presentation.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Recover a RSA Private Key From a TLS Session With Perfect Forward Secrecy

Explore RSA private key recovery from TLS sessions with Perfect Forward Secrecy, focusing on faulty digital signatures and hardware vulnerabilities in network devices.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

AVLeak - Fingerprinting Antivirus Emulators for Advanced Malware Evasion

Explore AVLeak, a tool for fingerprinting antivirus emulators through automated testing. Learn advanced techniques for detecting and evading popular consumer antivirus products.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Towards a Holistic Approach in Building Intelligence to Fight Crimeware

Holistic approach to combat cybercrime by analyzing network attack surfaces and actor behaviors. Explores bulletproof hosting, fast flux networks, and underground forums to proactively identify and block malicious infrastructure.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

An Insider's Guide to Cyber-Insurance and Security Guarantees

Explore the rise of cyber-insurance and security guarantees in the InfoSec industry. Learn about their impact, implementation challenges, and potential benefits for businesses and security vendors.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool

Explore BLE security vulnerabilities and learn to intercept communication between smart devices using a new open-source MITM proxy tool. Discover common flaws and best practices for IoT device security.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Cyber War in Perspective - Analysis From the Crisis in Ukraine

Explore the reality of cyber warfare through the lens of the Russia-Ukraine conflict. Gain insights into the strategic impacts, limitations, and implications of digital operations in modern geopolitical crises.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Access Keys Will Kill You Before You Kill the Password

Explore AWS API security, focusing on access key risks and MFA implementation. Learn strategies and tools for enhancing authentication without compromising workflow efficiency.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Account Jumping Post Infection Persistency & Lateral Movement in AWS

Explore AWS security vulnerabilities, infection methods, and post-infection techniques. Learn about account jumping, resource manipulation, and best practices for protecting cloud environments.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk