Black Hat Courses

Operation Clairvoyance - How APT Groups Spy on the Media Industry

Explore how APT groups target Taiwan's media industry for cyber espionage, focusing on their tactics, motivations, and impact on daily activities and national security.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

New Wine in an Old Bottle - Attacking Chrome WebSQL

Explore Chrome WebSQL vulnerabilities and a mutation-based fuzzer for discovering SQLite bugs, enhancing web application security against remote attacks.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Revisiting Stealthy Sensitive Information Collection from Android Apps

Explore advanced techniques for detecting stealthy sensitive information collection in Android apps, addressing challenges in privacy policy compliance and user data protection.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Stealing With Style - Using CSS to Exploit ProtonMail & Friends

Explore critical vulnerabilities in privacy-focused webmail providers, including email theft and remote code execution, through CSS exploitation techniques in ProtonMail, Tutanota, and Skiff.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Security Advocacy Shouldn't Be for Security Professionals - An Analysis of How the Industry Misses the Mark and How We Can Improve

Explores how security advocacy should extend beyond professionals to all IT sectors and society, analyzing global security content and proposing improvements for broader impact.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Sweet Dreams - Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks

Novel Wi-Fi attacks exploiting power-save mode to leak encrypted frames and disrupt networks. Explores vulnerabilities in AP frame buffering and encryption, demonstrating potential security risks in Wi-Fi implementations.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Leveraging Streaming-Based Outlier Detection and SliceLine to Stop Heavily Distributed Bot Attacks

Explore techniques to combat distributed bot attacks using streaming-based outlier detection and SliceLine, generating effective rules for blocking malicious traffic at scale.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Nakatomi Space - Lateral Movement as L1 Post-exploitation in OT

Exploring deep lateral movement in OT networks, focusing on TTPs for navigating through embedded device networks at the lowest levels, highlighting security vulnerabilities in industrial control systems.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Preparing the Long Journey for Data Security

Explore global data security trends, legislation, and industry-specific strategies. Gain insights into the evolving landscape of data protection and its impact across sectors.

• YouTube
• 55 minutes
• Self-Paced
• Conference Talk

Revealing Embedded Fingerprints - Deriving Intelligence - USB Stack Interactions

Techniques for analyzing USB stack interactions to gather intelligence on embedded systems, including OS identification and vulnerability exploitation challenges.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Home Invasion v2.0 - Attacking Network-Controlled Hardware

Explore security risks of network-connected home devices, including potential for physical access and surveillance. Learn about vulnerabilities in smart locks and other IoT products.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

Fully Arbitrary 802.3 Packet Injection - Maximizing the Ethernet Attack Surface

Explore novel Ethernet attack techniques using affordable hardware and custom firmware. Learn about frame manipulations, SFD parsing anomalies, and Ethernet Packet-In-Packet injection for enhanced network security testing.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

RFID Hacking - Live Free or RFID Hard

Practical guide on RFID hacking techniques, tools, and defenses. Learn to build custom long-range RFID hacking tools using Arduino, steal badge info, clone cards, and exploit vulnerabilities in proximity badge systems.

• YouTube
• 1 hour
• Self-Paced
• Conference Talk

Rooting SIM Cards

Explore SIM card vulnerabilities and their impact on mobile security. Learn about implementation flaws, potential exploits, and the implications for trusted computing in smartphones and embedded devices.

• YouTube
• 59 minutes
• Self-Paced
• Conference Talk

Truncating TLS Connections to Violate Beliefs in Web Applications

Exploring TLS truncation attacks to exploit web application flaws, demonstrating vulnerabilities in authentication systems and their impact on popular platforms like Helios, Microsoft Live, and Google.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk