Black Hat Courses

CDN Cannon - Exploiting CDN Back-to-Origin Strategies for Amplification Attacks

Uncover critical CDN vulnerabilities enabling massive amplification attacks that bypass DDoS protections, demonstrated through Back-to-Origin strategies and mitigation approaches.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

State Manipulation - Unveiling New Attack Vectors in Bluetooth Vulnerability Discovery through Protocol State Machine Reconfiguration

Uncover hidden Bluetooth vulnerabilities by manipulating protocol state machines, exploring attack vectors beyond traditional security flaws in automotive and IoT devices.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Inbox Invasion - Exploiting MIME Ambiguities to Evade Email Attachment Detectors

Discover how adversaries exploit MIME parsing discrepancies to bypass email security systems and evade malware detection through systematic vulnerability analysis.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

The Black Hat Asia Network Operations Center NOC Report

Discover how security professionals behave on open WiFi through Black Hat's NOC team analysis, network setup techniques, and entertaining statistics from conference operations.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Remote Exploitation of Nissan Leaf - Controlling Critical Body Elements from the Internet

Discover how researchers remotely compromised a 2020 Nissan Leaf, exploiting Bluetooth vulnerabilities to control critical vehicle functions like steering, locks, and wipers via internet.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Sweeping the Blockchain - Unmasking Illicit Accounts in Web3 Scams

Discover ScamSweeper, a novel framework for detecting Web3 scams on Ethereum using dynamic transaction graph analysis and structure-temporal random walks to unmask illicit accounts.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Tinker Tailor LLM Spy - Investigate and Respond to Attacks on GenAI Chatbots

Discover how to investigate and respond to attacks on GenAI chatbots, including prompt injection incidents, using AI defense tooling and LLM guardrails for effective incident response.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

JDD - In-depth Mining of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Payload Construction

Discover advanced techniques for mining Java deserialization vulnerabilities using bottom-up gadget search and dataflow-aided payload construction to identify zero-day exploits.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Think Inside the Box - In-the-Wild Abuse of Windows Sandbox in Targeted Attacks

Discover how APT groups exploit Windows Sandbox for evasion, analyzing Earth Kasha's tactics and learning defensive countermeasures for threat hunting.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Weaponized Deception - Lessons from Indonesia's Muslim Cyber Army

Explore how Indonesia's Muslim Cyber Army pioneered weaponized deception tactics in cyberspace, featuring behavioral analysis and ethnographic insights from Islamic communities.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

Perspectives on Trust in Hardware Supply Chains

Uncover the shadowy world of hardware supply chains and learn practical approaches to establishing trust in global manufacturing networks from industry expert bunnie Huang.

• YouTube
• 55 minutes
• Self-Paced
• Free Video

Should We Chat, Too? Security Analysis of WeChat's MMTLS Encryption Protocol

Discover critical security vulnerabilities in WeChat's proprietary MMTLS encryption protocol through comprehensive analysis by Citizen Lab researchers.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Operation BlackEcho - Voice Phishing Using Fake Financial and Vaccine Apps

Uncover sophisticated voice phishing tactics using malicious apps disguised as financial and vaccine applications, analyzing attack infrastructure and recent cybercrime trends.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Who Cares Where Waldo Is - Locating macOS Users Without Their Consent

Discover how attackers can bypass macOS location privacy controls to track users without consent through database vulnerabilities and third-party app exploits.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

One Bug to Rule Them All - Stably Exploiting a Preauth RCE Vulnerability on Windows Server 2025

Discover how to exploit CVE-2024-38077, a critical preauth RCE vulnerability affecting Windows Server 2003-2025, bypassing modern security mitigations for 0-click remote code execution.

• YouTube
• 22 minutes
• Self-Paced
• Free Video