Black Hat Courses

QuickShell - Sharing is Caring About an RCE Attack Chain on Quick Share

Discover how researchers uncovered 10 vulnerabilities in Google's Quick Share, leading to QuickShell - a complex RCE attack chain exploiting file sharing protocols on Windows and Android.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

DriveThru Car Hacking - Fast Food, Faster Data Breach

Discover how dashcams can be compromised in minutes through automated DriveThru attacks, exposing private data and conversations with live demos and countermeasures.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Back-Connect to the Connected Car - Search for Vulnerabilities in the VW Electric Car

A penetration test of the VW ID.3 reveals how attackers can gain root access to infotainment and gateway modules and install remote backdoors.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

DataBinding2Shell - Novel Pathways to RCE Web Frameworks

A security analysis of web framework data binding uncovers overlooked attack paths, including two vulnerabilities that lead to remote code execution.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Fail Harder - Finding Critical 0-Days in Spite of Ourselves

Researchers share how persistent failures and setbacks preceded the discovery of critical zero-day vulnerabilities across multiple projects.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Confidence in Chaos - Strategies for World-Class Security Operations

An 11-strategy roadmap for adapting security operations as new risks and shifting conditions challenge detection and response.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Breaking Kerberos' RC4 Cipher and Spoofing Windows PACs

A demonstration of how a weakness in Kerberos’ legacy RC4 support can be turned into a limited Windows PAC spoofing exploit.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Dirty Vanity - A New Approach to Code Injection & EDR Bypass

Dirty Vanity uses Windows’ built-in forking mechanism for a code injection technique that challenges endpoint detection and response defenses.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Bridging the Gap Between Research and Practice in Intelligently Bypassing WAF

Presents an intelligent workflow for adapting WAF bypass searches to diverse payloads and differing bypass difficulty.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Choo Choo, Network Train - The One to Rule Your Perimeter

Explores how exposed MQTT servers can open internal networks to attack through connected devices and firmware replacement.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Deep into Android Bluetooth Bug Hunting - New Attack Surfaces and Weak Code Patterns

Examines overlooked Android Bluetooth attack surfaces by tracing packet data lifecycles and weak architectural logic in AOSP.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

CSI - Rowhammer - Closing the Case of Half-Double and Beyond

The talk shows how Half-Double Rowhammer exploits disturbance two rows away and why Targeted Row Refresh can assist attackers instead of stopping them.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Event-based Fuzzing, Patch-based Research, and Comment Police - Finding Bugs Through a Bug

Learn how public vulnerability disclosures can guide event-based fuzzing, patch analysis, and code-query rules to uncover further bugs.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Android Parcels - The Bad, the Good and the Better - Introducing Android's Safer Parcel

A technical overview of Android Parcel exploits, from Bundle FengShui to a privileged-process code-execution chain.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Cross-Contract Ricochet Attacks - Off-Chain-On-Chain Manipulation of Billion Dollar NFT Collections

A demonstration of how utility NFTs can move across contracts to bypass staking safeguards and exploit marketplace logic.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk