DEFCONConference Courses

WPAD Domain Exploitation: Understanding Man-in-the-Middle Attacks Through DNS

Uncover how a single domain purchase can exploit WPAD vulnerabilities, leading to massive-scale man-in-the-middle attacks and compromising hundreds of thousands of internet clients through DNS manipulation.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

How State Laws Meant to Protect Children Raise Other Privacy and Constitutional Risks

Explore the complex interplay between state privacy laws aimed at protecting children online and their unintended consequences, from data collection concerns to First Amendment challenges.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Using AI Computer Vision in OSINT Data Analysis

Discover how to leverage AI computer vision tools in Azure and AWS to accelerate OSINT data analysis, perform object detection, facial recognition, and chronolocation analysis for forensic investigations.

• YouTube
• 53 minutes
• Self-Paced
• Free Video

Your Smartcard is Dumb: A Brief History of Hacking Access Control Systems

Explore the vulnerabilities of modern access control systems through live demonstrations, understanding fundamental design flaws and historical attacks on card-based security mechanisms.

• YouTube
• 53 minutes
• Self-Paced
• Free Video

Security Vulnerabilities in Video Surveillance Systems and Supply Chain Analysis

Explore security vulnerabilities in surveillance systems, focusing on NVR devices from major vendors like Hikvision and Dahua, while examining supply chain risks and exploitation scenarios.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Winning the Game of Active Directory - Securing Against Common Attack Strategies

Master essential Active Directory security strategies, from common attack vectors to implementing robust defensive measures for protecting enterprise environments and preventing network compromises.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Windows Downdate: Downgrade Attacks Using Windows Updates

Discover how to exploit Windows Update vulnerabilities to craft downgrade attacks, bypass security features, and compromise system integrity - from kernel to virtualization stack.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Defeating ATM Disk Encryption - Security Vulnerabilities in Vynamic Security Suite

Delve into critical ATM security vulnerabilities, focusing on Diebold Nixdorf's VSS encryption weaknesses, exploitation methods, and essential defense strategies for financial systems protection.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Abusing OIDC Authentication for Cloud Security Vulnerabilities

Dive into OIDC security vulnerabilities, exploring authentication mechanisms, potential misconfigurations, and real-world attack vectors in cloud environments through CI/CD workflows and identity providers.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

Web2 Meets Web3: Hacking Decentralized Applications

Dive into the security challenges of decentralized applications, exploring real-world vulnerabilities, threat modeling, and attack vectors in both Web2 and blockchain environments.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Xiaomi Mobile Security Vulnerabilities - Regional Exploit Analysis and Pwn2Own Competition

Delve into the behind-the-scenes journey of exploiting Xiaomi 13 Pro at Pwn2Own Toronto 2023, exploring regional security variations and the challenges of mobile device exploitation.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

V2GEvil: Cybersecurity Vulnerabilities in Electric Vehicle Charging Systems

Explore critical vulnerabilities in electric vehicle charging systems and learn specialized security testing techniques for EVCC and ISO 15118 protocols in charging infrastructure.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Open Sesame - Vulnerabilities in Electronic Smart Lockers and Cabinets

Explore physical and side-channel vulnerabilities in electronic smart locks, focusing on PIN and RFID security risks in organizational locker systems and shared spaces.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

Detecting Persistent Threats on Draytek Devices - Security Assessment and Mitigation Tools

Discover how to detect and mitigate persistent threats on Draytek devices through firmware analysis, reverse engineering, and custom security module development for enhanced network protection.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Outlook Unleashing RCE Chaos: Understanding CVE-2024-30103

Dive into the critical Outlook security vulnerabilities, exploring RCE exploits through COM objects, NTLM leaks, and essential mitigation strategies for enterprise protection.

• YouTube
• 41 minutes
• Self-Paced
• Free Video