DEFCONConference Courses

A Shadow Librarian: Fighting Back Against Encroaching Capitalism

Explore the underground resistance against digital content restrictions in public libraries, examining creative solutions to combat corporate control and ensure open access to knowledge.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

The Risk and Reward of Distributed Industrial Control - Cybersecurity in Remote Infrastructure Management

Explore the cybersecurity challenges of remotely controlled industrial assets, examining real-world incidents and practical mitigation strategies for protecting critical infrastructure operations.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Exploiting Localhost APIs From The Browser - Zero-Day Vulnerability and Attack Techniques

Discover how browser-based attacks exploit localhost services through a zero-day vulnerability, featuring live demonstrations of remote code execution and novel attack techniques targeting developers behind firewalls.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Social Engineering Techniques for Physical Access Red Team Operations

Dive into real-world social engineering tactics through a first-person narrative of complex red team operations, exploring methodologies for physical access and critical infrastructure penetration testing.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

AWS CloudQuarry: Digging for Secrets in Public AMIs

Dive into AWS security vulnerabilities through an analysis of 3.1M AMIs, exploring credential exposure risks, detection methodologies, and essential cloud security practices for preventing breaches.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

DriverJack: Turning NTFS and Emulated ROFs into an Infection

Discover advanced exploitation techniques targeting NTFS and emulated filesystem vulnerabilities, exploring novel attack vectors that bypass Windows security measures and maintain system persistence.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Unsaflok - Hacking Millions of Hotel Locks and Electronic Access Control Systems

Discover critical vulnerabilities in dormakaba Saflok hotel locks, including key card forgery techniques, security implications, and how to verify if your room's lock has been patched for protection.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

AMD Sinkclose - Universal Ring2 Privilege Escalation in System Management Mode

Delve into AMD processor security vulnerabilities, exploring System Management Mode (SMM), CPU design flaws, and the methodology behind ring-2 privilege escalation exploits.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Early Microprocessors and the 6502: A Historical and Technical Introduction

Explore the fascinating history of early microprocessors, focusing on the 6502 chip, its programming, and impact on vintage computing systems, with hands-on demonstrations and resources.

• YouTube
• 53 minutes
• Self-Paced
• Free Video

Nano Enigma: Uncovering the Secrets in eFuse Memories

Dive into the fascinating world of eFuse memory security, exploring physical extraction techniques from basic decapsulation to advanced SEM analysis for accessing encrypted data storage.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

Maturing Your Application Security Program - A Practical Guide to Next Steps

Discover practical steps to advance your AppSec program through three maturity levels, with actionable strategies for immediate security posture improvement based on experience with 400+ companies.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

Exploiting Cloud Provider Vulnerabilities for Initial Access in AWS

Dive into advanced AWS security vulnerabilities, focusing on IAM role exploitation, confused deputy attacks, and critical misconfigurations that enable unauthorized cloud environment access.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Exploiting Bluetooth Vulnerabilities: From Car Systems to Bank Account Security

Discover how to identify and exploit Bluetooth vulnerabilities in modern vehicles and flight systems, using BlueToolkit framework for testing, with practical tips and new attack vectors for security research.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

Top War Stories from Bug Bounty Hunting - High-Severity Exploits and Discoveries

Dive into real-world bug bounty hunting experiences, exploring high-severity vulnerabilities worth $10k-$60k, from simple RCE exploits to complex PII leakages, with detailed technical insights and lessons learned.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

The XZ Backdoor Story: How a Supply Chain Attack Nearly Compromised SSH Servers

Uncover the gripping investigation of the XZ backdoor incident, exploring the mysterious maintainer Jia Tan, technical analysis of the compromise, and crucial lessons for open-source security.

• YouTube
• 42 minutes
• Self-Paced
• Free Video