Hack In The Box Security Conference Courses

API Security in the Age of Microservices

1 rating

Explore API security challenges in microservices architectures and learn strategies for distributed security, including gateways, service mesh, authentication, and network segmentation.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Breaking Siemens SIMATIC S7 PLC Protection Mechanism

1 rating

Examines how Siemens SIMATIC PLC protection mechanisms can be bypassed through physical and network-accessible attacks.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

How to Hack Medical Imaging Applications via DICOM

1 rating

Security analysis of DICOM servers, protocols, and libraries reveals buffer overflows, insecure APIs, CSRF, XXE, and fuzzing techniques.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Timekiller: Escape From QEMU/KVM - Exploiting Asynchronous Clock Vulnerabilities

Demonstrating a novel guest-to-host escape exploit in QEMU/KVM using asynchronous clock vulnerabilities. Introduces "Timekiller" technique to turn heap overflow into arbitrary address write, achieving full VM escape.

• YouTube
• 53 minutes
• Self-Paced
• Free Video

Writing a New Decompiler for JRuby Security Audits

Explore JRuby vulnerabilities and learn about YBurj, a new open-source decompiler for JRuby IR, enabling recovery of compiled source code for enhanced security audits.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Injecting Brains Into Blind SQL Injection - Optimizing Data Exfiltration

Innovative approach to optimize Blind SQL Injection using Machine Learning and statistics. Introduces Hakuin, a tool that significantly improves exfiltration speed for database schemas and content compared to standard methods.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

How NTLM Relay Ruins Your Exchange Servers

Uncovers a critical NTLM relay attack surface in Exchange Server, affecting mailbox security and potentially leading to RCE. Explores vulnerabilities, exploits, patches, and protection strategies for Exchange environments.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Escaping From VMware Workstation Through the Disk Controller

Exploración detallada de una vulnerabilidad en los controladores de disco de VMware Workstation que permite escapar de una máquina virtual, con demostraciones de exploits para Linux y Windows.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

Analyzing and Reverse Engineering Antivirus Signatures

Explore antivirus signature analysis and reverse engineering, gaining insights into detection evasion techniques and evaluating Microsoft Defender's effectiveness for improved cybersecurity strategies.

• YouTube
• 1 hour 7 minutes
• Self-Paced
• Free Video

Lazarus Group's Undercover Operations in South Korea 2022-2023

Detailed analysis of Lazarus Group's recent cyber campaigns in South Korea, covering infiltration methods, lateral movement techniques, and data exfiltration strategies used by this sophisticated threat actor.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Extracting Information from Automotive Internet Units

Techniques for extracting and analyzing firmware from automotive internet modules, focusing on Qualcomm MDM-based units. Covers extraction methods, image analysis, and file system exploration.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

Designing Your Own Electronic Attack Device

Learn to design and create custom electronic attack devices, from circuit boards to complete Linux systems, for personalized and efficient security testing and penetration tasks.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Bluetooth Sniffing: Privacy Implications and Unexpected Findings

Exploring Bluetooth sniffing implications: privacy, security, and societal impacts. Insights on device tracking, medical data, law enforcement, and potential vulnerabilities in various Bluetooth-enabled systems.

• YouTube
• 59 minutes
• Self-Paced
• Free Video

gVisor: Modern Linux Sandboxing Technology - Hack In The Box 2023

Explore gVisor-based Linux sandboxing: advantages, implementation, and applications in security. Learn about existing solutions, primitives, and how to build a process-level sandbox for enhanced observability and protection.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Exploiting the Lexmark PostScript Stack

Explore Lexmark PostScript stack exploitation, covering internals, language basics, mitigations, and achieving remote code execution through out-of-bounds read and type confusion vulnerabilities.

• YouTube
• 49 minutes
• Self-Paced
• Free Video