Hack In The Box Security Conference Courses

Automated Black-box Security Testing of Smart Embedded Devices

Innovative approach for IoT black-box fuzzing using "fuzzing triggers" from companion apps to generate optimal inputs, overcoming limitations of existing tools and discovering zero-day vulnerabilities.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

How MySQL Servers Can Attack YOU

Novel attack vector using compromised MySQL servers to target clients, demonstrating remote code execution vulnerabilities in MySQL tools and libraries, including a zero-day exploit bypassing security patches.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

Bypassing Anti-Cheats and Hacking Competitive Games

Explore game cheating techniques, anti-cheat mechanisms, and bypassing methods in competitive gaming. Gain insights into the evolving landscape of game security and hacking strategies.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

A Tale of Building a Real Full Speed Anti-Censorship Router

Comprehensive guide to building a high-speed anti-censorship router, covering GFW history, bypass methods, protocols, deployment strategies, and practical implementation for unrestricted internet access.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Advanced DMA Reentrancy Techniques to Escape QEMU

Explore advanced DMA reentrancy techniques for QEMU escape, including DMA Reflection/Refraction and DMA Oriented Programming. Learn about vulnerabilities, exploit processes, and future challenges in virtualization security.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Hunting Windows Desktop Window Manager Bugs

Exploring Windows Desktop Window Manager vulnerabilities, focusing on DirectComposition UserSpace. Covers architecture, attack surfaces, and specific CVEs, offering insights into bug hunting techniques and security implications.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

SOHO Hacking at Pwn2Own

Exploring vulnerabilities in home routers and small business devices, detailing methodologies for finding and exploiting security flaws, and demonstrating real-world attack scenarios in SOHO networks.

• YouTube
• 58 minutes
• Self-Paced
• Conference Talk

Next Generation Virtualization-Based Obfuscators

Explores next-gen virtualization-based code obfuscation techniques, focusing on target-specific instruction sets and intertwined VM components to enhance resilience against deobfuscation attacks.

• YouTube
• 59 minutes
• Self-Paced
• Conference Talk

Nakatomi Space - Lateral Movement as L1 Post-Exploitation in OT

Explore lateral movement techniques in OT networks, focusing on vulnerabilities in L1 devices. Learn about BPCS/SIS architectures, exploit chains, and hardening strategies to enhance industrial control system security.

• YouTube
• 57 minutes
• Self-Paced
• Conference Talk

Syscalls in Shellcode - Techniques for Malicious Functionality

Explore advanced techniques for using Windows syscalls in shellcode, overcoming portability issues, and enhancing malicious functionality. Learn about ShellWasp tool and novel WoW64 syscall invocation methods for stealthy code execution.

• YouTube
• 1 hour 2 minutes
• Self-Paced
• Conference Talk

XRP Raid Protector - Killing A Critical Bug Worth 40 Billion Dollars

Unveiling a critical 8-year-old vulnerability in XRP Ledger that could compromise $40 billion in assets. Explores the RCE exploit, potential profit methods, and network control implications for blockchain security.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Current State of iOS Malware Detection

Comprehensive overview of iOS malware detection techniques, covering known samples, automated and manual detection methods, and potential improvements for enhanced security.

• YouTube
• 57 minutes
• Self-Paced
• Conference Talk

Upgrading Rollback Agnostic Replay Attacks

Explore car hacking techniques, focusing on radio frequencies and BLE. Learn about Rolling Codes analysis and practical steps to conduct research on vehicle security vulnerabilities.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Information Collection of Third-Party SDKs

Innovative static taint analyzer for third-party SDKs, addressing challenges in user data protection and privacy policy compliance. Achieves high accuracy in identifying undisclosed information collection behaviors.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

The Ransomware Protection Full Of Holes

Exposé des failles de la protection contre les ransomwares de Windows, démonstration de méthodes de contournement et d'attaques à distance, avec vidéos à l'appui.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk