Hack In The Box Security Conference Courses

Bugs in Blocks: Common Vulnerabilities in Blockchain Frameworks

Exploring common blockchain vulnerabilities, their impacts, and testing methods. Includes a demo of a fuzzer for Substrate-based chains to find typical bugs in blockchain systems.

• YouTube
• 54 minutes
• On-Demand
• Free Video

ALPChecker: Detecting Spoofing and Blinding Attacks on ALPC - HITB 2023

Presentation on ALPChecker, a new security tool designed to detect kernel mode attacks on Windows' ALPC mechanism, addressing vulnerabilities in inter-process communication.

• YouTube
• 19 minutes
• On-Demand
• Free Video

Timekiller: Escape From QEMU/KVM - Exploiting Asynchronous Clock Vulnerabilities

Demonstrating a novel guest-to-host escape exploit in QEMU/KVM using asynchronous clock vulnerabilities. Introduces "Timekiller" technique to turn heap overflow into arbitrary address write, achieving full VM escape.

• YouTube
• 53 minutes
• On-Demand
• Free Video

Writing a New Decompiler for JRuby Security Audits

Explore JRuby vulnerabilities and learn about YBurj, a new open-source decompiler for JRuby IR, enabling recovery of compiled source code for enhanced security audits.

• YouTube
• 36 minutes
• On-Demand
• Free Video

Injecting Brains Into Blind SQL Injection - Optimizing Data Exfiltration

Innovative approach to optimize Blind SQL Injection using Machine Learning and statistics. Introduces Hakuin, a tool that significantly improves exfiltration speed for database schemas and content compared to standard methods.

• YouTube
• 33 minutes
• On-Demand
• Free Video

How NTLM Relay Ruins Your Exchange Servers

Uncovers a critical NTLM relay attack surface in Exchange Server, affecting mailbox security and potentially leading to RCE. Explores vulnerabilities, exploits, patches, and protection strategies for Exchange environments.

• YouTube
• 52 minutes
• On-Demand
• Free Video

Escaping From VMware Workstation Through the Disk Controller

Exploración detallada de una vulnerabilidad en los controladores de disco de VMware Workstation que permite escapar de una máquina virtual, con demostraciones de exploits para Linux y Windows.

• YouTube
• 49 minutes
• On-Demand
• Free Video

Analyzing and Reverse Engineering Antivirus Signatures

Explore antivirus signature analysis and reverse engineering, gaining insights into detection evasion techniques and evaluating Microsoft Defender's effectiveness for improved cybersecurity strategies.

• YouTube
• 1 hour 7 minutes
• On-Demand
• Free Video

Lazarus Group's Undercover Operations in South Korea 2022-2023

Detailed analysis of Lazarus Group's recent cyber campaigns in South Korea, covering infiltration methods, lateral movement techniques, and data exfiltration strategies used by this sophisticated threat actor.

• YouTube
• 46 minutes
• On-Demand
• Free Video

Extracting Information from Automotive Internet Units

Techniques for extracting and analyzing firmware from automotive internet modules, focusing on Qualcomm MDM-based units. Covers extraction methods, image analysis, and file system exploration.

• YouTube
• 33 minutes
• On-Demand
• Free Video

Designing Your Own Electronic Attack Device

Learn to design and create custom electronic attack devices, from circuit boards to complete Linux systems, for personalized and efficient security testing and penetration tasks.

• YouTube
• 52 minutes
• On-Demand
• Free Video

Bluetooth Sniffing: Privacy Implications and Unexpected Findings

Exploring Bluetooth sniffing implications: privacy, security, and societal impacts. Insights on device tracking, medical data, law enforcement, and potential vulnerabilities in various Bluetooth-enabled systems.

• YouTube
• 59 minutes
• On-Demand
• Free Video

gVisor: Modern Linux Sandboxing Technology - Hack In The Box 2023

Explore gVisor-based Linux sandboxing: advantages, implementation, and applications in security. Learn about existing solutions, primitives, and how to build a process-level sandbox for enhanced observability and protection.

• YouTube
• 46 minutes
• On-Demand
• Free Video

Exploiting the Lexmark PostScript Stack

Explore Lexmark PostScript stack exploitation, covering internals, language basics, mitigations, and achieving remote code execution through out-of-bounds read and type confusion vulnerabilities.

• YouTube
• 49 minutes
• On-Demand
• Free Video

Embracing Failure to Be a Better Hacker and Human

Explore how embracing failure can enhance hacking skills and personal growth. Learn from real-world examples and gain insights into overcoming challenges in the hacking world.

• YouTube
• 55 minutes
• On-Demand
• Free Video