Hack In The Box Security Conference Courses

Surveillance Is Not The Answer; What Is The Question?

A keynote examines why expanded surveillance and attacks on encryption fail to solve online harms, and how security practitioners can develop better mitigations.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Payload Delivery for Initial Access in Red Team Engagement

Explores payload delivery techniques for gaining initial access in red team engagements, including attack-surface constraints, TTP bypasses, MagicShell customization, and browser exploits.

• YouTube
• 1 hour 1 minute
• Self-Paced
• Conference Talk

Attacking Storage Services - The Lynchpin of Cloud Services

Explore techniques for enumerating, identifying, exploiting, and post-exploiting AWS and Azure storage services through cloud compromise case studies.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

The War for Control of DNS Encryption

Examines protocol-level solutions and industry deployment of encrypted DNS amid pervasive Internet monitoring.

• YouTube
• 52 minutes
• Self-Paced
• Conference Talk

Two Strategies for Supply Chain Attacks

Examines BARIUM’s supply-chain attack tactics through ASUS Operation ShadowHammer and Korean case studies, including malware, update-server compromise, and defensive strategies.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Common Flaws in ICS Network Protocols

Examines recurring security flaws in public and proprietary ICS protocols, including unencrypted traffic and unauthenticated command and response injection attacks on PLCs.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Serverless Security - Attack & Defense

Attack and defense techniques for serverless applications, including dependency poisoning, Denial of Wallet, remote code execution, insecure defaults, and cloud-specific security nuances.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Fuzzing File System Implementations to Uncover Security Bugs

Fuzzing BSD file-system implementations to uncover security bugs through automated kernel testing.

• YouTube
• 57 minutes
• Self-Paced
• Conference Talk

Exploiting Directory Permissions on macOS

Explore how misconfigured macOS file and directory permissions enable arbitrary overwrites, file disclosure, and privilege escalation.

• YouTube
• 56 minutes
• Self-Paced
• Conference Talk

RIDL - Rogue In Flight Data Load

Examines RIDL/MDS microarchitectural attacks that bypass CPU security boundaries to leak secrets from SGX, virtual machines, and browsers.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Reimplementing Local RPC in .Net

Reimplementing local Windows RPC in .NET by reverse engineering ALPC, parsing NDR formats, and integrating PowerShell for privilege-escalation research.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

The Sum of All Fears - When ICS - SCADA Are Compromised

Introduces ICS/SCADA architecture, attack vectors, protocol exploitation, PLC compromise, threat hunting, and defense-in-depth for industrial cyber defense.

• YouTube
• 1 hour 1 minute
• Self-Paced
• Conference Talk

Car Hacking - Practical Guide to Automotive Security

A practical introduction to reverse-engineering automotive CAN bus traffic with ICSim, including attack-surface analysis, replay attacks, and sending commands.

• YouTube
• 56 minutes
• Self-Paced
• Conference Talk

Creating a Fuzzer for Diameter and LTE Telecom Protocols

A technical talk on building a Diameter protocol fuzzer for LTE telecom equipment and reproducing vulnerabilities in MNO test environments.

• YouTube
• 1 hour
• Self-Paced
• Conference Talk

Overcoming Fear - Reversing With Radare2

Learn practical reverse engineering with radare2 through hands-on demos of commands, visual navigation, configuration, emulation, scripting, and debugging.

• YouTube
• 2 hours 5 minutes
• Self-Paced
• Conference Talk