NahamSec Courses

The DeFi Threat Model

A brief look at threat modeling for decentralized finance, framed through offensive security.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

The Billion Dollar Vulnerability Forcing a Major Fork on the Ethereum Chain

An analysis of a billion-dollar Ethereum vulnerability and the major chain fork it could force.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

An Adversary's Approach to Smart Contracts

An adversarial perspective on smart contract security and offensive analysis.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Hunting for Amazon Cognito Security Misconfigurations

Explore four Amazon Cognito security misconfigurations, including credential exposure, signup abuse, writable attributes, and email verification bypasses.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

I Hope This Sticks - Analyzing ClipboardEvent Listeners for XSS

Analyzing ClipboardEvent listeners as an avenue for identifying cross-site scripting vulnerabilities.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Read The Bleeping RFC - Understanding Network Protocols for Security

An offensive-security talk centered on reading RFCs to understand the standards behind security research.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Command-Line Data-Wrangling for Security Professionals

Wrangle data from the command line using pipes, sorting, regular expressions, grep, find, xargs, JSON, and jq.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Story of an RCE on Apple Through Hot Jar Swapping

A case study of achieving remote code execution on Apple through Java hot JAR swapping, with exploit discovery, analysis, and a demonstration.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Reversing Web Assembly

A conference talk on reversing WebAssembly (Wasm).

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Are Smart Contracts Haunted? - Security Vulnerabilities in Blockchain

An offensive look at smart contract vulnerabilities, from re-entrancy and proxy bugs to price-oracle and access-control failures in DeFi.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Blackbox Monitoring for Timely Bug Detection

Explore a task-based hybrid approach to black-box monitoring, using freshness, risk markers, and human intelligence for timely bug detection.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Analyzing a Smart Contract Vulnerability Worth $600,000+ - Smart Contract Series Episode 4

A case study of analyzing a Port Finance smart-contract vulnerability that could have caused $20–25 million in losses.

• YouTube
• 21 minutes
• Self-Paced
• Free Video

Smart Contract Auditing - Episode 3

See how a smart contract security audit is conducted through an example from Halborn.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Finding XSS on Apple.com and Building a Proof of Concept to Leak Your PII

A hands-on walkthrough of finding cross-site scripting on Apple.com and building a proof of concept to leak personally identifiable information.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Continuous Intrusion - Hacking CI Systems

An offensive-security talk on exploiting weaknesses in continuous integration systems.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk