nullcon Courses

Security Journey in French Network Access Controller

A security talk examines vulnerabilities in the Alcasar network access controller, showing how flaws enable takeover, fake authentication, and recovery of cleartext passwords.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

The Achilles Heel of the macOS Gatekeeper

An examination of macOS Gatekeeper, recent bypasses, a novel zero-day, and Microsoft Defender for Endpoint detection heuristics.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

The Silent Spy Among Us - Modern Attacks Against Smart Intercoms

A technical talk on hacking cloud-based smart intercoms, exploiting device and cloud vulnerabilities to access connected cameras and remote video streams.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Changing the Colors of Your Keyboard Might Lead to Privilege Escalation

Explores how a gaming keyboard’s Linux kernel module yielded color-dependent zero-day bugs, with live exploitation and a review of kernel buffer-overflow mitigations.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Chop Suey - An Exceptional Dish With A Side Of Buffer Overflows

Explore how stack buffer overflows can disrupt exception unwinding, leading to a new exploitation technique, real-world vulnerability research, and exploit construction.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

In-Secure Remote Operations - What Sucks, Rocks, and a Super-CLI

A hands-on look at Windows living-off-the-land remote administration, from jump servers and restricted PowerShell to full-token hijacking in network logon sessions.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

Not So Famous Attack Vectors in the World of Smart Contract Security

Explores overlooked smart contract attack vectors, unsafe Solidity patterns, and defensive coding strategies for preventing exploits.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Why I Write My Own Security Tooling and Why You Should Too

Learn why building domain-specific security tools can deepen technology understanding and uncover vulnerabilities manual research might miss.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Dirty Stream Attack - Turning Android Share Targets To Attack Vectors

A technical examination of dirty stream attacks that abuse Android content providers and share targets to overwrite files, expose private data, or execute code.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

The Road to Side-Channel Regression Testing in CI Development

Demonstrates how to integrate side-channel regression tests and countermeasures into continuous integration workflows.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Server Side Prototype Pollution - Blackbox Detection Without The DoS

Learn black-box techniques to detect server-side prototype pollution without triggering denial of service.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Hacking Fintech Crime Realities & Possibilities

An expert talk on how low-tech scams and social engineering exploit digital wallets in India, and how law enforcement and security professionals can counter fintech crime.

• YouTube
• 1 hour 3 minutes
• Self-Paced
• Conference Talk

Web 3.0 Smart Contracts Could Be Leaky

A firsthand look at how a Web3 smart contract leaked sensitive information and the fix used to prevent the disclosure.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Honey I Just Put The Hospital On A Ventilator

Entropy-based detection of malicious DICOM files to protect healthcare systems and alert security operations teams.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Hacking Android Foreground Services Escalation Of Privileges

A technical walkthrough of bypassing Google’s patch for an Android foreground-service race condition that undermines background execution restrictions.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk