Hack In The Box Security Conference Courses

Knockin' On MediaTek ADSP's Door

Reverse engineering MediaTek's audio DSP firmware reveals vulnerabilities in RTOS and Android HAL, potentially enabling local privilege escalation and eavesdropping on user conversations.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

Response Smuggling - Pwning HTTP/1.1 Connections

Explore advanced HTTP response smuggling techniques, including protocol vulnerabilities, session hijacking, and response scripting, with real-world demonstrations on major ERP systems.

• YouTube
• 55 minutes
• On-Demand
• Conference Talk

Who Littered the Sandbox? Scooping Up New Malware Behavior

Explore large-scale malware behavior analysis using sandbox telemetry. Gain insights into infection patterns, commonalities, and evolving tactics to improve detection and mitigation strategies.

• YouTube
• 44 minutes
• On-Demand
• Conference Talk

Rage Against The Machine Clear

Explore new root causes of transient execution attacks, including machine clears, and discover novel attack primitives like Floating Point Value Injection and Speculative Code Store Bypass.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

Software Security Analysis - Present and Future Research Initiatives

Explore software security analysis, covering vulnerability detection, attack mitigation, and automated exploit generation. Learn about cutting-edge research initiatives in program comprehension and security testing techniques.

• YouTube
• 49 minutes
• On-Demand
• Conference Talk

MIPS-X - The Next IoT Frontier

Explore MIPS-based IoT device research with a framework for efficient emulation, vulnerability analysis, and exploit development. Gain insights into CPU architectures, virtualization, and cross-compilation techniques.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

Low Level BootROM Protocol Fuzzing Secure Memory Regions

Explore low-level protocol fuzzing for secure microcontrollers, uncovering vulnerabilities in BootROM USB drivers. Learn about a custom fuzzing framework for SPI, I2C, USB, and UART, and its application in hardware security research.

• YouTube
• 44 minutes
• On-Demand
• Conference Talk

Attack Scenarios Abusing Azure Active Directory

Explore Azure AD security vulnerabilities, privilege escalation techniques, and mitigation strategies. Learn to protect your organization's cloud infrastructure from potential attacks and misconfigurations.

• YouTube
• 52 minutes
• On-Demand
• Conference Talk

5G Cyber Security Challenges and Solution

Explore 5G network security challenges, solutions, and design principles. Learn about industry collaboration, in-depth defense, zero-trust, and adaptive security for controllable 5G risks.

• YouTube
• 55 minutes
• On-Demand
• Conference Talk

Modern Post Exploitation - The Ghost In The Cloud

Explore modern post-exploitation techniques in cloud environments, focusing on IAM vulnerabilities in enterprise apps. Learn attacker strategies, discovery methods, and evasion tactics against security tools.

• YouTube
• 56 minutes
• On-Demand
• Conference Talk

Malicious Contracts

Explore the potential of smart contracts as anonymous rootkit C2 infrastructure, demonstrating their immutability, anonymity, and scalability for controlling infected devices remotely.

• YouTube
• 29 minutes
• On-Demand
• Conference Talk

Electro-optical Sound Eavesdropping

Explore electro-optical sound eavesdropping techniques, including Lamphone and Glowworm attacks, to recover speech from physical and virtual conversations using light analysis.

• YouTube
• 52 minutes
• On-Demand
• Conference Talk

Trapfuzzer - Coverage-Guided Binary Fuzzing with Breakpoints

Coverage-guided binary fuzzing tool for vulnerability discovery, featuring test management, mutation tracking, and visualization. Supports multiple architectures and debuggers, with successful application in finding software vulnerabilities.

• YouTube
• 46 minutes
• On-Demand
• Conference Talk

Framework to Examine Mobile App Privacy

Framework for examining mobile app privacy, focusing on user control over data, consent, and compliance with global regulations. Includes automatic tools and findings from top apps, highlighting pervasive privacy issues.

• YouTube
• 46 minutes
• On-Demand
• Conference Talk

Fuzzing RDP Client and Server

Exploring innovative techniques to fuzz RDP protocol using WinAFL, uncovering vulnerabilities in both client and server implementations for enhanced remote connection security.

• YouTube
• 47 minutes
• On-Demand
• Conference Talk