Why would you RUN this COMMAND?!!
Think “rm -rf /” is just a harmless meme? Think again. In this video, I explain exactly what this infamous Linux/Unix command does and why executing it could completely wipe out your system. It's a critical reminder for beginners and even experienced users to understand what they're typing into the terminal and what not to do.
#linux #commandline #root
https://www.youtube.com/shorts/osa8lsh9cO8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
UK Piracy Blocks: Your VPN's UK Exit Won't Help
The video explains how UK internet controls are tightening: the Online Safety Act pushes age-verification for adult-gated services, while Cloudflare now geo-blocks hundreds of piracy domains for UK users. That undercuts the usual “use a VPN” workaround, if your VPN exits in the UK, many sites still won't load. The video highlights Cloudflare's past criticism of blocking, their current participation, and the broader risk that governments could expand blocks beyond piracy, raising censorship, privacy, and cybersecurity concerns.
#onlineprivacyact #uk #vpn
https://www.youtube.com/shorts/xCP2-GjEURU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - Darren Kitchen Hak5 Pager
Another fun hacking gadget courtesy of Hak5 - a pager that pineapples.
https://www.youtube.com/watch?v=TPLRmpIbQuQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - KevOps Sellout Pool Party at the Sahara
This is what happens when you give KevOps a Pool Party. You want pirate songs and flying sharks? Because this is how you get pirate songs and flying sharks.
https://www.youtube.com/watch?v=K8fjM9k_AUY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Soutenez No Hack Me sur Tipeee
L'Actu de la veille
From stealing servers to saving lives: Working in red teaming | Jim Broome
Get your FREE Cybersecurity Salary Guide:
https://www.infosecinstitute.com/form/cybersecurity-salary-guide-podcast/?utm_source=youtube&utm_medium=podcast&utm_campaign=podcast
Jim Broome of Direct Defense has been doing red teaming since before it became a term — back when a "pentest" meant ,000, no questions asked and walking out with a server under your arm. In this episode, Jim shares wild stories from decades of ethical hacking, including breaking into major tech companies, causing a cardiac event during a physical penetration test, and why he believes soft skills trump technical knowledge for aspiring red teamers. Learn why most companies aren't ready for red teaming, how to transition into cybersecurity from unexpected fields like education or event planning, and what it...
https://www.youtube.com/watch?v=VenCOyY9U2w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This “USB” Can Steal Your Files in Seconds 😳
Sponsored by ThreatLocker | This video features Rob Allen, Chief Product Officer at ThreatLocker from ZTW2025. Rob introduces the infamous “rubber ducky” a hacking device disguised as a USB stick that can exfiltrate your data in seconds using PowerShell. Learn how ThreatLocker challenges cybersecurity assumptions with live tests at events, and why 99% of security tools fail to stop it. If you think your system is secure… you might want to watch this first.
#threatlocker #rubberducky #ztw2025
https://www.youtube.com/shorts/8QiCD8loU9E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Outsource Your Weaknesses
About Infosec
Infosec's mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ's security awareness training. Learn more at infosecinstitute.com.
https://www.youtube.com/shorts/-O1JbXV7cS0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How to Track the People Tracking YOU
Big thanks to ThreatLocker for sponsoring my trip to Black Hat 2025. To start your free trial with ThreatLocker please use the following link: https://www.threatlocker.com/davidbombal
Discover “Chasing Your Tail,” an open-source surveillance detection tool you can build with a Raspberry Pi. In this exclusive Black Hat interview, creator Matt explains how it tracks Wi-Fi, Bluetooth, and even tire sensors to spot if you're being followed, then flips the script to map where your followers spend time. Learn the origins of this tool, from avoiding surprise visits to protecting informants and aiding search & rescue. We cover the tech stack (Kismet, Python, GPS integration), real-world success stories, and how you can set it up yourself for under 0. Perfect for security pros, privacy
advocates,...
https://www.youtube.com/watch?v=cjXp3bBd2h8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Stop Trusting Input: 3 RULES
Thank you to ThreatLocker for sponsoring this video and my trip to Black Hat USA 2025.
Want to write secure code without becoming a full-time security engineer? In this video, Tanya Janca (SheHacksPurple) breaks down the 3 essentials every developer should use on day one:
Validate & sanitize all inputs to block malicious characters.
Output encode everything you render so it's treated as text, not code.
Use parameterized queries for every DB call to shut down SQL injection.
Stop copy-pasting from forums and start shipping code that resists XSS and SQLi by design. Tanya also points to her secure-coding book covering 10 languages and 8 frameworks for deeper, practical guidance.
You'll learn: input validation vs. sanitization, output encoding basics, safe DB access patterns, and a simple...
https://www.youtube.com/shorts/XyfyhO9aShY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Applying Modular Design to Maintain IR Playbooks at Scale
Playbook Power-Up: Applying Modular Design to Maintain IR Playbooks at Scale
🎙️ Jessica Gorman, Sr Director of Security Operations and Incident Response, Experian, Georgetown University
📍 Presented at SANS DFIR Summit 2025
With only 23% of surveyed security professionals stating their incident response (IR) playbooks are updated frequently enough to keep up with best practices, a new approach is needed to “power up” the way organizations maintain their playbooks.
The rise of Security Orchestration, Automation, and Response (SOAR) technology offers promising potential for cybersecurity teams to modernize incident response processes, but the challenge of managing and updating IR playbooks at scale persists, especially when organizations find themselves managing dozens (or even...
https://www.youtube.com/watch?v=fZ-Qhx_UtMM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
When to Conduct Structured and Unstructured Threat Hunts
Making Sense of the Chaos: When to Conduct Structured and Unstructured Threat Hunts
🎙️ Lee Archinal, Senior Threat Hunt Analyst, Intel 471
🎙️ Arun Warikoo, Head of Cyber Threat Intelligence, CIB Americas BNP Paribas , BNP Paribas
📍 Presented at SANS DFIR Summit 2025
Making Sense of the Chaos explores two distinct threat hunting approaches. Structured, hypothesis-driven hunts, and Unstructured hunts, where data leads the way.
We'll discuss when to apply each method, and examine how different triggers - like intel reports or APT activity, can initiate a structured hunt. The talk will also cover how unstructured hunts unfold through data discovery. Attendees will gain insights into leveraging both approaches to achieve different objectives in threat hunting.
View upcoming...
https://www.youtube.com/watch?v=VAVj1JE6dG0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Keynote | DFIR AI-ze Your Workflow
Keynote | DFIR AI-ze Your Workflow
🎙️ Mari DeGrazia, SANS Certified Instructor
📍 Presented at SANS DFIR Summit 2025
Beyond all the AI hype, how can you leverage AI in your DFIR life? Take a journey with me as I discuss AI and how we can start applying it to DFIR workflows to go beyond “can you write me code to….” Or “Can you write a paragraph for me on….”. I will share how I found my way into AI and demonstrate how you can start AI-zing your daily tasks and investigations.
View upcoming Summits: https://www.sans.org/u/DuS
https://www.youtube.com/watch?v=eG2wHGIPCaQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
A North Korean Cyber Operation
A North Korean Cyber Operation: Exposing ARP-Based Covert C2s, WebSocket Malware, and Video Conference Software Abuse
🎙️ Luis Garcia, Incident Response Expert, Sygnia
🎙️ Matthew Mosley, Manager of Incident Response, Sygnia
📍 Presented at SANS DFIR Summit 2025
This research uncovers a real-world covert remote-control system designed by a North Korean IT worker, who was caught operating within an unsuspecting organization.
The forensic investigation that followed pieced together a highly sophisticated malware ecosystem, leveraging ARP-based payload execution, WebSockets for stealthy command & control, and Zoom for covert persistence and remote access.
Through deep technical analysis and live attack demonstration, this session will break down how the attacker:
- Built...
https://www.youtube.com/watch?v=T7x195M8g0o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Strengthening Your Forensic and Response Mindset
Think Like an Examiner: Strengthening Your Forensic and Response Mindset
🎙️ Tony Knutson, Principal Consultant, Palo Alto Unit 42
📍 Presented at SANS DFIR Summit 2025
Cybersecurity professionals are often faced with complex, high-stakes investigations where quick decision-making and investigative accuracy are critical.
However, many practitioners struggle to balance the rapid response required in Incident Response (IR) with the deep analytical mindset needed for Digital Forensics (DF). Without a structured investigative approach, security teams risk missing key evidence, drawing premature conclusions, or failing to remediate threats effectively.
This presentation, “Think Like an Examiner: Strengthening Your Forensic & Response Mindset,” explores how cybersecurity professionals...
https://www.youtube.com/watch?v=rpqO8edR9mQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
MacOS Endpoint Security Framework
MacOS Endpoint Security Framework: Not Another MacOS Log Source
🎙️ Jacob Latonis, Staff Software Engineer, Proofpoint
🎙️ Julia Paluch, Engineer, GreyNoise Intelligence
📍 Presented at SANS DFIR Summit 2025
As many Mac DFIR professionals know, MacOS is constantly changing. New features are regularly being added to the platform that may provide a new source of information that an examiner can use during an investigation.
One such feature, the Endpoint Security Framework, was added in MacOS Catalina and new features are added in every major OS version update.
In this talk, we will dive into the Endpoint Security Framework and discuss how to take advantage of the information it collects to complement other sources, such as the Apple Unified Log, to perform threat hunts. Although...
https://www.youtube.com/watch?v=vF83KleL9FU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
MDR to IR Handoffs: Stick The Landing
MDR to IR Handoffs: Stick The Landing
🎙️ Jess Burn, Principal Analyst, Forrester Research
🎙️ Jeff Pollard, VP, Principal Analyst, Forrester
📍 Presented at SANS DFIR Summit 2025
Security leaders and teams rely on MDR providers to deliver 24/7 monitoring of security events, augment the expertise of internal SOC analysts, assist with or perform response actions, and offer assurance that adversaries are not present in the environment through threat hunting.
But sometimes, an attack or incident becomes a breach, requiring specialized IR services offered through the MDR provider itself or an IR services firm and covered under attorney client privilege.
In a time when the regulatory compliance clock starts ticking for most organizations, the rapid, thorough transfer of information...
https://www.youtube.com/watch?v=GzfVIx4Ekfk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How Threat Actors Persist In Your Microsoft 365
Backdoors & Breadcrumbs: How Threat Actors Persist In Your Microsoft 365
🎙️ Federico Cedolini, DFIR Senior Consultant, Stroz Friedberg
📍 Presented at SANS DFIR Summit 2025
Threat actors don't just break in, they find creative ways to remain persistent. In this session, we will explore persistence techniques used in real-life Microsoft 365 incidents and how to identify them in your environment.
From basic inbox rules to advanced techniques such as domain federation abuse, we'll break down the tactics and techniques used by threat actors to maintain long-term access.
For example, this talk will walk through what a threat actor needs to use SSPR to re-enter an account after the organization has changed the account password and reset sessions, and we'll also cover how threat...
https://www.youtube.com/watch?v=Q_h_OuBB4q8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Ensuring Data Integrity in Incident Response
Ensuring Data Integrity in Incident Response: Tools and Techniques for Forensically Sound Log Extraction
🎙️ Colin Meek, DFIR Consultant, Stroz Friedberg
📍 Presented at SANS DFIR Summit 2025
Logs are foundational to nearly all DFIR engagements, yet reliably extracting logs from sources such as network appliances, SaaS applications, and cloud environments can be challenging.
When standard UI-based exports fail, due to volume restrictions, technical limitations, or undocumented interfaces, investigators must turn to APIs for programmatic log collection.
This session will share practical tips for API-driven log extraction, including a detailed real-life case study involving extraction from an undocumented API of a proprietary client application. Additionally, we will discuss real-life...
https://www.youtube.com/watch?v=gylFpAzRIoc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Finding Relevant Alerts, Events and Logs
Finding Relevant Alerts, Events and Logs
🎙️ Ezz Tahoun, Lead researcher, University of Waterloo
📍 Presented at SANS DFIR Summit 2025
In modern cybersecurity, the ability to connect isolated security alerts into coherent, actionable attack chains is essential. However, traditional detection methods often struggle to contextualize vast amounts of security data, leaving slow and stealthy attacks undetected within a sea of noise and false positives.
This talk introduces a novel approach using open-source AI models to map, cluster, and correlate security alerts in order to uncover coordinated attacks. Through clustering, knowledge graphs, and AI-driven correlation, this approach offers significant improvements in SOC (Security Operations Center) efficiency and effectiveness. We detail...
https://www.youtube.com/watch?v=h_mzH3ezrnQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Investigating a Malicious Script in Microsoft Intune
Investigating a Malicious Script in Microsoft Intune: A DFIR Case Study
🎙️ Dennis Labossiere, Director, KPMG LLP
📍 Presented at SANS DFIR Summit 2025
The proliferation of cloud-based solutions has significantly transformed the landscape of enterprise security, with Microsoft Intune emerging as a pivotal tool for device and application management.
This Digital Forensics and Incident Response (DFIR) case study delves into the forensic investigation of a malicious script within Microsoft Intune, highlighting procedural insights and analytical techniques.
The incident, which occurred in 2023, involved unauthorized access to a client's Azure tenant by Scattered Spider. This presentation discusses the forensic analysis conducted to recreate the attack and understand its impact. This...
https://www.youtube.com/watch?v=j722t2yOLEk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
macOS Lockdown Mode: A DFIR Odyssey
macOS Lockdown Mode: A DFIR Odyssey
🎙️ Bhargav Rathod, Security Analyst, Salesforce
📍 Presented at SANS DFIR Summit 2025
With increasing cyber threats, Apple introduced a robust security feature known as ""Lockdown Mode."" This session delves into the intricacies of Lockdown Mode, exploring its purpose and evolution.
Initially designed to shield users from potential cyber threats, Lockdown Mode introduces a new layer of security by restricting certain functionalities on the Apple OS like iOS, macOS, watchOS, and iPadOS.
Participants will gain insights into the operational changes when Lockdown Mode is activated on macOS, including what functionalities are restricted. Due to restrictions imposed on macOS, this raises intriguing questions from a DFIR perspective and how it changes...
https://www.youtube.com/watch?v=qw50_vTUD5I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Forensic Analysis of TAILs
Does Slicing Onions Make You Cry - Forensic Analysis of TAILs
🎙️ Aaron Sparling, Principal Incident Response Engineer, Walmart - Cyber Security Incident Response
📍 Presented at SANS DFIR Summit 2025
Adversaries leverage the TAILs (The Amnesic Incognito Live System) operating system for conducting criminal activity.
This presentation will address forensic imaging and analysis issues and illustrate techniques which can be used to access and analyze the much needed data. TAILs runs within the physical memory (RAM) of the host system, which if imaged and analyzed can provide numerous valuable forensic artifacts. This talk will address issued faced when confronted with systems running TAILs, options for imaging the TAILs instance and methods which can be applied to locate artifacts...
https://www.youtube.com/watch?v=AlWUrqYXP5c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Detecting Modern Ransomware Attacks in the Financial Sector
From Identity Admins to Cloud Compromise: Detecting Modern Ransomware Attacks in the Financial Sector
🎙️ Arda Büyükkaya, Senior Cyber Threat Intelligence Analyst, EclecticIQ
📍 Presented at SANS DFIR Summit 2025
Human-operated ransomware groups have increased their focus on cloud environments, targeting identity administrators and cloud misconfigurations to gain persistent access.
The financial sector is especially focused by Ransomware groups, given its high value target and reliance on cloud-based identity platforms, virtual infrastructure, and SaaS applications, which provide multiple avenues for compromise. By compromising identity admins and abusing misconfigured access controls, adversaries can stealthily pivot through cloud workloads and initiate domain-wide ransomware...
https://www.youtube.com/watch?v=SZd7bVXkdro
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
L'Actu à J-2
AI Clones Your Voice in Just SECONDS
The Call Might Sound Real... But It's AI.
AI voice cloning is here, and it's dangerously convincing. Microsoft's Azure AI can now replicate a person's voice with just seconds of recorded audio. In this video, we break down how scammers are using this tech to impersonate family members, extract sensitive info, and pull off terrifyingly real phone scams.
🔐 Learn how to protect your family with simple safeguards like passcodes.
📞 See real-world examples of deepfake scams targeting officials.
🤖 Understand how the tech works—and why it's hard to detect.
#ai #voicecloning #deepfake
https://www.youtube.com/shorts/6HqnTRVIzzg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Device Sends Internet Through LIGHT (Not Radio)
Discover how Li-Fi technology is changing wireless communication. In this demo, David Bombal tests AeroLiFi's Li-Fi starter kit—a system that uses infrared light to transmit data instead of traditional radio-based Wi-Fi. Learn how it performs in real-world scenarios, why it's a game-changer for secure networks, and what you can expect in terms of speed, signal blockage, and setup. Perfect for tech enthusiasts, cybersecurity professionals, and anyone curious about next-gen wireless solutions.
🔧 Test setup includes:
- Li-Fi access point + client dongle
- Internet via Starlink
- Local & cloud speed tests
- Signal blocking with real-time effects
// Sponsored SEGMENT //
Big thanks to aeroLifi for sponsoring the aeroLifi Starter Kit that made this demo possible.
// David's SOCIAL //...
https://www.youtube.com/watch?v=vz4MBmIRh0s
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
🚨 Hackers HATE This Wireless Trick
Big thanks to aeroLifi for sponsoring the aeroLifi Starter Kit that made this demo possible.
Unlock the future of wireless communication with Li-Fi — a groundbreaking technology that uses infrared light instead of radio waves to transmit data. In this video, I'll demonstrate how Li-Fi works using a real-world setup, explore its massive security benefits, and explain why even the US Army is adopting it. Learn why Li-Fi is not just faster, it's also virtually hacker-proof and perfect for high-security applications.
🔒 Why hackers can't break in
💡 How Li-Fi performs vs. Wi-Fi
📡 How scientists are already using Wi-Fi to track people — and why Li-Fi avoids that entirely
#lifi #wifi #wirelesstech
https://www.youtube.com/shorts/lpWeR_kbghg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Leaking Passwords via CSS Injection - "Fancy Login Form" [WHY CTF 2025]
🚩 Video walkthrough for the "Fancy Login Form" web challenge featured in the 2025 WHY CTF competition. The challenge involved exploiting a URL-based redirection to take control of a CSS file, then using blind exfiltration to extract each character of the admin's password from the login form field 😎 #CTF #Challenge #WHY2025
Check out the accompanying writeups here: https://book.cryptocat.me/ctf-writeups/2025/why/web
Join my discord server if you have any questions: https://discord.cryptocat.me
🐛What Hackers Yearn ( @WHY2025NL ) CTF🐞
https://ctf.why2025.org
https://why2025.org
https://discord.gg/fkn7qW3GRT
https://ctftime.org/event/2680
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00 Intro
0:46 Fancy Login Form
2:27 Hijacking CSS file
6:10 Blind data...
https://www.youtube.com/watch?v=jUjlj2z5jJk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
L'Actu des jours précédents
AI REPLICATED the Equifax Hack - No Humans Involved
AI is getting dangerously smart. This video breaks down a Carnegie Mellon University study where a large language model (LLM) autonomously replicated the Equifax breach, without any human help. Researchers taught the AI a mental model of red teaming behavior, and it successfully executed a multi-stage attack in a realistic enterprise environment. We explore what this means for the future of cybersecurity, red teaming, and automated defence systems.
#llm #ai #breach
https://www.youtube.com/shorts/2p19itvWo1E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Getting into Data Privacy with Zaviant's Will Sweeney!
About Infosec
Infosec's mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ's security awareness training. Learn more at infosecinstitute.com.
https://www.youtube.com/shorts/5W4et_g6iws
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Law Could KILL Internet Freedom
Is the Online Safety Act really protecting children—or just opening the door to mass surveillance and censorship?
In this video, we dive into the alarming implications of the UK's 2025 Online Safety Act. From mandatory age verification and discouraging VPN use, to secret government units monitoring online speech, we examine how policies meant to protect could instead undermine free expression and privacy. With comparisons to Orwell's 1984, and developments in countries like Australia, Norway, and the US, this isn't just a UK issue—it's a global warning.
🔐 Topics Covered:
Age verification & VPN restrictions
Secret Whitehall surveillance units
Social media censorship
Global trends toward internet control
#freespeech #onlinesafetyact #digitalprivacy
https://www.youtube.com/shorts/UD2sfpBla1U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Analysing the DOM to find Reflected XSS
Stuck watching YouTube videos about bug bounty hunting rather than a bounty hitting your inbox? In this series I partner with Bugcrowd to bring you everything you need to know to find their most common first bugs. In this video we explore one of the common first vulnerabilities - Reflected Cross-Site Scripting (XSS). Learn the basics of XSS, how to identify and exploit this vulnerability, and see a practical demonstration you can replicate on your own targets. With step-by-step methodology and tips, this episode will guide you through finding and validating the internets most common first bug.
This series couldn't happen without the support of our sponsor Bugcrowd, Bugcrowd is the best place to start hacking with a wide range of public and private programs from APIs to Desktop Applications...
https://www.youtube.com/watch?v=CpV3XDqzYyE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
You'll OWN NOTHING... and YOU pay the price!
In this video, we reveal how threat actors are sneaking InfoStealer malware into early-access Steam titles and why Steam's subscriber agreement lets Valve off the hook — leaving you with no ownership, forced online connections, forced subscriptions, and zero liability protection. We break down the malware's delivery mechanism, dissect the critical licensing vs. ownership clauses, outline the “as-is” warranty and liability disclaimers (including your sole responsibility for damages), compare international exceptions (like Germany's), and warn about the subscription treadmill trend.
// David's SOCIAL //
Discord: https://discord.com/invite/usKSyzb
X: https://www.twitter.com/davidbombal
Instagram: https://www.instagram.com/davidbombal
LinkedIn: https://www.linkedin.com/in/davidbombal
Facebook:...
https://www.youtube.com/watch?v=u1MVI-C5XmE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Hacker QUITS mid-attack... ZERO trust beat them
Thank you to ThreatLocker for sponsoring this video and my trip to ZTW 2025!
Discover a powerful real-world cybersecurity case study where ThreatLocker's zero trust and application control stopped ransomware in its tracks. In this video, you'll hear how a hospital's systems were fully encrypted while another, using ThreatLocker, completely blocked the attack... even without EDR or XDR. Learn how default deny, allowlisting, and zero trust architecture make a real difference. Perfect for IT admins, security pros, and CISOs looking for proven defences.
#zerotrust #cybersecurity #ztw2025
https://www.youtube.com/shorts/6CbSiek5Ph0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEFCON 33 Vlog
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=kxpkARgSjlI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
2 FLAWS Let Hackers Own MILLIONS of Cars
At Defcon 33, researchers uncovered a shocking vulnerability in a major automaker's centralized dealer portal — a flaw so severe it allowed hackers to remotely unlock cars, start engines, steal personal data, and even transfer ownership without the owner's knowledge. In this video, we break down exactly how the hack worked, why just two authentication mistakes opened the door, and what it means for the future of connected cars. If you own a vehicle with remote start or app control, this is a must-watch warning.
#carhacking #defcon #cybersecurity
https://www.youtube.com/shorts/Hq-MLzxovcA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AI CROSSED the Line - Taylor Swift Deepfakes!
Elon Musk's AI, Grok, is facing serious accusations after allegedly creating explicit Taylor Swift deepfakes without any user prompting. In this video, we break down what happened, how Grok's “spicy mode” bypassed safeguards, why this matters for AI safety, and what it reveals about the current “wild west” of artificial intelligence. Is AI safety failing before our eyes?
#ai #taylorswift #grok
https://www.youtube.com/shorts/ZMAqU3RmbIw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HTTP/1.1 - The Desync Endgame
Based on the amazing work of James Kettle of @PortSwiggerTV found at https://portswigger.net/research/http1-must-die.
I've guided NotebookLM by @Google to create this presentation for offensive pentesters.
https://www.youtube.com/watch?v=zs1rZnZuJ6A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Charging Cable Can HACK You 😱
Thank you to @ThreatLocker for sponsoring this video and my trip to ZTW 2025.
Think your charging cable is safe? Think again.
In this video, we break down the OMG Cable, a weaponized USB-C cable that looks like an ordinary charger but hides a powerful hacking device inside. Learn how attackers can remotely connect via Wi-Fi, run malicious commands, steal your data, and completely compromise your system all through what seems like a harmless cable. We'll show real-world attack scenarios, including how social engineering can make these devices almost impossible to detect.
#omg #chargingcable #threatlocker
https://www.youtube.com/shorts/BxNuRAG3_ms
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
On HTTP Request Smuggling - RFC 9110 Style
Based on the RFC 9110, I've guided NotebookLM by @Google to create this presentation for offensive pentesters, specifically on HTTP Methods.
RFC 9110: https://www.rfc-editor.org/rfc/rfc9110.html
https://www.youtube.com/watch?v=CvEBA_Sm-mw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
OWASP Global AppSec EU 2025 Closing Ceremony
Watch the closing ceremony to the OWASP Global AppSec EU 2025 conference.
https://www.youtube.com/watch?v=Fe_C8qGFTvI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Keynote: Nemo Resideo: Managing Application Security Through Rapid Change - Sarah-Jane Madden
Watch Sarah-Jane Madden's keynote talk from the 1st day of OWASP Global AppSec EU 2025 Barcelona.
https://www.youtube.com/watch?v=CZdSGKoi90Y
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Keynote: Outside the Ivory Tower: Connecting Practice and Science - Dr. Kate Labunets
Watch Dr. Kate Labunet's keynote talk from the 2nd day of OWASP Global AppSec EU 2025 Barcelona.
https://www.youtube.com/watch?v=2QQTbtFV-Kc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Why Hackers Are Stealing Encrypted Data Now To Decrypt Later | David Close
Get your FREE Cybersecurity Salary Guide: https://www.infosecinstitute.com/form/cybersecurity-salary-guide-podcast/?utm_source=youtube&utm_medium=podcast&utm_campaign=podcast
David Close, Chief Solutions Architect at Futurex, discusses the reality facing our digital world: quantum computing will soon break the encryption protecting everything from mobile banking to satellite communications. But here's the twist — hackers aren't waiting. They're harvesting encrypted data now, betting that quantum computers will eventually crack today's "unbreakable" codes in a strategy called "harvest now, decrypt later." David explains how NIST's new post-quantum cryptography standards are already being deployed by companies like Google and CloudFlare, why crypto agility is essential for future-proofing...
https://www.youtube.com/watch?v=kKa191wEOiE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - Mar Williams
Mar Williams created this year's badge and much of the art all around you at DEF CON 33. Here's a behind the scenes interview about what goes into crafting the visual style of a hacker convention.
https://www.youtube.com/watch?v=3YT_tOKHSDA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Sherif Mansour - Donate Blood Today!
Sherif Mansour, our Chair of the Global Board of Directors in 2021, has been diagnosed with leukemia, which is a cancer of the blood. Learn how you can help folks with leukemia, no matter where you are!
Don't hesitate to contact your local blood donation service and make an appointment today. In the UK, you can donate via the NHS (https://www.blood.co.uk/why-give-blood/). You can donate via the Red Cross Blood Service or Red Cross Lifeblood in many countries. Search for "donate blood" in your search engine to find out more.
🌍 Global Resources
World Health Organization – Blood Services Directory https://www.who.int/campaigns/world-blood-donor-day
IFRC – Find a Red Cross/Red Crescent https://www.ifrc.org/national-societies
🇺🇸 USA – American Red Cross | AABB Blood Bank Locator...
https://www.youtube.com/watch?v=LKZTppmAS84
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - Retro Tech Community & Badge Life LIVE - d3dbot x psyop x grrrizzzz
Retro Tech and Badge Life - two great DEF CON tastes that taste great together.
https://www.youtube.com/watch?v=b5zL6IijpYA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - ICS Village Treatment Plant
Industrial Control Systems (ICS) Village explains their Water Treatment Plant Display.
https://www.youtube.com/watch?v=D_3mUd7shX4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HTTP Methods for Offensive Pentesting
Based on the RFC 9110, I've guided NotebookLM by @Google to create this presentation for offensive pentesters, specifically on HTTP Methods.
RFC 9110: https://www.rfc-editor.org/rfc/rfc9110.html
https://www.youtube.com/watch?v=ZtoPYQD0rXs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
And here they are. WiFi Pineapple Pager at DEF CON 33. Come say hi to Ali Diamond and I 🍍📟
https://www.youtube.com/shorts/IU_IYtscEbc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - IoT Village Preview
Celebrate 10 years of DEF CON Internet of Things Village!
https://www.youtube.com/shorts/Xx94tMP_6ys
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - RedAlert ICS CTF
Come check out the RedAlert ICS CTF1
https://www.youtube.com/shorts/AMA6e_oyEH8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEFCON 33 Video Team - Bug Bounty Village
You don't even have to be here to get in on the fun at the BBV!
https://www.youtube.com/shorts/7eXzwI8uD5M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEFCON 33 Video Team - Embedded Systems Village #defcon #defcon33 #embedded systems village
Embedded Systems Village checking in.
https://www.youtube.com/shorts/K4oYVfQ98HU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - Gen Sec CTF #defcon #defcon33 #gensecctf
Come see the Gen Sec CTF at DEF CON 33
https://www.youtube.com/shorts/Kx86gzmY_NE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - Red Team Village #retrogaming #cryptocomnft #retro
A quick update on what's going down at the Red Team Village at DEF CON 33.
https://www.youtube.com/shorts/-B_rYhHQ_9k
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Video Team - Contest Update - Tiberius
Contest runner Tiberius gives some updates about the DEF CON 33 Contest situation.
https://www.youtube.com/watch?v=q6ri2BTily4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How AI Is Improving Scam Emails 😮📧
How AI Is Improving Scam Emails | John Hansman
About Infosec
Infosec's mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ's security awareness training. Learn more at infosecinstitute.com.
https://www.youtube.com/shorts/ITpDd9I4oXM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Honored to be contributing to @DEFCONConference and the hacker community at large! 🍍 🕶️
https://www.youtube.com/shorts/wsyPxxN4oM0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
July 2025 Board Meeting
Minutes here: https://owasp.org/www-board/meetings-historical/2025/202507.html
Managed by the OWASP® Foundation
https://owasp.org/
https://www.youtube.com/watch?v=xYVKG4R9_kY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
August 6, 2025
https://www.youtube.com/shorts/7neJyXMIZU0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Formula for Business Success Revealed
The Formula for Business Success Revealed with John Hansman
About Infosec
Infosec's mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ's security awareness training. Learn more at infosecinstitute.com.
https://www.youtube.com/shorts/aUM5O6O3t6Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Stay Ahead of Ransomware - Pre-Ransomware Notification and YOU!
Ransomware attacks continue to devastate businesses around the world. Initial access methods are evolving, new ransomware groups continue to spin into existence, and dwell times continue to decrease. Even more so than ever, speed of detection is of utmost importance. Luckily, the Cybersecurity & Infrastructure Security Agency (CISA), a component of the US Department of Homeland Security (DHS), started their Pre-Ransomware Notification Initiative (PRNI) back in 2023. The PRNI program provided over 2,100 alerts to help secure businesses in 2024 alone. This program wouldn't be possible without the tireless efforts of the threat researcher community at large, and we are more than appreciative of their hard work. Join co-hosts Ryan and Mari as they welcome Dave Stern, Lead of the Actionable Information...
https://www.youtube.com/watch?v=C3VsXk_us_k
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introducing WiFi Pineapple Pager 🍍📟 by Hak5
Introducing the WiFi Pineapple Pager: https://shop.hak5.org/products/wifi-pineapple-pager
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/watch?v=GUaUerYCvs0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC33 - Red Team Village x Amazon
Thank you for being one of our platinum sponsors!
Additional information about Amazon can be obtained from https://www.aboutamazon.com/
They're Hiring!: https://amazon.jobs/content/en/teams/amazon-security/devices-services
Twitter/X: https://x.com/amazon
LinkedIn: https://www.linkedin.com/company/amazon/
_________________________________________________________________________
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=-KIEqwVejSE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AWS Hands-On Lab: Build Your First EC2 Web Server | Free Hands-On Workshop
— Watch part 1 here: https://www.youtube.com/watch?v=TPKQup_b0yk
— Access the lab here with a free Infosec Skills account: https://app.infosecinstitute.com/portal/skills/content/asset/43595?utm_source=youtube&utm_medium=webinar&utm_campaign=aws+launch
— Additional AWS training: https://www.infosecinstitute.com/skills/content-library/?Type=Boot+camp&_=1743748776579&Vendor=AWS&utm_source=youtube&utm_medium=webinar&utm_campaign=aws+launch
—Upcoming live workshops and events: https://www.infosecinstitute.com/events/?utm_source=youtube&utm_medium=webinar&utm_campaign=aws+launch
Ready to take your AWS skills to the next level? In this hands-on workshop, Keatron Evans guides you through building your first EC2 instance from scratch, setting up a Windows web...
https://www.youtube.com/watch?v=Lysx-l9LDrU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HTTP Request Smuggling Explained (with James Kettle)
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=QjPFjd8GJWY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Behind the Book: Threat Hunting macOS with Jaron Bradley
In this episode, I sit down with Jaron Bradley, author of the upcoming book Threat Hunting macOS. With the recent release of the new 13Cubed training course Investigating macOS Endpoints, this felt like the perfect time to bring Jaron on the channel to discuss his new book — a resource I believe will be an excellent companion to the course.
📘 Order Jaron's Book – Threat Hunting macOS
https://themittenmac.com/threat-hunting-book/
🌐 Visit Jaron's Website – The Mitten Mac
https://themittenmac.com/
🎓 Learn macOS Forensics!
https://training.13cubed.com/investigating-macos-endpoints
#Forensics #DigitalForensics #DFIR #ComputerForensics #macOSForensics
https://www.youtube.com/watch?v=8Uj2NbWnU6M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DISK PAGING Secrets You Need to Know
🔥 Learn How Disk Paging Works on Windows Operating System
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
Virtual memory is an essential concept in computer science that allows an operating system to create the illusion of having more memory than what is physically available. This Virtual Memory tutorial' explains how Windows uses this system, giving a glimpse into the Windows Internals.
In Disk Paging, when the system requires more physical memory than available, the memory manager moves unused memory pages to special files called page files on disk to free up memory, a process known as paging out memory. The memory addresses remain valid, and when...
https://www.youtube.com/shorts/Ftkx_4BWnn8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Women's App Hacked #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/qyMzFP8K64w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Preview - Malware Village
Preview of the DEF CON 33 Malware Village.
https://www.youtube.com/watch?v=6BIBQUmJgac
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Google vs Supply Chain Attacks #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/MEcFtZ1x1p0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Build Your Own CHEAT ENGINE in PYTHON with PyQt5!
🔥 Learn How To Build a Python Memory Scanner Frontend with Python!
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
🔗 Article Link: https://guidedhacking.com/threads/python-memory-scanner-pgh109.20962/
👨💻 Content Creator: codenulls
👉 https://guidedhacking.com/members/codenulls.272722/
❤️ Free Courses from Perkins Fund: https://perkinsfund.org/courses
📜 Video Description:
We're going to build a Python memory scanner from scratch, similar to Cheat Engine. This tool will allow selecting the target process and attach to it. One of the...
https://www.youtube.com/watch?v=tC86VhNdaFc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Preview - Cryptocurrency Preview
What to expect from the expanded Cryptocurrency offerings at DEF CON 33
https://www.youtube.com/watch?v=mHFcecX4RIA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC33 - Red Team Village x Flare
Thank you for being one of our platinum sponsors!
Additional information about Flare can be obtained from https://flare.io/.
Twitter/X: https://twitter.com/FlareSystems
LinkedIn: https://www.linkedin.com/company/flare-systems-inc
Discord: https://discord.gg/qRGBT2TcEV
YouTube: https://www.youtube.com/channel/UCU5Nr_7GpdxgxPOhuWuvXVg
_________________________________________________________________________
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=xapuRA5uEbg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Google Takes on Supply Chain Attacks - Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️
@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev
Want to work with Ali? endingwithalicollabs@gmail.com
[❗] Join the Patreon→ https://patreon.com/threatwire
00:00 0 - Intro
00:16 1 - Women's App Hacked
01:36 2 - Google vs Supply Chain Attacks
03:05 3 - DEF CON
00:00 4 - Outro
LINKS
🔗 Story 1: Women's App Hacked
https://www.404media.co/women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/
https://www.cnet.com/tech/services-and-software/tea-app-breach-exposes-72000-selfies-and-id-photos/
https://www.404media.co/a-second-tea-breach-reveals-users-dms-about-abortions-and-cheating/
🔗...
https://www.youtube.com/watch?v=jdQb-h5PADI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Still not found your first bug? Try IDORs
Stuck watching YouTube videos about bug bounty hunting rather than your inbox? In this series I partner with Bugcrowd to bring you everything you need to know to find their most common first bugs. In this episode we're talking about the ever popular IDOR, and while yes, I am aware I have made videos on this topic many times, it's still a solid choice for your first bug, difficult to automate and scale, yet easy to understand and test for. Its tediousness means that top hackers often skip them in favour of trickier bugs, making it perfect for newer bug bounty hunters to focus on.
This series couldn't happen without the support of our sponsor Bugcrowd, Bugcrowd is the best place to start hacking with a wide range of public and private programs from APIs to Desktop Applications and everything...
https://www.youtube.com/watch?v=8Uva1su3goc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEF CON 33 Preview - Hardware Hacking Village
The principles that guide the Hardware Hacking Village, now in convenient YouTube form.
https://www.youtube.com/watch?v=leKO6dphHBY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC33 - Red Team Village x White Knight Labs
Thank you for being one of our platinum sponsors!
Additional information about White Knight Labs can be obtained from https://whiteknightlabs.com.
Twitter/X: https://twitter.com/WKL_cyber
LinkedIn: https://www.linkedin.com/company/white-knight-labs/
Discord: https://discord.gg/qRGBT2TcEV
_________________________________________________________________________
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=RULalD2__Lg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC33 - Red Team Village x Kindo
Thank you for being one of our platinum sponsors!
Additional information about Kindo can be obtained from https://www.kindo.ai/.
Twitter/X: https://x.com/kindoai
LinkedIn: https://linkedin.com/company/kindo-ai
YouTube: https://www.youtube.com/channel/UC9ahwU5unSzp0ytNPcjVg8g
_________________________________________________________________________
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=PT7zVhbdvpk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Hypervisor Isolated UserMode Trustlets
🔥 Reverse Engineer Kernel Anti-Cheat Here: https://guidedhacking.com/forums/anticheat-bypass-antidebug-tutorials.46/
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
✏️ Tags:
#cybersecurity #hypervisor #hyperv
Windows Isolated User Mode Trustlets
hypervisor Trustlet
Windows Isolated User Mode
hyper-v hypervisors
https://www.youtube.com/shorts/D4SbX6_Fs3o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Working in ransomware response, investigation and recovery | John Price
Get your FREE Cybersecurity Salary Guide: https://www.infosecinstitute.com/form/cybersecurity-salary-guide-podcast/?utm_source=youtube&utm_medium=podcast&utm_campaign=podcast
John Price of SubRosa joins today's Cyber Work Podcast to share insights from his unique career path spanning UK military counterintelligence, banking cybersecurity and founding his own digital forensics consultancy. John breaks down what really happens when ransomware hits small and medium businesses, why most companies choose recovery over legal action, and how his team helps organizations get back on their feet quickly. He also discusses the growing threats facing industries like automotive dealerships, the critical role of documentation in forensics work, and why AI will reshape both offensive and defensive...
https://www.youtube.com/watch?v=GPsAofzhQbY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Ransomware Group Rebrand Strikes #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/fDnFRQ9hyGY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Lessons Learned From 0,000 In Blind Cross Site Scripting (Blind XSS)!
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=QSiXHb97E1c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The US Goes On The Cyber Offensive #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/M4lhnk2YCyw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
SharePoint 0-Day Went Unpatched #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/Uz7g03pnpCA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Meet Network Chuck at Black Hat USA!
Join us at #BHUSA and meet @NetworkChuck 📣
https://www.youtube.com/shorts/r45TCd9rx3w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DEFCON Game Hacking Village CTF
🔥 DEFCON GAME HACKING VILLAGE CTF WALKTHROUGH
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
👉 Official Game Hacking Village Website: https://www.gamehacking.gg/
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
The Game Hacking Community at DEFCON 32 in 2024 was the debut of this unique game hacking CTF. We'll be walking you through the full game hacking challenge! This is a beginner tutorial but features some fun and unique challenges using a cool Unity game made just for this challenge.
Guided Hacking sponsored it last year and this year's upcoming event too! The 2024 was a huge success and...
https://www.youtube.com/watch?v=0O1JMrXuncw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Massive Microsoft 0-Day Exploited and Unfixed - Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️
@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev
Want to work with Ali? endingwithalicollabs@gmail.com
[❗] Join the Patreon→ https://patreon.com/threatwire
0:00 0 - Intro
1 - SharePoint 0-Day Went Unpatched
2 - The US Goes On The Cyber Offensive
3 - Ransomware Group Rebrand Strikes
4 - Outro
LINKS
🔗 Story 1: SharePoint 0-Day Went Unpatched
https://timesofindia.indiatimes.com/technology/tech-news/microsoft-sharepoint-zero-day-breach-hits-75-servers-heres-what-the-company-said/articleshow/122805393.cms
https://x.com/codewhitesec/status/1944743478350557232
https://research.eye.security/sharepoint-under-siege/
https://learn.microsoft.com/en-us/previous-versions/aspnet/bb386448(v=vs.100)
https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
🔗...
https://www.youtube.com/watch?v=N87F6ifqxo0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
From security audits to privacy consulting: Building a GRC practice | Will Sweeney
Get your FREE Cybersecurity Salary Guide: https://www.infosecinstitute.com/form/cybersecurity-salary-guide-podcast/?utm_source=youtube&utm_medium=podcast&utm_campaign=podcast
Will Sweeney, founding and managing partner of Zaviant, joins the Cyber Work Podcast to discuss the evolving landscape of data privacy and GRC (governance, risk and compliance). With experience overseeing complex information security audits for Fortune 100 companies, Will shares insights on everything from the key differences between security auditing and implementation to whether privacy regulatory frameworks will continue multiplying or begin consolidating. He offers practical advice for GRC aspirants, emphasizing the importance of understanding core security processes rather than getting lost in framework...
https://www.youtube.com/watch?v=rk1U531PnXE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Whois Hak5?
whois hak5.org | grep -i created && echo "Happy Birthday Hak5!"
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/V91QRkV35hk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How I Saved My First 0,000 From Bug Bounty Hunting
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=j5nm38fSy60
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
CitrixBleed2 Confirmed #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/S0tvTXPGUVQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
CPU Exploit Ported to GPU #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/6Ip-c47qb3Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Cisco Left Credentials In Prod #technews #cybersecurity @endingwithali
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.
https://www.youtube.com/shorts/wcaOWmZnzs4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
how hackers hide (Intro to Beacon Object Files - with Empire C2!)
https://jh.live/bcsecurity || Get expert-led training on advanced threat emulation or cybersecurity services across the board with BC Security: https://jh.live/bcsecurity
Special thanks to Matt Ehrnschwender (@M_Alpha / @MEhrn00) for his help in preparing this video!
https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_main.htm
https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_how-to-develop.htm
https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_bof-c-api.htm
https://github.com/trustedsec/COFFLoader
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getcurrentprocessid
https://github.com/BC-SECURITY/Empire
https://bc-security.gitbook.io/empire-wiki/modules/module-development
https://github.com/trustedsec/CS-Situational-Awareness-BOF
Learn...
https://www.youtube.com/watch?v=p3fByg8pa1g
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Is PINCE the BEST Linux Game Hacking Tool?
🔥 PINCE Is Not Cheat Engine.... or is it?
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
✏️ Tags:
#gamehacking #cheatengine #imgui
PINCE is not cheat engine
linux cheat engine
cheat engine tutorial
PINCE tutorial
cheat engine linux
https://www.youtube.com/shorts/1OHcmiFJi_w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How Scammers Profit from Disasters: The Charity Scam You Need to Know | Hacker Headlines
Learn how cybercriminals exploit natural disasters and tragedies to steal money through fake charity scams in this episode of Hacker Headlines with Keatron Evans. Scammers create fraudulent charity websites, impersonate disaster victims on fundraising platforms, and send unsolicited donation requests to steal your money when you're trying to help those in need. This episode reveals the tactics scammers use and provides three essential steps to protect yourself while still supporting legitimate disaster relief efforts.
0:00 - Introduction to disaster scams
0:35 - Avoiding unsolicited charity requests
1:15 - How to verify fundraising campaigns safely
1:58 - Only donate to trusted, verified charities
2:45 - Conclusion and key takeaways
Learn more about Hacker Headlines and the Infosec IQ...
https://www.youtube.com/watch?v=i6aGdO1UhKw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
What are AWS S3 buckets? Simple explanation | Cyber Work | #AWS #cloudsecurity
Infosec's Keatron Evans breaks down AWS S3 buckets in the simplest way possible: think of them as web-accessible folders that Amazon lets you create to store and share files. Whether you're sharing with other AWS users or making content publicly available, S3 buckets are your go-to storage solution. Watch as he walks through the AWS console to show you exactly how to create your first bucket!
About Infosec
Infosec's mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5...
https://www.youtube.com/shorts/29K8m8VyhKY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Global AppSec USA 2025 Washington, D.C.
PURCHASE YOUR TICKETS NOW: https://owasp.glueup.com/event/owasp-2025-global-appsec-usa-washington-dc-131624/home.html
Training Dates - November 3-5, 2025
Conference Dates - November 6-7, 2025
From November 6–7, 2025, connect with over 800 hundred security experts, thought leaders, and practitioners. Be a part of something extraordinary at the OWASP Global AppSec US Conference, OWASP's largest US Conference, taking place in the heart of Washington, D.C. This is your opportunity to immerse yourself in the leading event for application security professionals, where passion, innovation, and community converge.
Ours is an event designed to fuel your passion for security. This is your chance to connect, learn, and grow with some of the brightest minds in the field. Be inspired by our keynote...
https://www.youtube.com/watch?v=5Xuvcfoha_I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
From "dead-end job" to CEO: Building an IT consulting business | John Hansman
Get your FREE Cybersecurity Salary Guide: https://www.infosecinstitute.com/form/cybersecurity-salary-guide-podcast/?utm_source=youtube&utm_medium=podcast&utm_campaign=podcast
John Hansman of Truit joins today's Cyber Work episode to share his journey from a "dead-end job" in electronic security to building a thriving managed IT services company. As the co-host of the Business & Bytes podcast, John brings a unique perspective on how small businesses can leverage AI tools to solve fundamental challenges while maintaining strong cybersecurity practices. He shares practical AI tools that business owners are leaving on the table, discusses the mindset shifts required for entrepreneurship, and explains how his company pivoted during the pandemic to emerge stronger than ever.
0:00 - Intro...
https://www.youtube.com/watch?v=JttvqTzmv34
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Tiny JWT Mistake = Massive Bug Bounty
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=0R3xHx7fPUM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Windows Memory Forensics Challenge
Welcome to a special Windows Memory Forensics Challenge from 13Cubed. This is an excellent opportunity to get some hands-on practice with Windows memory forensics. You'll find the questions below, as well as a link to download the memory sample needed to answer those questions.
🎉 Check out the official training courses from 13Cubed at https://training.13cubed.com!
🛑 CONTEST IS CLOSED 🛑
All winners have been selected. We still encourage you to participate in the lab, as we believe it will serve as an excellent practice opportunity. If you do participate, please consider creating a video or blog-based walkthrough of the process, as it would be a valuable resource for the community!
⚠️ CAUTION ⚠️
This memory sample contains a simulated ransomware for educational purposes....
https://www.youtube.com/watch?v=6JN6iAenEoA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
how hackers avoid getting caught
https://jh.live/flare || Track data on the dark web, hunt adversaries across the cybercrime ecosystem, and manage threat intelligence for your exposed attack surface with Flare! Start a free trial and see what info is out there: https://jh.live/flare
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=6-Gbv0h7m1I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Learn Google Dorking!
Just Hacking Training livestream with Bailey Marshall, July 8, 2025 at 12pm PT / 3pm ET. https://justhacking.com
https://www.youtube.com/watch?v=6HBEvVrMyX8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
GuidedHacking.com Changed Game Hacking Forever.
🔥 GuidedHacking.com will always be the GOAT.
👨💻 Buy Our Courses: https://guidedhacking.com/register/
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
💰 Donate on Patreon: https://patreon.com/guidedhacking
✏️ Tags:
#cheatengine #guidedhacking #gamehacking
game hacking tutorials
gamehacking bible
game hacking course
guidedhacking.com
game hacking courses
guidedhacking
game hacking rake
guided hacking
game hacking
guidedhacking rake
game hackers
game hacking tutorials
game hacking bible
guidedhacking.com rake
gamehacking
guidedhacking.com
https://www.youtube.com/shorts/A_ErraCdJrQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How to Get the Most Out of the Python Decompilers Uncompyle6 and Decompyle3
How to Get the Most Out of the Python Decompilers Uncompyle6 and Decompyle3 - How to Write and Read a Bytecode Decompiler
Uncompyle6, and decompyle3 are the most complete, popular, and accurate open-source Python bytecode decompilers available for the Python versions they support. The underlying cross-platform disassembler they use, xdis, is also unique.
The decompilers produce runnable Python source code for the Python version dialect that the code was written in. Furthermore, they produce the thought process used to recreate the source code. An abstract parse of the bytecode instructions can be used to understand how sequences of bytecode correspond to sequences of source code.
The disassembler they use is also unique in in a number of ways that I will describe.
I will show tips and...
https://www.youtube.com/watch?v=H-7ZNrpsV50
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Reverse Engineering Anti-Debugging Techniques (with Nathan Baggs!)
Check Nathans channel out here:
https://www.youtube.com/@nathanbaggs
His video on this game:
https://www.youtube.com/watch?v=PKlOCMjaGdc
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=0XwhmrIU3fY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Securing Access: Leveraging IGA, JIT & Policy Controls to Tackle OWASP Threats
Saai Krishnan Udayakumar and Dilip Mandadi discuss securing access - leveraging IGA, JIT and policy controls to tackle OWASP threats.
https://www.youtube.com/watch?v=Qj3Oq-5w1iA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Unlocking Secure Development: A Deep Dive into OWASP ASVS
Tejpal Garhwal discusses unlocking secure development with a deep dive into OWASP ASVS.
https://www.youtube.com/watch?v=6v5XHd6nFb4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Everyone Can Play! Building CTFs for Non-Security Folks
Joe Kuemerle discusses building CTFs for non-security folks.
https://www.youtube.com/watch?v=mwIW9ZZgW1E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Don't Make This Mistake: Painful Learnings of Applying AI in Security
Eitan Worcel discusses painful learnings of applying AI in security.
https://www.youtube.com/watch?v=i2Ogx9AuESM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
OWASP Top 10 for LLMs
A discussion on OWASP Top 10 for LLMs.
https://www.youtube.com/watch?v=de9UPN7yD5U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
API Fuzzing in the SSDLC Problems and Possible Solutions
Arseniy Sitnikov and Vitaliy Panasenko discuss API fuzzing in the SSDLC problems and possible solutions.
https://www.youtube.com/watch?v=d6_7hZxoIBs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Carrot vs The Stick: Making a Positive Impact on the Security + Developer Relationship
Mark Maney discusses making a positive impact on the security + developer relationship.
https://www.youtube.com/watch?v=dgWHSZ7Nl_I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
No Fate But What We Make: Doing Intrusion Prediction
Craig Chamberlain discusses doing intrusion prediction.
https://www.youtube.com/watch?v=TwMfBr7DRa0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Getting an LLM to Hack Itself: On AI, Moral Dilemmas, and Security
John Walker discusses getting an LLM to hack itself: on AI, moral dilemmas, and security.
https://www.youtube.com/watch?v=VvNWajI_tfo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
this malware hides in a WALLPAPER
https://jh.live/drata || Bring Governance, Risk and Compliance into the modern age with Drata: https://jh.live/drata
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=LwKOS10lblk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Why BINARY REWRITING is the FUTURE of Obfuscation
Learn how CodeDefender.io and Back.Engineering are pushing the boundaries of code obfuscation, virtualization and anti-tamper.
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - © 2025 Guided Hacking LLC. All Rights Reserved.
🔗 Back.Engineering + CodeDefender 🔗
https://codedefender.io/
https://back.engineering/
https://x.com/BackEngineerLab
🔗 GH Link: https://guidedhacking.com/threads/back-engineering-interview-codedefender-io-demo-gh-podcast-4.20946/
Listen to the Guided Hacking Show on these platforms:
- https://podcasters.spotify.com/pod/show/guidedhacking
- https://soundcloud.com/guidedhacking
- https://guidedhacking.com/forums/the-guided-hacking-podcast.569/
-...
https://www.youtube.com/shorts/i2hXz38xIvc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
hackers trick everyone to run malware (FileFix)
https://jh.live/alteredsecurity || Hacker Summer! Get 20% off Altered Security training with code HACKERSUMMER20OFF for Active Directory & Entra ID penetration testing courses and bootcamps! https://jh.live/alteredsecurity
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
Master Binary Files and Protocols with Gynvael Coldwind: https://jh.live/hackarcana (code MBF-JH-10 gives 10% off!)
https://www.youtube.com/watch?v=Vz2ak0YW_L4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Build AWS Cloud Infrastructure From Scratch in 60 Minutes | Free Hands-On Workshop
— Access the lab here with a free Infosec Skills account: https://app.infosecinstitute.com/portal/skills/content/asset/43595?utm_source=youtube&utm_medium=webinar&utm_campaign=aws+launch
— Watch part 2 here: https://www.youtube.com/watch?v=Lysx-l9LDrU
— Additional AWS training: https://www.infosecinstitute.com/skills/content-library/?Type=Boot+camp&_=1743748776579&Vendor=AWS&utm_source=youtube&utm_medium=webinar&utm_campaign=aws+launch
—Upcoming live workshops and events: https://www.infosecinstitute.com/events/?utm_source=youtube&utm_medium=webinar&utm_campaign=aws+launch
Join Keatron Evans, an AWS Certified Generative AI Expert and VP of Portfolio Product and AI Strategy at Infosec, for this comprehensive hands-on AWS workshop. In less than 60 minutes,...
https://www.youtube.com/watch?v=TPKQup_b0yk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How You Can Impersonate Anyone in Active Directory (with Shikata!)
https://jh.live/specops || Protect your organization with stronger passwords, and continuously scan and block over FOUR BILLION breached passwords with Specops Software! https://jh.live/specops
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
Master Binary Files and Protocols with Gynvael Coldwind: https://jh.live/hackarcana...
https://www.youtube.com/watch?v=JzlaszGBhjw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Top Skills Cybersecurity Professionals Need In 2025
Cybersecurity professionals must blend core technical skills with AI expertise to stay relevant as the field evolves. The following skills are essential for building a practical, effective defense in an AI-driven world.
📖 Read the full article: https://purplesec.us/learn/ai-replacing-cybersecurity-jobs/
Tom Vazdar is the Chief AI Officer at PurpleSec and brings more than two decades of cybersecurity expertise to this discussion. He is an expert in AI and leads the development of advanced cybersecurity strategies, enhancing data protection and compliance. As an AI strategist and mentor, Tom advocates for ethical AI integration.
About The Experts
------------------------------
Jason Firch, MBA
https://purplesec.us/about-us/leadership/jason-firch/
Tom Vazdar
https://purplesec.us/about-us/leadership/tom-vazdar/
AI...
https://www.youtube.com/watch?v=KbyAwGCXfCc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Learn Capture the Flag!
Just Hacking Training livestream with Matt Ehrnschwender at 10am PT/1pm ET on Thursday, June 19 https://justhacking.com
https://www.youtube.com/watch?v=MJC11U3WzoA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Is your organization part of the 25%? #securityawareness #cybersecurity
Some insights from a new Dark Reading report on human risk management: 43% of organizations have highly engaged leadership for human risk management, but 25% have leaders who are minimally engaged or just "aware" without active support. Here's the reality check — managing human risk isn't just a technical problem, it's a strategic business priority that requires cross-functional coordination between SecOps, business managers and training teams. Without executive buy-in, your security program will struggle to gain traction and mature. If your leadership falls into that 25%, consider this your wake-up call.
Get more insights from the Dark Reading report here: https://www.infosecinstitute.com/iq/human-risk-management-report/?utm_source=youtube&utm_medium=video&utm_campaign=iq%20hrm%20dark%20reading...
https://www.youtube.com/shorts/qaz2Bi-wK3o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Evading Antivirus Detection in C (with Dahvid Schloss)
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
Master Binary Files and Protocols with Gynvael Coldwind: https://jh.live/hackarcana (code MBF-JH-10 gives 10% off!)
https://www.youtube.com/watch?v=izf8ptPVh2g
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Live AWS workshop: Build and deploy your first cloud infrastructure | Free training promo
Save your spot here: https://www.infosecinstitute.com/webinar/aws-cloud-workshop/?utm_source=youtube&utm_medium=video&utm_campaign=aws%20launch
Ready to discover the power of cloud computing? Don't miss this hands-on training where you'll build real AWS infrastructure and deploy a live site — all in less than an hour.
This isn't a passive course. You will actively participate every step of the way and leave with some of the same practical skills students learn in our 3-day AWS boot camps. Already familiar with cloud basics? Come see how AWS makes complex tasks surprisingly simple!
Join Keatron Evans, 20-year cybersecurity veteran and VP of Portfolio Product and AI Strategy at Infosec, on June 26 at 11 a.m. Central for this one-of-a-kind training event. During the live workshop,...
https://www.youtube.com/watch?v=jhKm6rZAiMI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DLL Sideloading Your Aimbot into ANY Game
🔥 Learn how to load your DLL without injection, using DLL Sideloading!
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
Learn how to perform DLL sideloading to inject code without conventional methods. This technique involves hijacking the DLL search order, allowing you to load your own DLL files into a process. This is a form of evasion, commonly used in game hacking, malware & red teaming scenarios.
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
🔗 Article Link: https://guidedhacking.com/threads/dll-sideloading-your-aimbot-into-any-game.20978/
👨💻 New Content Creator: Ayla
👉https://guidedhacking.com/members/ayla.279946/
❤️...
https://www.youtube.com/watch?v=OcDc_gMALX0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
CodeDefender Gives You TOTAL FREEDOM to Obfuscate Your Code
Learn how CodeDefender.io and Back.Engineering are pushing the boundaries of code obfuscation, virtualization and anti-tamper.
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - © 2025 Guided Hacking LLC. All Rights Reserved.
🔗 Back.Engineering + CodeDefender 🔗
https://codedefender.io/
https://back.engineering/
https://x.com/BackEngineerLab
🔗 GH Link: https://guidedhacking.com/threads/back-engineering-interview-codedefender-io-demo-gh-podcast-4.20946/
Listen to the Guided Hacking Show on these platforms:
- https://podcasters.spotify.com/pod/show/guidedhacking
- https://soundcloud.com/guidedhacking
- https://guidedhacking.com/forums/the-guided-hacking-podcast.569/
-...
https://www.youtube.com/shorts/cpNvCW9-_Qw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Learning to Hack Active Directory Certificate Services (with Shikata!)
https://jh.live/specops || Protect your organization with stronger passwords, and continuously scan and block over FOUR BILLION breached passwords with Specops Software! https://jh.live/specops
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
Master Binary Files and Protocols with Gynvael Coldwind: https://jh.live/hackarcana...
https://www.youtube.com/watch?v=tYxJMr8jAgo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Will AI Replace Cybersecurity Jobs? #cybersecurity #AI #jobs #podcast
Will AI Replace Cybersecurity Jobs? w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/Nn4yU6fVnJ0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How Security Leaders Build AI-Augmented Defense in Depth
Webinar from HackerOne:
Learn how Zoom is adopting defense in depth for a world of constant code changes, rising AI-driven threats, and growing attack surfaces.
https://www.youtube.com/watch?v=8_GpJTqHHOQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AI Cybersecurity: Job Evolution, Not Job Loss! #cybersecurity #ai #jobs #podcast
AI Cybersecurity: Job Evolution, Not Job Loss! W/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/a4E3xmQhujs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Yes, AI Will Replace Cybersecurity Jobs (If You Let It)
Is AI coming for your cybersecurity job?
In this episode of Security Beyond the Checkbox, host Jason Firch sits down with PurpleSec's Chief AI Officer, Tom Vazdar, to unpack the role of AI in cybersecurity and what it means for your career.
From CrowdStrike's 2025 job cuts to a Reddit user's story of their team being replaced by AI, we dive into the headlines and separate fact from fear.
Spoiler: AI isn't replacing cybersecurity jobs—it's evolving them.
📖 Read the full article: https://purplesec.us/learn/ai-replacing-cybersecurity-jobs/
Tom shares actionable insights on how AI is reshaping roles, creating hybrid opportunities like AI Security Engineer and AI Governance Specialist, and why skills like ethics, communication, and AI fluency are now critical.
Learn how...
https://www.youtube.com/watch?v=reRHSeNkIm0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Extended Detection & Response (XDR) Explained #XDR #cybersecurity #podcast
Extended Detection & Response (XDR) Explained w/ Joshua Selvidge @PurpleSec
https://www.youtube.com/shorts/8Y7pmIZ1IYE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Managed vs Unmanaged XDR: Choosing The Right Fit #XDR #cybersecurity #podcast
Managed vs Unmanaged XDR: Choosing The Right Fit w/ Joshua Selvidge @PurpleSec
https://www.youtube.com/shorts/FTjie8o-2Rs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Learn Phishing!
Livestream with Cori Macy on Wednesday, June 11th at 10am Pacific Time for her upcoming course on Just Hacking Training https://justhacking.com
https://www.youtube.com/watch?v=ZB-2JXSQ5uE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Hunting Phishing Kits
https://jh.live/flare || Track data on the dark web, hunt adversaries across the cybercrime ecosystem, and manage threat intelligence for your exposed attack surface with Flare! Start a free trial and see what info is out there: https://jh.live/flare
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
Master Binary...
https://www.youtube.com/watch?v=sSuAKE7gjBM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
ANTICHEAT DEVELOPMENT COURSE - COMING SOON!
🚀 Guided Hacking's Anticheat Development Course - COMING SOON!
👨💻 Buy Our Courses: https://guidedhacking.com/forums/anti-cheat-development-course.570/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
👑 2025 is the year Guided Hacking reclaims our throne!
⌛️ Coming Soon...
🚀 Guided Hacking's Anticheat Development Course
We will be teaching you how to build an anticheat, 1 feature at a time, and then teaching you how to bypass it.
More info coming soon!
We have HUNDREDS of tutorials teaching you how to bypass anticheat already, but this will be uniquely different.
The GH Anticheat app will perform...
https://www.youtube.com/shorts/hPfFEB2jlDA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Windows Endpoint Telemetry (ft. Jonny Johnson)
Check out Jonny's work: https://github.com/jonny-jhnson/ETWInspector // https://github.com/jonny-jhnson/JonMon // https://x.com/JonnyJohnson_
He also just recently put out some AWESOME research for "Remote EDR" using this technique over DCOM: https://jonny-johnson.medium.com/no-agent-no-problem-discovering-remote-edr-8ca60596559f
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst...
https://www.youtube.com/watch?v=BNWAxJFL6uM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
New Course! Investigating macOS Endpoints
Check out Investigating macOS Endpoints, a comprehensive macOS forensics training course from 13Cubed! Starting with fundamental principles, Investigating macOS Endpoints advances to encompass log analysis, file systems, forensic artifacts, persistence mechanisms, evidence collection, and more! This course offers extensive hands-on practice and a capstone involving the analysis of a compromised system. Tailored for both beginners and seasoned professionals, it serves as an ideal resource for mastering macOS forensics!
🎉 Enroll today at https://training.13cubed.com!
#Forensics #DigitalForensics #DFIR #macOSForensics
https://www.youtube.com/watch?v=_D6oHm-371A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
EDR vs MDR vs XDR: Key Features Explained #xdr #mdr #edr #podcast
EDR vs MDR vs XDR: Key Features Explained w/ Joshua Selvidge @PurpleSec
https://www.youtube.com/shorts/GyDoU8uiooQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Puny-Code, 0-Click Account Takeover | @YShahinzadeh & @AmirMSafari | #NahamCon2025
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=4CCghc7eUgI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AI in Cybersecurity: Enhancing Security Team Efficiency #cybersecurity #aisecurity #podcast
AI in Cybersecurity: Enhancing Security Team Efficiency w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/6qKGUCux6QY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AI Cybersecurity: Autonomous Systems Protecting Us Now! #cybersecurity #aisecurity #podcast
AI Cybersecurity: Autonomous Systems Protecting Us Now! w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/xIBIcDCHgdg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AI Cyber Attacks: How Bad Guys Are Using AI #cybersecurity #aisecurity #podcast
AI Cyber Attacks: How Bad Guys Are Using AI w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/QHwCNav-34Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Why Data Poisoning Is The Most Insidious Threat To AI Security #cybersecurity #aisecurity #podcast
Why Data Poisoning Is The Most Insidious Threat To AI Security w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/fuGkIL5_D4E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
AI vs AI: The Biggest Threat To Cybersecurity #cybersecurity #aisecurity #ai #podcast
AI vs AI: The Biggest Threat To Cybersecurity w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/NLwXM0aYopc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Why Detecting AI Data Poisoning Is Insanely Difficult #cybersecurity #aisecurity #AI #podcast
Why Detecting AI Data Poisoning Is Insanely Difficult w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/yAyakcxHL9c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Recent AI Data Poisoning Attack Cost Banks 4.5 Million #aisecurity #cyberattacks #podcast
Recent AI Data Poisoning Attack Cost Banks 4.5 Million w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/u34Onb93FrA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Poisoned Models: The Hidden Dangers In AI Deployment #cybersecurity #aisecurity #AI #podcast
Poisoned Models: The Hidden Dangers In AI Deployment w/ Tom Vazdar @PurpleSec
https://www.youtube.com/shorts/VxTaCXmRXMM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
BYPASS Anti-Cheat with this one WIERD TRICK!
🔥 Learn How Anti-Cheats Detect CreateRemoteThread, NtCreateThreadEx etc...
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
🔗 Article Link: https://guidedhacking.com/threads/how-to-detect-createremotethread-ntcreatethreadex.20474/
🔗 GH Injector: https://guidedhacking.com/resources/guided-hacking-dll-injector.4/
✏️ Tags:
#gamehacking #anticheat #reverseengineering
https://www.youtube.com/shorts/fM0_O1ABRGg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Offensive Security Web Expert (OSWE) Review + Tips/Tricks [OffSec]
Offensive Security Web Expert (OSWE) review, tips/tricks etc. Hopefully this video will be useful for aspiring bug bounty hunters, security researchers, pentesters, CTF players etc who might be interested in taking the Advanced Web Attacks and Exploitation course from Offensive Security (OffSec) 🙂 #OSWE #BugBounty #EthicalHacking #PenTesting #AppSec #WebSec #InfoSec #OffSec
↢OffSec OSWE↣
Web-300 course: https://www.offsec.com/courses/web-300
Web-300 syllabus: https://manage.offsec.com/app/uploads/2023/01/WEB-300-Syllabus-Google-Docs.pdf
Web-300 FAQ: https://help.offsec.com/hc/en-us/articles/360046868971-WEB-300-Advanced-Web-Attacks-and-Exploitation-FAQ
OSWE exam guide: https://help.offsec.com/hc/en-us/articles/360046869951-WEB-300-Advanced-Web-Attacks-and-Exploitation-OSWE-Exam-Guide
OSWE...
https://www.youtube.com/watch?v=IK4t-i5lDEs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
#NahamCon2025 Day 1 Keynote: Hacking, Prompt Engineering, and the Future of Pentesting with AI
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=jT4RVAASPIs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Malware & Hackers Evade Antivirus with Windows Sandbox
https://jh.live/plextrac-530 || Save time and effort on pentest reports with PlexTrac's premiere reporting & collaborative platform: https://jh.live/plextrac-530 😎
https://blog-en.itochuci.co.jp/entry/2025/03/12/140000
http://blog.syscall.party/2020/12/02/weaponizing-windows-sandbox.html
https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_2_9_kamekawa_sasada_niwa_en.pdf
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get...
https://www.youtube.com/watch?v=O20WhmCspqo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTVcron: Introduction to Ghidra and Version Tracking
RTVcron is our monthly live stream where we bring workshops to you! Learn more about cron and RTV at https://redteamvillage.io
Mike will demonstrate basic Ghidra functionality such as importing programs, launching tools, and using the standard windows and plugins. Next he will explain the design and use of the Version Tracking tool, and how it can help your workflow understanding functionality while analyzing upgrades to software.
Finally, time permitting, he will show beginning usage of the BSim capability and how this can be a game changer for discovering lineage of software en masse.
Participants are encouraged to ask questions about the application, as Mike will be demonstrating everything live without a net.
https://www.youtube.com/watch?v=6ou3Qcwuao8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Vibe Coding in Cursor for Cyber Security
In the past few weeks I've dove headfirst into vibe coding with Cursor, so I wanted to share what I've been working on and some tips and tricks. In this video we'll cover all things vibe coding for hackers: What is it? How is it making waves on Twitter and within the startup and AI influencer communities? More importantly, what does it mean for us bug bounty hunters and hackers? I'll share tips on using AI for coding, how to get started with tools like Cursor, Gemini, and Docker, and even give you a peek at a vibe-coded pet adoption website I worked on. Whether you're a coding newbie or looking to simplify your process, this video has something for you. Enjoy!
Links:
Awesome .cursorrules: https://github.com/PatrickJS/awesome-cursorrules
Spec-drive Vibe Coding (how to write design docs for...
https://www.youtube.com/watch?v=wnVpmSrhNRo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
hackers weaponize... really long filenames??
https://jh.live/antisyphon || Check out Antisyphon Training and course material, including their Pay Forward What You Can offering! https://jh.live/antisyphon
https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
https://www.morphisec.com/blog/new-noodlophile-stealer-fake-ai-video-generation-platforms/
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
🏆Attend ContinuumCon, the practical online cybersecurity conference that never ends! Livestream begins June 20th, 2025: https://jh.live/continuumcon
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training...
https://www.youtube.com/watch?v=aj3uBl9hFxY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Sneaky Malware Uses Cloudflare to Steal Your Password
Thank you ThreatLocker for sponsoring this video. Check out ThreatLocker 👉🏼 https://www.threatlocker.com/nahamsec
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in...
https://www.youtube.com/watch?v=JKK24EEpSDo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Why Nemi Left RIOT GAMES and founded BYFRON Anticheat
New opportunity!
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
Full interview: https://www.youtube.com/watch?v=6xET66eitYY
✏️ Tags:
#anticheat #roblox #byfron
GuidedHacking.com
nemi interview
byfron nemi
nemi byfron
kernel anticheat
byfron Hyperion
anticheat interview
roblox byfron
nemi interview
how to bypass byfron
guidedhacking
anticheat dev
roblox byfron bypass
byfron anti cheat
anti-cheat dev
nemi hyperion
byfron anticheat
byfron roblox
byfron bypass
riot games
https://www.youtube.com/shorts/kraTEATB7bk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
A New(ish) Way to Detect Process Hollowing
In this episode, we'll briefly explore how process hollowing works. Then, we'll examine the relatively new windows.hollowprocesses plugin for Volatility 3—a more recent alternative to the popular HollowFind plugin from Volatility 2. As you'll see, this new plugin isn't a one-for-one replacement for HollowFind, but it can still be useful.
⚠️ Deprecation Notice
The windows.hollowprocesses plugin is being renamed to windows.malware.hollowprocesses in an upcoming Volatility 3 release. The plugin's behavior and output remain unchanged.
❤️ Special thanks to Mike Peterson of https://nullsec.us for research and testing.
Download the memory samples here:
https://cdn.13cubed.com/downloads/hollow.zip
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed....
https://www.youtube.com/watch?v=x5mGPAG41I4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Secrets Behind Roblox Anti-Cheat
What components does a good anticheat have?
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
✏️ Tags:
#anticheat #roblox #byfron
GuidedHacking.com
nemi interview
byfron nemi
nemi byfron
kernel anticheat
byfron Hyperion
anticheat interview
roblox byfron
nemi interview
how to bypass byfron
guidedhacking
anticheat dev
roblox byfron bypass
byfron anti cheat
anti-cheat dev
nemi hyperion
byfron anticheat
byfron roblox
byfron bypass
https://www.youtube.com/shorts/YMowHnPLNhk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
BACK.ENGINEERING's Bin2Bin TECHNOLOGY Will Change Everything!
Learn how CodeDefender.io and Back.Engineering are pushing the boundaries of code obfuscation, virtualization and anti-tamper.
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - © 2025 Guided Hacking LLC. All Rights Reserved.
🔗 Back.Engineering + CodeDefender 🔗
https://codedefender.io/
https://back.engineering/
https://x.com/BackEngineerLab
🔗 GH Link: https://guidedhacking.com/threads/back-engineering-interview-codedefender-io-demo-gh-podcast-4.20946/
Listen to the Guided Hacking Show on these platforms:
- https://podcasters.spotify.com/pod/show/guidedhacking
- https://soundcloud.com/guidedhacking
- https://guidedhacking.com/forums/the-guided-hacking-podcast.569/
-...
https://www.youtube.com/watch?v=3LOGxOHfUHg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
WorstFit: Unveiling Hidden Transformers in Windows ANSI!
*It was the best of fit, it was the worst of fit, it was the age of wisdom, it was the age of foolishness.*
As we know, certain codepages have limitations and cannot support all Unicode Codepoints. So, why not just convert unsupported characters to the closest one? This is the essence of the "Best Fit" feature in Windows — a seemingly clever long-existing solution to character conversion issues.
However, it is a double-edged sword.
This system-wide behavior, often neglected by developers, has remained lurked in the deep-seated design flaws in Windows C/C++ Runtime and APIs for decades. It constitutes a critical risk to the Windows ecosystem, giving rise to numerous vulnerabilities across various applications.
This presentation unveils a novel attack vector that exploits the "Best Fit"...
https://www.youtube.com/watch?v=sKH8283CFzs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
WiFi Calling: Revealing Downgrade Attacks and Not-so-private private Keys
VoWiFi (aka Wi-Fi Calling) is a convenient way for the customer to get better cell coverage while also externalizing the costs for the last mile to the customer without losing call revenue. On a technical level, this is standardized by using IPsec tunnels directly into the mobile network operator's core network.
We found that for years, at least 140 million cellular customers worldwide were only using one of ten IPsec keys. Furthermore, a major phone chipset manufacturer allowed downgrades to key lengths well below the 3GPP specification: 768 bits, which is widely considered inadequate for a resourceful attacker.
By:
Adrian Dabrowski | PhD, University of Applied Sciences FH Campus Wien
Gabriel Gegenhuber | Dipl-Ing., University of Vienna, Austria
Florian Holzbauer | University of Vienna
Philipp...
https://www.youtube.com/watch?v=iBlPlXRxHF0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The CVSS Deception: How We've Been Misled on Vulnerability Severity
Since 2014, 170K+ CVEs have been published with a ~4.5x growth in yearly disclosures, and an average disclosure rate of ~80/day in 2023. The sheer volume makes it untenable for organizations to address all vulnerabilities. It is common to rely heavily on CVSS score/rating for prioritization without giving it a second thought. Being generic, CVSS has implicit tradeoffs that plague its use, and more importantly can lead to a false sense of security. We present six such empirically validated operational challenges to be on the look-out for:
C1 - Underrated severity due to CIA (Confidentiality, Integrity, Availability) aggregation. We show ~10% CVEs are potentially underrated posing significant risk. CVE-2020-8187 a 7.5 (under)rated vulnerability disclosed amid COVID crisis had the potential...
https://www.youtube.com/watch?v=qQuaBB5tg8U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Bugs in Your Bootloaders: Embedded Device Secure Boot Fails and How to Fix Them
Many embedded devices use complex boot sequences to initiate their operating systems.
These boot chains often implement security features that enforce the authenticity and integrity of each boot stage, forming a chain of trust. Often, a single vulnerability is enough to break and circumvent these chains of trust. We think that this, combined with a lack of basic hardware security features, is an industry-wide problem.
In this presentation, we show how to easily break secure boot implementations by exploiting bootloader vulnerabilities using physical access or remote, root-equivalent access. One of our examples is a fully-patched network device that runs a fork of grub 0.97 (yes, the legacy one). We also show how it was possible to fully compromise the Dell iDRAC9 secure boot chain using a...
https://www.youtube.com/watch?v=eZczwNFzxus
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Browser Hack Scored Me a ,000 Bug Bounty
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=4MpjB68posg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
mfw the game ships with...
All Your .PDB Are Belong To Us
👨💻 Buy Our Courses: https://guidedhacking.com/register/
💰 Donate on Patreon: https://patreon.com/guidedhacking
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved.
✏️ Tags:
#reverseengineering #guidedhacking #gamehacking
game hacking tutorials
game hacking bible
game hacking course
game hacking courses
guidedhacking
guided hacking
game hacking
guidedhacking.com
guidedhacking rake
guided hacking rake
game hacking rake
game hackers
game hacking tutorials
game hacking bible
https://www.youtube.com/shorts/eCOBdVjptjw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Double (AI) Agent: Flipping a GenAI Agent Behavior
The Double (AI) Agent: Flipping a GenAI Agent Behavior from Serving an Application to Attacking it using Promptwares
Function calling (a.k.a. Plan & Execute), is a groundbreaking application of generative AI (GenAI). By dynamically planning a solution for a given user input, it offers a powerful alternative to traditional, pre-coded approaches. GenAI engines are used to craft a tailored plan (based on the available functions within an application) which independent agents subsequently execute. Despite its rapid adoption in the industry and integration into countless applications (e.g., chatbots, assistants), the risks associated with function calling (agents-based GenAI applications) remain largely unexplored.
This talk discusses PromptWare, a new emerging risk to agents-based GenAI applications....
https://www.youtube.com/watch?v=2xGcqDmkkf8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Unmasking State-Sponsored Mobile Surveillance Malware from Russia, China, and North Korea
Unmasking State-Sponsored Mobile Surveillance Malware from Russia, China, and North Korea – Threat Actors, Tactics, and Defense Strategies
State-sponsored threat actors have expanded their arsenal of surveillance tooling, leaning into mobile malware as a way to acquire information about a target or target group that had otherwise been inaccessible through traditional desktop campaigns. With more than 86% of the
worldwide population using a smartphone, attackers have access to the perfect espionage device in the pockets of nearly every potential target. However, APTs from various regions tend to conduct operations in significantly different ways. In this session, we'll explore the landscape
of state-sponsored surveillance activity using case studies from Russian, Chinese and North Korean...
https://www.youtube.com/watch?v=AkNzyvGbB50
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
UNC1860 and The Temple of Oats - Iran's hidden hand in Middle Eastern Networks
This session is a master class in piecing together seemingly unrelated tools and incidents into a single cohesive story about an uprising threat group, UNC1860. For years, UNC1860, a state sponsored Iranian threat actor, operated covertly, leaving behind a trail of tools and incidents that multiple security vendors could not attribute to a single entity. Through meticulous investigation, we were able to correlate the clues about this actor and expose not only its full arsenal but also its intent and tactics.
While remaining largely obscured despite its persistent targeting of governments, telecommunications and critical infrastructure entities across the Middle East since at least 2018, this group has in fact played the role of an advanced access broker employed by the Iranian government...
https://www.youtube.com/watch?v=ijHL3V08Z2I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
When (Remote) Shells Fall Into The Same Hole: Rooting DrayTek Routers Before Attackers Can
When (Remote) Shells Fall Into The Same Hole: Rooting DrayTek Routers Before Attackers Can Do It Again
Routers, VoIP gateways, firewalls, WiFi access points and VPN concentrators are ubiquitous in homes, small offices and large business networks. Some vendors manufacture ALL of these devices, which often means they share the same core software components - and thus the same vulnerabilities.
In this talk we will analyze a large vendor of such network equipment - DrayTek. Their devices have been targeted by Chinese threat actors on several occasions since 2018. Within the past four years alone, other researchers have disclosed over 19 critical issues in their products.
To our big surprise, we were able to achieve Remote Code Execution against the latest model of a VPN concentrator manufactured...
https://www.youtube.com/watch?v=tgfaEtQd8s4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Vulnerabilities in the eSIM download protocol
Downloadable eSIM is replacing physical SIM cards in mobile phones. The GSM Association (GSMA) defines the consumer Remote SIM Provisioning (RSP) protocol that enables consumers to download SIM profiles to a secure element in their mobile devices. These profiles contain the credentials for authenticating the device and subscriber to the mobile network. The security of the downloaded profile is critically important for protecting mobile communication and billing, and various other applications depend on these credentials for user authentication. We modeled the protocol with formal methods and performed an in-depth analysis of its security properties. This talk presents the results of the analysis in an understandable form for security practitioners.
We will explain the RSP protocol architecture...
https://www.youtube.com/watch?v=v0muR5UGFB8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Black Hat Europe Network Operations Center (NOC) Report
Back with another year of soul-crushing statistics, the Black Hat NOC team will be sharing all of the data that keeps us equally puzzled, and entertained, year after year. We'll let you know all the tools and techniques we're using to set up, stabilize, and secure the network, and what changes we've made over the past year to try and keep doing things better. Of course, we'll be sharing some of the more humorous network activity and what it helps us learn about the way security professionals conduct themselves on an open WiFi network.
By:
Neil Wyler | Vice President of Defensive Services, Coalfire
Bart Stump | Managing Principal, Coalfire
Full Abstract Available:
https://www.blackhat.com/eu-24/briefings/schedule/#the-black-hat-europe-network-operations-center-noc-report-43579
https://www.youtube.com/watch?v=X-9jPKwwL8w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Security analysis of Residential Gateways and ISPs: global network domination is (sneakily) possible
Residential Gateways (modems) have become a very common device around the world, usually provided by the ISP along with a broadband subscription. As consumer routers have frequently been compromised by botnets or exploited as infrastructure for nation-state attackers, RGs have seen little discussions yet on a position on par with consumer routers.
We reviewed popular broadband network standards (DSL, DOCSIS, xPON), remote management standards (TR-069/CWMP), and reverse engineered 14 different RGs from 11 ISPs, across 8 different countries, including from G7. We analyzed all RG's hardware components, dissected and inspected all firmware, using a set of firmware dissectors and decryptors that we developed to deal with the proprietary formats. We discovered most RGs are lacking in modern software...
https://www.youtube.com/watch?v=7qBIba8ah6o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Redefining the Origin of Secrecy in a Post-Quantum World
The post-quantum era demands innovative approaches to key generation that can withstand the capabilities of quantum adversaries, making secure and scalable symmetric key creation more essential than ever. Key agreement and distribution methods, old and new, achieve secrecy by constructing relative distinguishability and indistinguishability through high complexity mathematical constructions or quantum phenomena. This talk explores and compares a range of these approaches against a quantum threat model —from mathematical problem-based techniques to quantum-based solutions—and introduces an alternative strategy: leveraging the properties of finite randomness. This unique, quantum-safe method reimagines the origin of secrecy by utilizing a straightforward resource as a foundation for mutual...
https://www.youtube.com/watch?v=dxJfjcQPZo8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Reasonable Regs vs Red Tape: How Should Governments Tackle the Cyber Intrusion Market
Following recent public revelations about the thriving market in advanced spyware, many governments have wrestled with the question of how to respond to its global spread, and the software supply chain that sits around it. Cyber intrusion companies offer state-level capabilities available to anyone with the means to pay – transforming the cyber threat to us all and posing serious concerns for human rights, national security and the stability of cyberspace. There are clear and legitimate uses for many of these tools. However, the UK and other governments are concerned that, too often, capabilities can be developed, sold and used without the necessary oversight or safeguards in place. How can governments collaborate with industry partners to make the commercial cyber intrusion sector work...
https://www.youtube.com/watch?v=UmR1xzhWnrg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Tiny Chrome Behavior Leads to an Account Takeover
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=Pi37YwraPBg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How I Got an AI Chatbot to Spill Its Secrets Using Just a Prompt
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=5Wu0eSjOv0o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Tsuku CTF Web Challenge Walkthroughs (2025)
🚩 Video walkthrough for the 3 web challenges featured in the 2025 Tsuku CTF competition. Challenges include JSON injection, sensitive file disclosure and flawed PRNG implementation, YAML injection with WAF 😎 #CTF #Challenge #Tsuku
Check out the accompanying writeups here: https://book.cryptocat.me/ctf-writeups/2025/tsuku/web
Join my discord server if you have any questions: https://discord.cryptocat.me
🐛CIT@CTF🐞
https://tsukuctf.org
https://discord.gg/xNgh3a6Ynp
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00 Intro
0:08 len_len
2:47 flash
8:28 YAMLwaf
12:23 Conclusion
https://www.youtube.com/watch?v=qGd4d0zmhy8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
CTF@CIT Web Challenge Walkthroughs (2025)
🚩 Video walkthrough for the 5 web challenges featured in the 2025 CIT@CTF competition. Challenges include SQL injection (SQLi), git repo version history (git-dumper), local file read (with basic filter), flask session cookie tampering + server-side template injection (SSTI) and credential reuse / HTTP method tampering 😎 #CTF #Challenge #CIT
Check out the accompanying writeups here: https://book.cryptocat.me/ctf-writeups/2025/ctf-cit/web
Join my discord server if you have any questions: https://discord.cryptocat.me
🐛CIT@CTF🐞
https://ctf.cyber-cit.club
https://discord.gg/GzUAsFvhbk
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00 Intro
0:06 Breaking authentication (SQLi)
2:20 Commit & Order: Version Control Unit (git dumping / history)
4:25 How I Parsed...
https://www.youtube.com/watch?v=ZBdApaw0r0M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTVcron | Systematic Malware: A Rule-Based Approach to Creating Payloads
RTVcron is our monthly live stream where we bring workshops to you! Learn more about cron and RTV at https://redteamvillage.io
This month we're joined by Kevin Clark and Skyler Knecht for "Systematic Malware: A Rule-Based Approach to Creating Payloads"
Creating evasive payloads in the modern EDR landscape is less about knowing what to do, and more about learning what not to do. Although EDR has moved away from relying on static binary signatures, rule-based detections are still in play. Every step of payload execution is an opportunity to be detected. In this workshop, we showcase step-by-step instructions on how to craft evasive payloads.
Kevin Clark
Security Consultant at TrustedSec
Kevin Clark is a Software Developer turned Penetration Tester at TrustedSec. He focuses on initial access...
https://www.youtube.com/watch?v=-xStGweK9KI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This Is How Hackers Evade Detection with PowerShell Obfuscation
Thank you Threatlocker for sponsoring this video 👉🏼 https://www.threatlocker.com/nahamsec
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023...
https://www.youtube.com/watch?v=t4rpsFt6n08
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The No BS Bug Bounty & Web Hacking Roadmap
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me http://hhub.io/roadmap
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
Linuxjourney.com
Overthewire.org/wargames/bandit/
YouTube.com/Newtorkchuck
Portswigger.net/web-security
HackingHub.io
HackTheBox.eu
HackerOne.com/hacktivity
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started...
https://www.youtube.com/watch?v=AMQq06WUMVk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Reverse Engineering Access Tokens Part 2
This tutorial covers Windows Access Tokens, the Logon Session, Token Elevation, AdjustTokenPrivileges and the Windows Access Control Model.
This is part of our IDA Pro reverse engineering series. The full series can be found on our patron...
https://www.patreon.com/collection/1259251
-----
References
Token Viewer (Tool)
https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools
LogonSessions (Tool)
https://learn.microsoft.com/en-us/sysinternals/downloads/logonsessions
Elastic - Introduction to Windows tokens for security practitioners
https://www.elastic.co/blog/introduction-to-windows-tokens-for-security-practitioners
UAC Overview (old but good)
https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-1.html
Access Control Model (Microsoft)
https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-components
LSA...
https://www.youtube.com/watch?v=Y58eBWyJxDA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
PowerShell for Hackers
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU
2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU
Bug Bounty Hunting...
https://www.youtube.com/watch?v=s2kquCwKNs8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
I designed and built eink labels for my filament with an ESP32, here's how it works #3dprinting
https://www.youtube.com/shorts/KIgaZb_IjHU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
This CTF Teaches You Everything About Hacking an API
Big thank you to APISEC for sponsoring this video! Please make sure to check out all of their free resources down below ⬇️
🔗 APISEC University's free API Courses 👉🏼 https://apisecuniversity.com/
RSVP for APISec's FREE API Security conference 👉🏼 https://apisecuniversity.com/
📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io
💵 FREE 0 DigitalOcean Credit:
https://m.do.co/c/3236319b9d0b
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr
Black Hat GraphQL: Attacking...
https://www.youtube.com/watch?v=6Tyqvl-GSNQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Getting Started with Fuji - The Logical Choice for Mac Imaging
In this episode, we'll look at Fuji—a free, open-source tool for performing live, logical forensic acquisitions of Mac computers (Intel or Apple Silicon). You'll see how Fuji leverages built-in macOS tools to generate a DMG and sparseimage, ready for analysis in your forensic tool of choice.
This video is an excerpt from the 13Cubed training course "Investigating macOS Endpoints." Visit https://training.13cubed.com to learn more!
🛠 Resources
Fuji:
https://github.com/Lazza/Fuji
https://www.youtube.com/watch?v=9bEiizjySHA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How FIN6 Exfiltrates Files Over FTP
Access the FIN6 Exfiltration Lab: https://bit.ly/3XsXFRZ
In this final episode of our FIN6 Adversary Emulation mini-series, we demonstrate how to emulate FIN6's exfiltration techniques, focusing on how this financially motivated threat actor collects, stages, archives, and exfiltrates sensitive data from compromised systems.
// CYBER RANGES Adversary Emulation Labs
► New to CYBER RANGES? Register for a free account here: https://bit.ly/42VxDu5
► Access the FIN6 Exfiltration Lab: https://bit.ly/3XsXFRZ
► Adversary Emulation Fundamentals Labs (Free): https://bit.ly/4gQd8SB
🔗 Video Resources & References
CTID Adversary Emulation Library: https://github.com/center-for-threat-informed-defense/adversary_emulation_library
🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6
//...
https://www.youtube.com/watch?v=SbZ7JUII-SQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
From Zero to Zero Day (and beyond) - Life of a Hacker: Jonathan Jacobi
I met Jonathan in 2018 at the CCC when he was just 18 years old. Back then he referenced my videos which had a little bit of impact on his life. Now a lot of time has passed and in this interview I want to get to know Jonathan better. How did he get into hacking, founding of the CTF team perfect blue, working as a vulnerability researcher and ultimately transitioning into a new career.
From Zero to Zero Day (2018): https://www.youtube.com/watch?v=xp1YDOtWohw
Jonathan on Twitter: https://x.com/j0nathanj
00:00:00 - How we met
00:02:16 - Jonathan's early life
00:04:24 - Going to college as a teenager
00:18:52 - Meeting like-minded people in CTF
00:27:29 - Getting first VR internship at Checkpoint
00:32:34 - Creating opportunities through networking
00:43:40 - Working at Microsoft Security Response...
https://www.youtube.com/watch?v=BOLN_B0qnZk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Is Your AI Deployment Risky? How to Address AI Safety, Security, and Reliability Risks
Most organizations are committed to adopting generative AI in some form to drive innovation and efficiency. Yet, many leaders responsible for AI risk still grapple with how to minimize the chances their organization's AI deployment turns into a very public AI embarrassment that could compromise trust and reputation.
In this webinar, hear from HackerOne co-founder Michiel Prins and Haize Labs co-founder Leonard Tang about actionable strategies that can help you proactively manage AI risk and turn your deployment into a competitive advantage rather than a liability. Michiel and Leonard will share insights on establishing clear ownership within your organization and provide practical guidance on identifying and addressing AI safety risks relevant to your industry and use cases.
You will...
https://www.youtube.com/watch?v=Z6GU6tGqs1o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Automated AI Reverse Engineering with MCP for IDA and Ghidra (Live VIBE RE)
Testing MCP plugins for IDA and Ghidra live with @mrexodia
IDA MCP
https://github.com/mrexodia/ida-pro-mcp
Ghidra MCP (thanks @lauriewired )
https://github.com/LaurieWired/GhidraMCP
Malware sample
7b5b060d9013725413f3f77719d0881035246b281e18005c0040e78a32e1c6cc
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=iFxNuk3kxhk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTVcron - Influcence_Ops: Tactical Pretexting
Welcome to RTVcron, our monthly live stream, held on the last Thursday of every month. Each two-hour session features a unique workshop led by a different expert, offering hands-on experience in offensive security tactics and strategies.
Follow us: https://redteamvillage.io
This month our workshop is provided by Jeff Tomkiewicz!
Jeff Tomkiewicz is a Offensive Security Engineer for a Healthcare Fortune 40 organization, where he specializes in network penetration testing, social engineering, and physical penetration testing. With a rich background as a 21-year Air Force veteran, Jeff has served in various capacities, including K9 handler and trainer, Intelligence, and Special Operations. Residing in Colorado Springs, CO, where interests span upon horror films, performing in improv shows,...
https://www.youtube.com/watch?v=vlow4qZSOSE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Reverse Engineering Access Tokens Part 1
This tutorial walks through the process of reverse engineering malware which uses AdjustTokenPrivileges to enable SeDebugPrivilege. No steps are skipped in the process!
This is Module 2.2 of our IDA Pro reverse engineering series. The full series can be found on our patron...
https://www.patreon.com/collection/1259251
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=iT2U3UXhic4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 0. Introduction
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=1AAZDkSZePs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 11 - Additional Resources and Personal Message
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=zVgV__cRhvo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 10 - Finding Hidden Wireless Networks with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=0EB5U8dcAVc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 9 - Spoofing your MAC Address with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=OtvSfjX6kGY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 8 - Cracking Hashes with Python and Hashlib
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=EA4JFh8hj9E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 7 - Discovering Subdomains with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=X9oyU7kUob8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 6 - Attacking Web Forms with requests and BeautifulSoup in Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=sYg3dyetcYA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 5 - The Scapy Module for Network Traffic Sniffing and Manipulation
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=M_5YKbsk4eY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 4 - The Socket Module for Network Communication - A TCP Server Client
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=bHDITf8TMmY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 3 - Grabbing Screenshots with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=_O5msdxSwII
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 2 - Building a Basic Port Scanner using NMAP in Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=nlDjpswJmbc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Python for Pentesters II - 1 - Gathering Information - Grabbing Banners, Hostname and IP Lookup
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1
Connect with me:
X: https://twitter.com/cristivlad25
IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=S9gYhZT2TFo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Turn Your Cybersecurity to Cyberstrength with HackerOne
This new era of cybersecurity combines AI and Human Intelligence for faster, smarter, and more adaptive protection.
Ready to move beyond traditional security and into cyberstrength? Visit https://bit.ly/4kMXE5a to learn more.
https://www.youtube.com/watch?v=f7M8WO6Nz8o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
18 - API Security (low/med/high) - Damn Vulnerable Web Application (DVWA)
18 - API Testing (low/med/high difficulties) video from the Damn Vulnerable Web Application (DVWA) walkthrough/tutorial series. DVWA is an intentionally vulnerable application for you to learn about ethical hacking. I made this series for students on the MSc in cybersecurity course at Queen's University Belfast but hopefully it can help others too! Hope you enjoy 🙂
↢Damn Vulnerable Web Application (DVWA)↣
https://github.com/digininja/DVWA
👷♂️Resources🛠
https://cryptocat.me/resources
↢Chapters↣
Start - 0:00
Low - 0:38
Med - 3:59
High - 7:07
Impossible - 13:19
End - 13:35
https://www.youtube.com/watch?v=c_6RaCekH40
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Quantifying the Financial Impact of Cybersecurity with Return on Mitigation (RoM)
Join HackerOne for an insightful session introducing return on mitigation (RoM)—a novel framework that redefines cybersecurity's role in protecting profits and reducing risk. With RoM, you'll learn to quantify the financial impact of mitigated breaches and position cybersecurity as a strategic business enabler.
In this session, you'll discover how to:
-Use the RoM calculator, built on widely accepted industry benchmarks like IBM's Cost of a Data Breach Report
-Automate RoM calculations and generate real-time summaries tailored to your organization's business and risk profile—by using Hai Play, part of the -HackerOne Platform's AI copilot
-Make data-driven business cases to your board and executive team, showing why offensive security programs as essential to operational continuity,...
https://www.youtube.com/watch?v=CbiiKnQXGyY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The German Hacking Championship
An amazing event for aspiring German hackers is happening right now. I went to the finals in 2024, share a few impressions and tell you about this year's event.
Learn hacking: https://www.hextree.io/ (ad)
CSCG 2025 runs from 1. March 2025 until 1. May 2025
Rules: https://play.cscg.live/rules
Die Hacking Meisterschaft: https://hacking-meisterschaft.de/
NFITS: https://nfits.de/spenden/
European Cybersecurity Challenge: https://ecsc.eu/
00:00 - Intro DHM 2024
00:52 - CTF Teams vs. CSCG Teams
01:48 - Sponsor Challenges
03:04 - My CSCG History
04:18 - NFITS
05:06 - Die Deutsche Hacking Meisterschaft (DHM)
07:00 - Take the Opportunity!
07:47 - Outro
=[ ❤️ Support ]=
→ My courses: https://www.hextree.io/
→ My font: https://shop.liveoverflow.com/
→ per Video: https://www.patreon.com/join/liveoverflow
→...
https://www.youtube.com/watch?v=f0C3RH7baEw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
17 - Cryptography (low/med/high) - Damn Vulnerable Web Application (DVWA)
17 - Cryptography (low/med/high difficulties) video from the Damn Vulnerable Web Application (DVWA) walkthrough/tutorial series. DVWA is an intentionally vulnerable application for you to learn about ethical hacking. I made this series for students on the MSc in cybersecurity course at Queen's University Belfast but hopefully it can help others too! Hope you enjoy 🙂
↢Damn Vulnerable Web Application (DVWA)↣
https://github.com/digininja/DVWA
↢Cryptography↣
https://cryptohack.org
@pastiesbin2254 : https://www.youtube.com/watch?v=8Tr2aj6JETg
https://www.nccgroup.com/uk/research-blog/cryptopals-exploiting-cbc-padding-oracles
@nccgroup : https://www.youtube.com/watch?v=6yHM19rQjDo
👷♂️Resources🛠
https://cryptocat.me/resources
↢Chapters↣
Start - 0:00
Low - 0:14
Med...
https://www.youtube.com/watch?v=7WySPRERN0Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The latest insights on global VDP adoption & IoT security trends
The 2024 report on global Vulnerability Disclosure Policy (VDP) adoption reveals significant strides in IoT security—yet critical gaps remain.
Join our exclusive webinar as industry experts break down the key findings, including:
- 11.6% growth in VDP adoption—who's leading and who's lagging
- The impact of the UK's PSTI Act on IoT security standards
- Upcoming regulations in the EU and U.S. and what they mean for businesses
- Enterprise vs. consumer IoT security—where vulnerabilities persist
Don't miss this opportunity to gain actionable insights and stay ahead of evolving security regulations.
For more information visit: https://www.hackerone.com/
https://www.youtube.com/watch?v=CowQQK195Ao
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTV Overflow: "Breaching Bare Metal Kubernetes Clusters" with Graham Helton
Graham Helton - Arbiter of (in scope) chaos - "Attackers thrive in complex environments because they're motivated to dive deep into ambiguous technical details. In this workshop I will guide you through those ambiguous technical details by walking through multiple attack scenarios that can be used to fully compromise a bare metal Kubernetes cluster.
After each attack, we'll discuss controls that could stop or mitigate each attack, what tools you should carry in your toolbox when performing a Kubernetes assessment, and the security implications (and misconceptions) of Kubernetes. By the end of this workshop, you will be paranoid by the power you possess next time you land a shell in a Kubernetes pod."
Web: https://grahamhelton.com/
Twitter/X: @GrahamHelton3
linkedin.com/in/grahamhelton/
...
https://www.youtube.com/watch?v=iR064xsllqk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTV Overflow "An Operators Guide: Hunting SCCM in the Real World" w/ Zachary Stein & Garrett Foster
Zachary Stein (Security Consultant at SpecterOps) and Garrett Foster (Senior Security Consultant at SpecterOps) - "SCCM abuse has become a popular technique in the offensive security community but can be intimidating to test in production environments due to its complexity. This workshop aims to provide operators not only a safe environment to practice tradecraft but also provide them with the confidence to properly find and assess SCCM during their engagements."
Twitter/X: @unsigned_sh0rt
Twitter/X: @synzack21
https://www.linkedin.com/in/garrett-foster86/
https://www.linkedin.com/in/zacharydstein/
________________________________________________________________
The Red Team Village
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter:...
https://www.youtube.com/watch?v=TmfWYDqEEUo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTV Overflow: "Physical Red Teaming for Offensive Cyber Teams" with Ana Aslanishvili & Shawn Abelson
Ana Aslanishvili (Red Teaming Aficionado) and Shawn Abelson (Ex-Head of Physical Red Team @ Meta, Current Consultant/Trainer for PhySec Red Teaming) - "Offensive security is an unfamiliar concept to most physical security practitioners. Yet we still rely on physical security teams to protect our hardware, network, ports, and assets. Physical security professionals are often non-technical, former law enforcement/military, and are focused on protecting people instead of property. This talk will bridge the gap between physical and cyber red teaming, covering the best approaches, common pitfalls, dangers, and benefits of testing physical security programs as part of a red team assessment. From the difficulty of “patching” physical vulnerabilities to examples of red teams gone wrong and how...
https://www.youtube.com/watch?v=FZS32kb5IXk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Do you know this common Go vulnerability?
When auditing code it's crucial to know about common issues. In this video we explore a Go issue that I was not aware of.
Learn hacking on https://www.hextree.io/ (ad)
38c3 CTF - Fajny Jagazyn Wartości Kluczy:
https://2024.ctf.link/internal/challenge/fb03748d-7e94-4ca2-8998-a5e0ffcbd761/
Unintended solution: https://msanft.foo/blog/hxp-38c3-web-fajny-jagazyn/
Challenge author writeup: https://hxp.io/blog/114/hxp-38C3-CTF-Fajny-Jagazyn-Wartoci-Kluczy/
VSCode Go debugger client code: https://github.com/golang/vscode-go/blob/39786ea90f18ab98f75d091b9a04367d1b1df82c/extension/src/debugAdapter/goDebug.ts#L1557
00:00 - Intro
00:20 - Go gjson vs json behavior
01:33 - Overview CTF challenge "Fajny Jagazyn Wartości Kluczy"
04:33 - Weird server setup?
05:55 - Arbitrary file read
07:00 - /proc...
https://www.youtube.com/watch?v=wVknDjTgQoo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RADAR Contact! An Obscure Evidence of Execution Artifact
In this episode, we'll take a look at a rather obscure evidence of execution artifact associated with RADAR, the Resource Exhaustion Detection and Resolution system.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
01:16 - What You Need to Know
🛠 Resources
The Mystery of the HeapLeakDetection Registry Key:
https://harelsegev.github.io/posts/the-mystery-of-the-heapleakdetection-registry-key/
HeapLeakDetection Registry Forensics:
https://github.com/MHaggis/HeapLeakDetection
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics
https://www.youtube.com/watch?v=edJa_SLVqOo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Emulating FIN6 - Active Directory Enumeration Made EASY
In this episode of the FIN6 Adversary Emulation series, we focus on Active Directory (AD) enumeration—a critical phase in FIN6's discovery techniques. Understanding how adversaries enumerate Active Directory environments will help you refine your tradecraft or improve your detection and mitigation capabilities if you are a Blue Teamer.
In this video, you will learn how FIN6 performs Active Directory enumeration, and how to use native Windows commands like "net" and PowerShell's "Get-AD*" cmdlets for AD Enumeration. You will also learn how to utilize "AdFind.exe" to extract information from an Active Directory Environment.
The lab environment used in this demonstration is available for free on CYBER RANGES, allowing you to follow along and practice these techniques in a safe and controlled...
https://www.youtube.com/watch?v=Iwxmscx3XXc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
A Scammer Tried to Hack Me!
🚨🚔 I was recently offered a video sponsorship opportunity which turned out to be a DocuSign scam! They said they liked my videos but really just wanted to infect me with some malware 😿 Anyway, I thought I'd make a quick educational video to raise awareness. I'll explain what raised my suspicions and how I confirmed that the scammer was trying to hack me! #MalwareAnalysis #CyberSecurity #CyberSecurityAwareness #InfoSec #ScamBaiting #CryptoCat
🦠Malware Analysis🦠
VirusTotal: https://www.virustotal.com/gui/file/8f6f207277a8881e9c2042de4dc3a7c824eaa0334f522d96d412a2dfe5f93820/detection
APP.ANY.RUN Analysis: https://app.any.run/tasks/78722395-a017-4ac5-a18c-47464aae63a7
APP.ANY.RUN Safebrowsing: https://app.any.run/browses/6a13f769-5ec1-43e4-bc23-71f076e04e36
DocuSign Scams: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00...
https://www.youtube.com/watch?v=v8ZwlKAjMJA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The SECRET to Embedding Metasploit Payloads in VBA Macros
In this episode of the Offensive VBA series, we explore how to integrate PowerShell payloads and stagers into custom VBA macros for initial access. Specifically, we'll demonstrate how to repurpose and format PowerShell stagers generated by Msfvenom and PowerShell-Empire to execute a reverse shell.
This video will teach you how to format and embed HTA-based PowerShell payloads inside a VBA macro.
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU
🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6
// MORE RESOURCES
HACKERSPLOIT BLOG ►► https://bit.ly/3qjvSjK
HACKERSPLOIT FORUM ►► https://bit.ly/39r2kcY
HACKERSPLOIT ACADEMY ►►...
https://www.youtube.com/watch?v=Q1wQuHw5JKI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTV Overflow
RTV Overflow is a full-day virtual event packed with some of your favorite workshops from DEFCON 32!
Starting at 10:00 AM ET, the event features hands-on workshops including sessions on breaching Kubernetes clusters, physical red teaming strategies, and advanced cloud exploitation techniques. Get a behind-the-scenes look at RTV's mission, learn how our CTF comes to life, and discover opportunities to contribute to the village at the upcoming DEF CON 33. With sessions led by top professionals this event is your gateway to mastering real-world red team techniques and connecting with the global offensive security community.
Visit redteamvillage.io to learn more about our mission and sign up!
https://www.youtube.com/watch?v=JMTMEEqaBKg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Offensive VBA 0x4 - Reverse Shell Macro with Powercat
In this episode of the Offensive VBA series, we dive into one of the most powerful techniques for red teamers—creating a reverse shell VBA macro using Powercat. This technique enables stealthy command execution and remote access through malicious macro-enabled Office documents.
In this video, you will learn how to build a reverse shell VBA Macro that leverages Powercat allowing you to stealthily execute remote commands in-memory using PowerShell.
Powercat: https://github.com/besimorhino/powercat
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU
🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6
// MORE RESOURCES
HACKERSPLOIT BLOG ►►...
https://www.youtube.com/watch?v=0W3Z3Br56XM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Offensive VBA 0x3 - Developing PowerShell Droppers
In this episode of the Offensive VBA series, we take VBA macros to the next level by developing PowerShell droppers designed for red team operations. Learn how to craft stealthy and effective VBA scripts that deliver and execute PowerShell payloads seamlessly.
Here's what we'll cover: Writing VBA macros to execute PowerShell scripts, executing payloads directly in memory for stealth, leveraging environment variables to identify system paths dynamically, and techniques to remove traces of macro execution for stealthier operations
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU
🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6
// MORE...
https://www.youtube.com/watch?v=ot3053UxJOc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Offensive VBA 0x2 - Program & Command Execution
Welcome to the second episode of the Offensive VBA series, where we explore how to execute programs and system commands using VBA macros—essential skills for red teamers looking to leverage VBA for initial access and automation.
In this video, you will learn how to use the Shell function to run external programs and commands and leverage the WScript.Shell object for enhanced control over command execution. You will also learn how to use the Shell Window Style options to ensure stealth during execution.
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU
🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6
// MORE RESOURCES
HACKERSPLOIT BLOG...
https://www.youtube.com/watch?v=ogbrNZ3SCRY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Why Traditional Pentesting Is Letting You Down (and How to Fix It)
Pentesting is overdue for a refresh. Traditional pentesting methods—slow, checklist-driven, and lacking visibility—can no longer keep up with today's dynamic security landscape. The result is critical security gaps that leave organizations exposed to rapidly evolving threats.
In this webinar, you'll learn why traditional pentesting methods are failing and how Pentest as a Service (PTaaS) is reshaping the future of security testing. By combining a skills-vetted global pentester community with the efficiency of the HackerOne PTaaS platform, organizations can achieve real-time results, unmatched flexibility, and deeper integration with modern DevOps workflows.
Join us for insights into:
Common pitfalls of traditional pentesting, such as inexperienced testers and slow reporting cycles
How...
https://www.youtube.com/watch?v=db9ecB0izCA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Offensive VBA 0x1 - Your First Macro
Welcome to the first episode of the Offensive VBA series, where we equip red teamers with the skills to leverage VBA for initial access and offensive operations. This video introduces you to Visual Basic for Applications (VBA)—a powerful scripting language integrated into Microsoft Office.
Here's what we'll cover: What is VBA?: An overview of how VBA works and integrates with MS Office, A walkthrough of the Integrated Development Environment (IDE) and its features, and How to create and run a basic macro.
Core Concepts:
- Subroutines, Functions, and their calls.
- Variable declaration, data types, and scope.
- User input/output with MsgBox and control statements.
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation...
https://www.youtube.com/watch?v=jGy7_NusjuQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Emulating FIN6 - Gaining Initial Access (Office Word Macro)
Welcome to the next installment in our adversary emulation series! This video focuses on emulating initial access via a spear-phishing attachment—specifically, a malicious Word document with an embedded macro, just like FIN6 might use.
🚨 Next Up: If you want to manually develop your own VBA macros for initial access, don't worry—we've got you covered in the next video, where we'll dive deeper into crafting custom macros for red team operations.
🎥 Practical Labs: This video uses the CYBER RANGES platform to simulate a realistic attack environment. Try it out and follow along!
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU
The lab used in this video: https://app.cyberranges.com/scenario/624cd3877733a30007185a15
🔗...
https://www.youtube.com/watch?v=hUBRnh5dzrI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Broken Security Promises: How Human-AI Collaboration Rebuilds Developer Trust
Traditional security approaches have long frustrated developers, creating friction and eroding trust. The endless vulnerability backlogs must become a thing of the past. Discover a fresh approach that transforms security from a bottleneck to a strategic advantage, where AI-powered insights work in harmony with human-in-the-loop expertise to rewrite the rules of code security and ship more secure code faster.
Learn how combining artificial intelligence with human expertise will enable developers to:
- Receive actionable, context-aware security feedback that doesn't interrupt development
- Reduce false positives through intelligent human-in-the-loop analysis
- Benefit from contextual, just-in-time security training
We'll showcase real-world examples of how this human-AI collaborative approach...
https://www.youtube.com/watch?v=OZcaX38B2F8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
USB Ethernet Adapter Malware??? Chinese RJ45-USB Full Analysis - Part 1
Reverse engineering all stages with line by line code analysis.
e3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359
OP
https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memory-exe-recognized-as-malware
--
OALABS PATREON
https://www.patreon.com/oalabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
https://www.youtube.com/watch?v=3IfJSGWIrCo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
FIN6 Adversary Emulation Plan (TTPs & Tooling)
Step into the world of adversary emulation with this in-depth video on the FIN6 Emulation Plan. Learn how to use the Center for Threat-Informed Defense (CTID) Adversary Emulation Library to craft a comprehensive emulation plan that replicates FIN6's sophisticated TTPs.
This video will provide you with: An intelligence summary of FIN6, and the FIN6 emulation plan detailing TTPs from initial access to discovery, privilege escalation, and exfiltration.
The Adversary Emulation Fundamentals labs used in this video and series are available for free on CYBER RANGES to practice and refine your emulation skills.
// Adversary Emulation Labs
New to CYBER RANGES? Register here: https://bit.ly/40dRMsb
CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU
Lab used in this video: https://app.cyberranges.com/scenario/624cb3bd7733a30007185990
🔗...
https://www.youtube.com/watch?v=qEfk44G4zFM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Developing An Adversary Emulation Plan
Creating an adversary emulation plan is a critical process for red teamers and cybersecurity professionals aiming to improve their organization's threat detection and response capabilities. In this video, we break down the entire process starting with how to select a threat actor relevant to your industry or geolocation, finding and leveraging Cyber Threat Intelligence (CTI) to gather insights on the adversary, and mapping the adversary's TTPs using the MITRE ATT&CK framework.
🔗 Video Resources & References
Explore the comprehensive APT Groups and Operations Directory to find details on APT groups by region, their TTPs, and campaigns: https://apt.threattracking.com
APTnotes: https://github.com/kbandla/APTnotes
APT & CyberCriminal Campaign Collection: https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
//...
https://www.youtube.com/watch?v=1N49x1EWw7s
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How 3 Hackers Combined Their Skills for Big Bounties! (And how you can do it too)
Join us in this special episode as we sit down with the winners of Bugcrowd's Hacker Showdown Carnival of Chaos virtual event: sw33tLie, bsysop, and godiego! Discover their hacking methodologies, collaboration techniques, and their journey to victory. Learn how they met, their advice for forming your own team, and the coolest exploits they uncovered during the event. If you're interested in bug bounties, team hacking, or just want to meet more hacker friends, this episode is a must-watch!
00:00 Introduction and Special Guests
01:04 Meet the Hackers
02:55 Carnival of Chaos Experience
04:32 Collaboration and Team Dynamics
06:15 Roles and Strategies in Hacking
13:00 Finding the Right Collaborators
15:25 Live Hacking Events vs. Virtual Events
22:30 Coolest Findings and Bug Stories
29:52 Advice...
https://www.youtube.com/watch?v=gUuDyIE44bc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HackerOne Live Hacking Event Recap: Edinburgh w/ Amazon and AWS
In September, some of the best security researchers in the world joined the Amazon and AWS teams in Edinburgh, Scotland, for a live-hacking event fit for a Scottish king. 👑
This collaboration with the security researcher community is vital to Amazon and AWS' commitment to comprehensive security for their users and customers. See the highlights and which security researchers were able to climb to the top of the leaderboard.
For more information about HackerOne, visit https://www.hackerone.com/
https://www.youtube.com/watch?v=xIIPn4CV9eM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introduction To Advanced Persistent Threats (APTs)
This informative video is designed to give you a comprehensive understanding of Advanced Persistent Threats (APTs). In this video, you will learn what APTs are, how they differ from traditional threat actors, and why they pose a significant challenge to organizations worldwide. This video also explores the categorization and naming of APT Groups based on nation-state affiliation, motivations, and the tactics they employ to achieve their objectives.
This video also sheds light on the complexities of APT naming conventions used by major cybersecurity vendors, such as CrowdStrike and Mandiant, and the challenges in tracking these elusive groups.
🔗 Don't miss this resource: Access the "APT Groups and Operations" repository here: https://apt.threattracking.com — a comprehensive spreadsheet...
https://www.youtube.com/watch?v=CwSG5sa0Nao
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HackerOne Customer Testimonial: Amazon and AWS
For Amazon and AWS, their bug bounty programs give their security teams unique insight into their entire digital landscape. Through their programs, the Amazon and AWS teams work with researchers from around the world to continuously test their platform and products. See how their teams regularly engage the researcher community to protect customer data, drive collaboration, and foster knowledge sharing.
For more information on HackerOne products visit: https://www.hackerone.com/
https://www.youtube.com/watch?v=pNJNdrZN0YA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Be Kind, Rewind... The USN Journal
In this episode, we'll explore groundbreaking research from CyberCX on “rewinding the NTFS USN Journal.” This innovative technique reveals how to uncover the original locations of files recorded in the USN Journal, even after their corresponding NTFS FILE records have been reused by different files.
🛑 If you need a refresher on the prerequisites for this episode, watch these:
Introduction to MFTECmd - NTFS MFT and Journal Forensics:
https://www.youtube.com/watch?v=_qElVZJqlGY
Anatomy of an NTFS FILE Record - Windows File System Forensics:
https://www.youtube.com/watch?v=l4IphrAjzeY
NTFS FILE Record Reuse:
https://www.youtube.com/watch?v=6LpJVx7PrUI
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
05:03...
https://www.youtube.com/watch?v=GDc8TbWiQio
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
403 Bypass and Deserialization in BentoML Library (CVE-2024-2912) - "Summar-AI-ze" [Web Challenge]
🚩 Video walkthrough for the "Summar-AI-ze" (web) challenge I created and hosted on my NEW website (https://cryptocat.me)!! Players were required to bypass a 403 error by using the X-Forwarded-For HTTP header, allowing them to activate an internal feature and grant their account beta access. The "beta" feature was a word summarization tool, running BentoML (LLM) on the backend. Players could identify the library by changing the content-type, triggering an error. Some research would yield CVE-2024-2912; a python pickle deserialization vulnerability, discovered by PinkDraconian 💜 Players could use the supplied PoC to gain code execution and exfiltrate the flag using curl 😎 #CTF #Challenge #CryptoCat
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/cryptocat/summaraize
Join...
https://www.youtube.com/watch?v=5NCzDZcx_Dg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Advent of Cyber Day 24: MQTT & Wireshark
Check out TryHackMe's Advent of Cyber Event: https://tryhackme.com/r/christmas?utm_source=youtube&utm_medium=social&utm_campaign=
Join Katie, aka InsiderPhD, on the 24th day of TryHackMe's Advent of Cyber! Today, we're diving into the mysterious world of communication protocols, focusing on the MQTT protocol. Discover how the city of Wereville faces off against Mayor Malware's sabotage of smart lights and HVAC systems. Using Wireshark, Katie demonstrates how to analyze MQTT traffic, understand the publish-subscribe model, and reverse engineer networking protocols. With a blend of British humour and hands-on learning, Katie leads you through the process of identifying malicious commands and securing IoT devices. By the end, you'll learn how to troubleshoot smart devices, monitor network...
https://www.youtube.com/watch?v=ct6393M_Iow
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
From Report to Results: Building Resilience with Insights from the Hacker-Powered Security Report
The 8th Annual Hacker-Powered Security Report just launched. How can you interpret it to make the case for your own human-powered security program, attract more security researchers to your programs, or incentivize more impactful vulnerability reports?
This webinar, featuring HackerOne customers and a leading member of our security researcher community, will answer that question.
Learn More: https://www.hackerone.com/events/report-results-hacker-powered-security-report
https://www.youtube.com/watch?v=tAGF4pFSs6M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introduction To Adversary Emulation
This video introduces you to Adversary Emulation and its role in Red Team operations. Furthermore, this video also explains the differences between Adversary Emulation and Simulation. Adversary emulation in the context of Red Teaming is the process of mimicking/emulating the tactics, techniques, and procedures (TTPs) of a threat actor/adversary to test the effectiveness and efficacy of an organization's defenses.
//PLATFORMS
BLOG ►► https://bit.ly/3qjvSjK
FORUM ►► https://bit.ly/39r2kcY
ACADEMY ►► https://bit.ly/39CuORr
//SOCIAL NETWORKS
TWITTER ►► https://bit.ly/3sNKXfq
DISCORD ►► https://bit.ly/3hkIDsK
INSTAGRAM ►► https://bit.ly/3sP1Syh
LINKEDIN ►► https://bit.ly/360qwlN
PATREON ►► https://bit.ly/365iDLK
MERCHANDISE ►► https://bit.ly/3c2jDEn
//BOOKS
Privilege...
https://www.youtube.com/watch?v=CUMhiSdOSkY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Advent of Cyber Day 13: Exploring WebSocket Vulnerabilities with InsiderPhD
Check out TryHackMe's Advent of Cyber Event: https://tryhackme.com/r/christmas?utm_source=youtube&utm_medium=social&utm_campaign=
Join me, in today's TryHackMe Advent of Cyber Day 13 walkthrough, where she diving into WebSockets and WebSocket message manipulation vulnerabilities. Learn about WebSocket message manipulation, common security risks such as weak authentication, message tampering. Follow along as I demonstrates how to identify and exploit WebSocket vulnerabilities in a web application. Perfect for anyone interested in web security, bug bounty hunting, and real-time communication protocols.
00:00 Introduction and Welcome
00:26 Story Setup: The Threat in Wareville
01:22 Understanding WebSockets
02:54 WebSocket Vulnerabilities
04:08 WebSocket Message Manipulation
07:33 Practical...
https://www.youtube.com/watch?v=ozgRXn44FF0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Mastering Persistence: Using an Apache2 Rootkit for Stealth and Defense Evasion
In this video, I demonstrate the process of establishing persistence and evading defenses on Linux through the use of an Apache2 rootkit.
The lab used in this video can be accessed for free on the CYBER RANGES platform. The links to the platform and lab are listed below:
// CYBER RANGES
CYBER RANGES: https://app.cyberranges.com
SQL Injection Lab: https://app.cyberranges.com/scenario/67474e64a3907f65136f1a6d
//LINKS
Apache2 Rootkit: https://github.com/ChristianPapathanasiou/apache-rootkit
//PLATFORMS
BLOG ►► https://bit.ly/3qjvSjK
FORUM ►► https://bit.ly/39r2kcY
ACADEMY ►► https://bit.ly/39CuORr
//SOCIAL NETWORKS
TWITTER ►► https://bit.ly/3sNKXfq
DISCORD ►► https://bit.ly/3hkIDsK
INSTAGRAM ►► https://bit.ly/3sP1Syh
LINKEDIN ►► https://bit.ly/360qwlN
PATREON...
https://www.youtube.com/watch?v=Ra2altDvPYI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
XSS via CSPT and DOM Clobbering - "SafeNotes 2.0" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Safe Notes 2.0" (web) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! The developer of Safe Notes learnt from their mistakes and introduced a variety of security fixes, but unfortunately introduced new vulnerabilities! Players were required to chain DOM Clobbering, client-side path traversal (CSPT) and an Open Redirect in order to achieve XSS and steal the admin's cookie. 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/intigriti/web/safenotes_2
Check out Safe Notes v1 challenge and walkthrough here: https://challenge-0824.intigriti.io + https://youtu.be/yGRRGUtT9MU
🐛INTIGRITI 1337UPLIVE CTF🐞
https://ctftime.org/event/2134
https://ctf.intigriti.io
https://discord.gg/intigriti-870275171938873395
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00...
https://www.youtube.com/watch?v=G-KoF8WAoUM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
NTFS FILE Record Reuse
In this continuation of "Anatomy of an NTFS FILE Record," we'll learn how NTFS manages record reuse and distinguishes between in-use and deleted files and directories.
If you haven't watched the previous episode, watch it here:
https://www.youtube.com/watch?v=l4IphrAjzeY
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
00:31 - NTFS Master File Table (MFT) artiFACTS
01:49 - Analysis
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics
https://www.youtube.com/watch?v=6LpJVx7PrUI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Basic Stack Buffer Overflow (with parameters) - "Retro2Win" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Retro2Win" (pwn) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! A classic "ret2win" challenge, the binary included a buffer overflow vulnerability, allowing players to take over the flow of execution and call a "win" function. In this case, the function expected two parameters, requiring values to be popped into the RDI/RSI registers first 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/intigriti/pwn/retro2win
🐛INTIGRITI 1337UPLIVE CTF🐞
https://ctftime.org/event/2134
https://ctf.intigriti.io
https://discord.gg/intigriti-870275171938873395
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00 Intro
0:13 Basic file...
https://www.youtube.com/watch?v=Y37KMst1XFU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
X-Forwarded-For Header Spoofing and XXE - "BioCorp" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "BioCorp" (web) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! Players arrived an a website for an energy corporation, with a hint that they were working on decoupling their backend infrastructure from the public facing website. By analysing the source code, players would find a hidden panel, restricted by IP address. By setting the X-Forwarded-For header, they could spoof the IP and gain access to a nuclear panel. Since the panel read XML data, players would test for XXE and ultimately recover the flag 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/intigriti/web/biocorp
🐛INTIGRITI 1337UPLIVE CTF🐞
https://ctftime.org/event/2134
https://ctf.intigriti.io
https://discord.gg/intigriti-870275171938873395
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00...
https://www.youtube.com/watch?v=hyi_JZvXOTU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
5 Things You Need to Learn From the New Hacker-Powered Security Report
As the cybersecurity landscape continues to change, understanding the perspectives of security researchers is essential for effective risk management.
In this 30-minute live webinar session, we'll dive into the top five takeaways from the 8th Annual Hacker-Powered Security Report. With practical examples and actionable recommendations, you'll learn how to:
- Ensure that AI deployments are secure and trustworthy
- Enhance your approach to vulnerability management
- Implement demonstrably valuable security measures
Join this fast-paced exploration of the vital role of human expertise in the AI era.
To download the full report, visit: hackerone.com/report
https://www.youtube.com/watch?v=1DdY6lV3Llc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Impact of Collaboration
https://www.youtube.com/watch?v=n2Z-kaRr2ws
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
One Time Pad (OTP) with a Twist - "Schrödinger's Pad" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Schrödinger's Pad" (crypto) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! The challenge included a common vulnerability; reusing a one-time-pad (OTP). There was a slight twist; for each encryption, the box would be observed. If the cat is alive, some cryptographic operations would take place. If the cat is dead, some different operations occur - players need to reverse it! 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/intigriti/crypto/schrodingers_pad
🐛INTIGRITI 1337UPLIVE CTF🐞
https://ctftime.org/event/2134
https://ctf.intigriti.io
https://discord.gg/intigriti-870275171938873395
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00...
https://www.youtube.com/watch?v=9NrmlOBcF1c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
JWT Algorithm Confusion and SSTI (Pug) - "Cat Club" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Cat Club" (web) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! The challenge featured a server-side template injection (SSTI) vulnerability in the user welcome message. However, there is a problem; the username is sanitized on registration and then rendered from the JWT, which is signed using an RS256 private key. Players must exploit an algorithm confusion vulnerability to tamper with the JWT, changing their username to an SSTI (pug) payload. There's no command output, so to return the flag they will also need to develop a blind payload (e.g. return flag to web server logs) 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/intigriti/web/cat_club
🐛INTIGRITI...
https://www.youtube.com/watch?v=Vh9SqT9KyL8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Bypassing Server-side Anti-Cheat Protections - "Bug Squash (part 2)" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Bug Squash part 2" (gamepwn) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! It's a unity-based game where players need to squash bugs to earn points, like part 1. The difference here is the points are stored server-side and some anti-cheat mechanisms have been put in place to prevent hackers from manipulating their score! Players must develop a PoC which exploits some JSON parsing discrepancies, being careful not to trigger any ant-cheat defences (all under a strict time limit) 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/intigriti/game/bug_squash2
Bug Squash part 1: https://youtu.be/VoT74JOGWgA
🐛INTIGRITI 1337UPLIVE CTF🐞
https://ctftime.org/event/2134
https://ctf.intigriti.io
https://discord.gg/intigriti-870275171938873395
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00...
https://www.youtube.com/watch?v=dEA68Aa0V-s
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
A Guide for Solving Beginner CTF Challenges [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for 4 "warmup" challenges from the 2023 1337UP LIVE (CTF) competition by Intigriti, originally presented during the pre-CTF livestream in 2024. The challenges include various decodings with cyberchef, traffic analysis (PCAPs) and basic reversing/crypto 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti
Full livestream: https://youtube.com/live/BKXfrNwrcqQ
🐛INTIGRITI 1337UPLIVE CTF🐞
https://ctftime.org/event/2134
https://ctf.intigriti.io
https://discord.gg/intigriti-870275171938873395
👷♂️Resources🛠
https://cryptocat.me/resources
Overview:
0:00 Intro
0:19 Warmup: Encoding
1:52 Forensics: OverTheWire (part 1)
5:17 Forensics: OverTheWire (part 2)
10:00 Crypto: Keyless
11:03 Conclusion
🧑💻 Sign up and start hacking right now - https://go.intigriti.com/register
👾...
https://www.youtube.com/watch?v=CsyQFzTJ09w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The 8th Annual Hacker-Powered Security Report: An overview
The 8th Annual Hacker-Powered Security Report states that whether you think AI is a threat or an opportunity, you are right.
- 48% of security leaders say GenAI is the biggest threat to their organization.
- Nearly 10% of researchers specialize in AI red teaming as the number of AI assets in scope for bug bounty programs has increased by 171%.
- Researchers are also leveraging AI tools to be even more effective in finding and reporting vulnerabilities, with 58% saying they use AI either as a significant tool or in some way.
At HackerOne, we definitely see the opportunities provided by GenAI. In the spirit of embracing the technology, we asked NotebookLM to summarize the latest Hacker-Powered Security Report. Listen to our AI-generated podcast on the report and let us know what you think!
To...
https://www.youtube.com/watch?v=7j1cNrknCe4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
13Cubed XINTRA Lab Walkthrough
In this episode, we'll perform a comprehensive walkthrough of the 13Cubed challenge created for XINTRA Labs. Learn more at https://www.xintra.org/labs.
💰 For a limited time only, use the discount code "13CUBED" to get 15% off a XINTRA Labs subscription!
🙏 Special thanks to Mike Peterson from https://nullsec.us for playing the role of Threat Actor in our scenario!
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
00:58 - Workstation - Running MemProcFS
03:25 - Workstation - Question 1
05:14 - Workstation - Question 2
07:06 - Workstation - Question 3
07:53 - Workstation - Question 4
09:42 - Workstation - Question 5
12:42 - Workstation - Question 6
15:31 - Workstation - Question 7
17:34 - Workstation -...
https://www.youtube.com/watch?v=A7Bh7vnAooQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Review: This Is How They Tell Me the World Ends (not with a bang but with a bug)
Join me on a brand-new series as I indulge my childhood dream of creating a personal library, focusing on InfoSec books! Kicking things off, we dive into 'This Is How They Tell Me How The World Ends' by Nicole Perlroth. Despite being an ebook enthusiast, I decided it was high time to fill my custom-built bookcase with real books. We'll explore the fascinating histories and personal stories behind bug bounties, zero days, and cyber warfare, all narrated with the flair of a seasoned journalist. From cyber politics to sassy hacker quips - what did happen to that salmon anyway? To how hackers take on the global stage of politics
00:00 Introduction to the Quest for Infosec Books
00:29 Building the Dream Library
00:55 E-Readers vs. Physical Books
02:41 Criteria for Book Selection
04:44 First Book...
https://www.youtube.com/watch?v=OvUmumbiGRI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HackerOne Live Hacking Event Recap: Las Vegas w/Epic Games
https://www.youtube.com/watch?v=rJb-qFYylis
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Understanding the Bugcrowd VRT: An Insider's Guide
Join us at DEF CON as we sit down with Codingo, VP of Operations at Bugcrowd, to look into the Vulnerability Rating Taxonomy (VRT). Learn what makes the VRT unique, how it compares to other vulnerability rating systems like CVSS, and why it's a key part of Bugcrowd's platform. Discover how the VRT evolves, the community's role in its development, and essential tips for hackers advocating for higher priorities on their findings. Whether you're a seasoned Bugcrowd hacker or new to the platform, this interview offers valuable insights and practical advice for improving your skills and understanding of the VRT.
00:00 Introduction to the VRT and Bugcrowd
00:33 Bugcrowd's Unique Offerings for Hackers
01:19 Understanding the VRT: An Interview with Kodinga
02:22 Differences Between VRT and CVSS
03:09...
https://www.youtube.com/watch?v=AIJK_Lw8rKw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Google's Mobile VRP Behind the Scenes with Kristoffer Blasiak (Hextree Podcast Ep.1)
"There are not that many people that do Android research [...] There is no lack of targets. If people would actually look, there is lots to it. The scope is huge." - This is a conversation with Kristoffer Blasiak about Google's Mobile Vulnerability Rewards Program (VRP).
Learn Android Hacking (ad): https://hextree.io/hextree-x-google
Mobile VRP: https://bughunters.google.com/about/rules/android-friends/6618732618186752/google-mobile-vulnerability-reward-program-rules
00:00 - Introducing Kristoffer and Mobile VRP
01:38 - What happens when you submit a bug
05:07 - Android app bug bounty opportunities
08:38 - "There is no lack of targets"
13:06 - The side-loading threat model
17:00 - Bugs in Android app vs. web app
23:30 - Hextree sponsored by Google
=[ ❤️ Support ]=
→ per Video:...
https://www.youtube.com/watch?v=SyTy1uZgx8E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Reverse Engineering LAB Setup Tutorial (updated)
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials.
The full notes for this tutorial are unlocked for everyone on our Patreon including links to all of the tools mentioned
https://www.patreon.com/posts/101718688
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=adAr0KBJm4U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
HackerOne Live Hacking Event Recap: Las Vegas w/TikTok
https://www.youtube.com/watch?v=QYRgmBmsm_M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Get Bigger Bounties With Better Reports
At DEFCON a few weeks ago, I sat down with Codingo, VP of operations to talk about the key elements of writing an effective bug report, especially for non-native English speakers and beginners. We also discuss the importance of clarity, accurate replication steps, and the impact of comprehensive report writing on your bug bounty success. Learn from Bugcrowd's framework and community-driven practices to enhance your cybersecurity skills and make a stronger impact with your findings.
00:00 Introduction and Apology
00:37 Sponsor Message: Bugcrowd
01:22 Live from DEF CON
01:53 The Importance of Report Writing
02:17 Key Elements of a Good Report
04:46 Challenges in Report Writing
06:11 The Triage Process
08:21 Support for Non-Native English Speakers
09:17 Common Reasons for Bug Rejection
11:09...
https://www.youtube.com/watch?v=hnU0mRl0WBI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
My theory on how the webp 0day was discovered #short
Want to learn more about hacking? Checkout our courses on https://www.hextree.io (ad)
I have spent many hours looking at the webp vulnerability used in the 0day attack against iPhones. In the past videos we have seen why fuzzers have a hard time finding the issue, so I wanted to understand how this was discovered. And I think I have a good theory!
Part 1: Huffman Tables https://youtu.be/lAyhKaclsPM
Part 2: Fuzzing libwebp https://youtu.be/PJLWlmp8CDM
Sources:
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html
https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html
https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html
https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://github.com/libjxl/libjxl/blob/4b9dbde293f7f282b6952a02340300abfca2b184/lib/jxl/huffman_table.cc#L51
https://github.com/webmproject/libwebp/blob/7861947813b7ea02198f5d0b46afa5d987b797ae/src/dec/vp8l_dec.c#L86C3-L86C76
https://github.com/Tencent/mars/blob/9ab46e19ed3d4fcafe9d0de4b36547321f5ead83/mars/comm/windows/zlib/inftrees.h#L41
https://github.com/google/brunsli/blob/master/c/enc/jpeg_huffman_decode.h#L20
00:00...
https://www.youtube.com/shorts/CS128zYJSmw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Linux Memory Forensics Challenge
Welcome to a special Linux Memory Forensics Challenge from 13Cubed. This is an excellent opportunity to get some hands-on practice with Linux memory forensics. You'll find the questions below, as well as a link to download the memory sample needed to answer those questions.
🎉 Check out the official training courses from 13Cubed at https://training.13cubed.com!
HINT 1: To get started, run the Volatility 3 banners plugin to determine the correct kernel version, and subsequently install the correct symbols and create the ISF.
HINT 2: The kernel version in use on this Ubuntu 22.04 machine was 6.5.0-41. It is recommended that Ubuntu 22.04 be used for the analysis.
🛑 CONTEST IS CLOSED 🛑
All winners have been selected. We still encourage you to participate in the lab, as we believe it...
https://www.youtube.com/watch?v=IHd85h6T57E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
My theory on how the webp 0day was discovered (BLASTPASS)
Want to learn more about hacking? Checkout our courses on https://www.hextree.io (ad)
I have spent many hours looking at the webp vulnerability used in the 0day attack against iPhones. In the past videos we have seen why fuzzers have a hard time finding the issue, so I wanted to understand how this was discovered. And I think I have a good theory!
Part 1: Huffman Tables https://youtu.be/lAyhKaclsPM
Part 2: Fuzzing libwebp https://youtu.be/PJLWlmp8CDM
Sources:
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html
https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html
https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html
https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://github.com/libjxl/libjxl/blob/4b9dbde293f7f282b6952a02340300abfca2b184/lib/jxl/huffman_table.cc#L51
https://github.com/webmproject/libwebp/blob/7861947813b7ea02198f5d0b46afa5d987b797ae/src/dec/vp8l_dec.c#L86C3-L86C76
https://github.com/Tencent/mars/blob/9ab46e19ed3d4fcafe9d0de4b36547321f5ead83/mars/comm/windows/zlib/inftrees.h#L41
https://github.com/google/brunsli/blob/master/c/enc/jpeg_huffman_decode.h#L20
00:00...
https://www.youtube.com/watch?v=_ACCK0AUQ8Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Shimcache Execution Is Back - What You Need to Know!
In this special episode, Mike Peterson from nullsec.us joins us to discuss important new research on Shimcache/AppCompatCache. Discover how this artifact can potentially be used to prove execution in Windows 10 and later—a capability that was previously thought impossible!
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
01:08 - Shimcache/AppCompatCache artiFACTS
09:38 - nullsec.us Research
18:40 - Wrap-up
🛠 Resources
Original research from Eric Zimmerman:
https://github.com/EricZimmerman/AppCompatCacheParser/issues/6
GitHub commit for AppCompatCacheParser adding the functionality (March 2023):
https://github.com/EricZimmerman/AppCompatCacheParser/commit/c995e82a58684bb15a46c34729c99a4024aaf8b3#diff-e5f34b98fc08cf3da1819cd0652cb2c28a785e4f2bab8cccfb0d7fe2cb99cff9R79
For...
https://www.youtube.com/watch?v=DsqKIVcfA90
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Learn Android Hacking! - University Nevada, Las Vegas (2024)
During DEF CON and Black Hat, Google invited me to give a talk about Android hacking to students as part of init.g at the University Nevada, Las Vegas. In this talk I share my "trick" how to get into Android hacking and reverse engineering, which can also be adapted to any other topic.
Learn android hacking (ad): https://app.hextree.io/map/android
Watch my Vegas Vlog: https://www.youtube.com/watch?v=bhQ6FF3fCdA
Article about the init.g event: https://www.unlv.edu/announcement/academics/google-sponsors-initgvegas-student-event-unlv-during-defcon
=[ ❤️ Support ]=
→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd Channel: https://www.youtube.com/LiveUnderflow
=[ 🐕 Social ]=
→ Twitter: https://twitter.com/LiveOverflow/
→...
https://www.youtube.com/watch?v=fPt6fJDjKKM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC32 - Red Team Village - Recap
Thank you to everyone who attended the village this year at DEF CON! Another huge thank you to our core team, sponsors, volunteers, goons, and DEF CON!
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=xjKxLoz0Dw4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
My Trip to Las Vegas for DEFCON & Black Hat
My second time in Las Vegas for DEF CON and Black Hat. Lots has changed since I have been here 6 years ago. This trip was quite emotional for me and I am so grateful for the experience. Hope to meet you all again.
Learn hacking (ad): https://app.hextree.io/
Buy our Faultier (US): https://1bitsquared.com/collections/embedded-hardware/products/faultier
Google x Hextree Android Courses: https://www.hextree.io/hextree-x-google
Raspberry Pi Hacking Challenge: https://www.hextree.io/rp2350
Embedded System Village: https://embeddedvillage.org/
My previous DEF CON 26 (6 years ago) Vlog:
- https://youtu.be/B8saYocsI-U
- https://www.youtube.com/watch?v=RXgp4cDbiq4
=[ ❤️ Support ]=
→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd...
https://www.youtube.com/watch?v=bhQ6FF3fCdA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC32 - Red Team Village x Amazon
Thank you Amazon for being a platinum sponsor! For more information about Amazon, please visit https://amazon.com.
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=ouv0tgFmo8M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
DC32 - Red Team Village x Kindo
Thank you Kindo for being a platinum sponsor! For more information, please visit https://kindo.ai.
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=-1wBcsNVqPo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
RTV x Flare - An Introduction to Flare
The Red Team Village
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=xXulBDmkxsY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Planning Red Team Operations | Scope, ROE & Reporting
Hey guys, HackerSploit here back again with another video. This video outlines the process of planning and orchestrating Red Team operations.
This video also outlines various Red Team resources, guides, and templates to plan and orchestrate a successful Red Team Operation.
//LINKS & RESOURCES
REDTEAM.GUIDE: https://redteam.guide/
The slides and written version of this video can be accessed on the HackerSploit Forum: https://forum.hackersploit.org/t/introduction-to-the-mitre-att-ck-framework/9127
//HACKERSPLOIT PLATFORMS
BLOG ►► https://bit.ly/3qjvSjK
FORUM ►► https://bit.ly/39r2kcY
ACADEMY ►► https://bit.ly/39CuORr
//SOCIAL NETWORKS
TWITTER ►► https://bit.ly/3sNKXfq
INSTAGRAM ►► https://bit.ly/3sP1Syh
LINKEDIN ►► https://bit.ly/360qwlN
PATREON ►► https://bit.ly/365iDLK
MERCHANDISE...
https://www.youtube.com/watch?v=usDt-s2sACI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Mapping APT TTPs With MITRE ATT&CK Navigator
Hey guys, HackerSploit here back again with another video. This video will introduce you to the MITRE ATT&CK Navigator and will illustrate how it can be operationalized for planning and orchestrating Red Team operations.
MITRE ATT&CK Framework: https://attack.mitre.org/
MITRE ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/
//PLATFORMS
BLOG ►► https://bit.ly/3qjvSjK
FORUM ►► https://bit.ly/39r2kcY
ACADEMY ►► https://bit.ly/39CuORr
//SOCIAL NETWORKS
TWITTER ►► https://bit.ly/3sNKXfq
DISCORD ►► https://bit.ly/3hkIDsK
INSTAGRAM ►► https://bit.ly/3sP1Syh
LINKEDIN ►► https://bit.ly/360qwlN
PATREON ►► https://bit.ly/365iDLK
MERCHANDISE ►► https://bit.ly/3c2jDEn
//BOOKS
Privilege Escalation Techniques ►► https://amzn.to/3ylCl33
Docker...
https://www.youtube.com/watch?v=hN_r3JW6xsY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Mounting Linux Disk Images in Windows
Learn how to mount Linux disk images in Windows using the Windows Subsystem for Linux (WSL). We'll tackle common issues and their fixes.
⌨️ Command used in the video:
sudo mount -o ro,loop,offset=[OFFSET],noload [IMAGE] /mnt/[MOUNTPOINT]
If you're mounting images containing Logical Volume Management (LVM) volumes, additional steps are required:
✅ Install LVM2 (if not already installed)
sudo apt install lvm2 (Debian/Ubuntu)
sudo dnf install lvm2 (Fedora)
sudo yum install lvm2 (RHEL)
✅ Create a loop device from the disk image:
sudo losetup -f -P testimage.dd
Here, "-f" tells losetup to find the next available loop device, and "-P" forces the kernel to scan the partition table on the newly created loop device.
✅ Refresh LVM so that the new device appears:
sudo pvscan --cache
This...
https://www.youtube.com/watch?v=W_youhia4dU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
New Course! Investigating Linux Devices
Check out Investigating Linux Devices, a comprehensive Linux forensics training course from 13Cubed! Starting with fundamental principles, Investigating Linux Devices rapidly progresses to encompass log analysis, file systems, persistence mechanisms, memory forensics, live response, and more! This course offers extensive hands-on practice and a capstone involving the analysis of a compromised system. Tailored for both beginners and seasoned professionals, it serves as an ideal resource for mastering Linux forensics!
🎉 Enroll today at https://training.13cubed.com!
#Forensics #DigitalForensics #DFIR #LinuxForensics
https://www.youtube.com/watch?v=4sRFu_QTkXM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Weird Windows Feature You've Never Heard Of
In this episode, we'll explore File System Tunneling, a lesser-known legacy feature of Windows. We'll uncover the fascinating behind-the-scenes functionality and discuss the potential implications for forensic examinations of compromised systems.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
05:06 - File System Tunneling Demo
🛠 Resources
The Apocryphal History of File System Tunnelling:
https://devblogs.microsoft.com/oldnewthing/20050715-14/?p=34923
File System Tunneling in Windows (Jason Hale):
https://df-stream.com/2012/02/file-system-tunneling-in-windows/
File System Tunneling (Harlan Carvey):
https://windowsir.blogspot.com/2010/04/linksand-whatnot.html
#Forensics #DigitalForensics #DFIR #ComputerForensics...
https://www.youtube.com/watch?v=D5lQVdYYF4I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Live at the RSA expo hall!
https://www.youtube.com/shorts/y7-J8g3_9l8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Zombieware
Self-replicating malware, long abandoned by its operators, continues to contribute significant volume and noise to malware feeds. We investigate this trend, which we refer to as Zombieware!
Join us on Patreon for Part 2 where we reverse engineer a popular file infector and write an extractor to recover the infected files!
https://www.patreon.com/posts/zombieware-part-103656376
Full Zombieware blog post can be found on our UnpacMe blog here: https://blog.unpac.me/2024/04/25/zombieware/
Ladislav Zezula's excellent talk from BSides Prague can be found here:
https://www.youtube.com/watch?v=OgXvd-Wce9o
-----
OALABS DISCORD
https://discord.gg/oalabs
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED...
https://www.youtube.com/watch?v=NNLZmB6_aGA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Ultimate Guide to Arsenal Image Mounter
In this episode, we'll take an in-depth look at Arsenal Image Mounter. We'll start with the basics and cover the functionality included in the free version. Then, we'll look at advanced features including the ability to launch VMs from disk images, password bypass and password cracking, and working with BitLocker encrypted disk images.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
00:57 - Free Mode
07:55 - Professional Mode
08:43 - Launch a VM from a Disk Image
09:28 - Fixing a Common Issue
12:21 - Windows Authentication Bypass
14:55 - About DPAPI
16:36 - DPAPI: Password Attack Functionality
19:49 - Mounting VSCs
22:36 - Launch a VM from a VSC
23:45 - More VSC Options
26:08 - Working with BitLocker Images
🛠...
https://www.youtube.com/watch?v=4eifl8qvqVk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Should I report this vulnerability? Will I get a bounty?
It's really exciting to find your first bug BUT it's crushing when you realise it isn't reportable or comes back as NA from a client. Here are my top tips for identifying if you've found something and double checking before getting caught up in excitement! I still get emails about IDORs being NA because you need a victims cookie and hackers who are angry at bug bounty programs or triagers.
https://www.youtube.com/watch?v=T4EhE5f7fQg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How to take notes when you suck at it
This episode of the Bug Bounty course we talk about the importance of developing a personal note taking system that supports both hacking and learning. Emphasizing the differentiation between notes taken during hacking activities and those for learning about vulnerabilities. We look at methods for organizing and accessing your notes whether you are into Notion, Obsidian or Vim or even mind maps we'll look at how to integrate your notes with tools like Burp Suite. Creating your own knowledge base you can refer to every time you hack, tailored to individual needs and preferences and refine your own note-taking strategies for successful hacking and learning.
00:00 Introduction to the Bug Bounty Course
00:14 The Importance of a Personalized Note-Taking System
00:53 Sponsor Shoutout: Bugcrowd
01:45...
https://www.youtube.com/watch?v=uXuMvUPlvd0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Finding The .webp Vulnerability in 8s (Fuzzing with AFL++)
A guide on how to do fuzzing with AFL++ in an attempt to rediscover the libwebp vulnerability CVE-2023-4863 that was used to hack iPhones.
Want to learn hacking? Signup to https://hextree.io (ad)
Buy my shitty font: https://shop.liveoverflow.com/ (ad)
Watch webp Part 1: https://www.youtube.com/watch?v=lAyhKaclsPM
Sudo Vulnerability Series: https://www.youtube.com/playlist?list=PLhixgUqwRTjy0gMuT4C3bmjeZjuNQyqdx
Docker Video: https://www.youtube.com/watch?v=-YnMr1lj4Z8
OSS-Fuzz: https://github.com/google/oss-fuzz
OSS-Fuzz libwebp coverage: https://storage.googleapis.com/oss-fuzz-coverage/libwebp/reports/20230901/linux/src/libwebp/src/utils/report.html
AFLplusplus: https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/fuzzing_in_depth.md
vanhauser's blog: https://www.srlabs.de/blog-post/advanced-fuzzing-unmasks-elusive-vulnerabilities
vanhauser/thc...
https://www.youtube.com/watch?v=PJLWlmp8CDM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introduction to YARA Part 4 - Efficient Rule Development
In this OALABS Patreon tutorial we cover the foundations of writing efficient YARA rules and provide some tips that can help speed up your YARA hunting.
The full notes for this tutorial are unlocked for everyone on our Patreon
https://www.patreon.com/posts/introduction-to-96638239
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=xKeF_cPKXt0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introduction to YARA Part 3 - Rule Use Cases
In this OALABS Patreon tutorial we cover the three main use cases for YARA rules and how they apply to both BlueTeam/SOC operations and malware analysis.
Fun notes have been unlocked for everyone on our Patreon here
https://www.patreon.com/posts/introduction-to-96637668
The following are links to UnpacMe specific tutorials for developing each type of rule.
Identifying specific malware families (unpacked)
https://support.unpac.me/howto/hunting-with-yara/#identifying-specific-malware-families-unpacked
Identifying malware on disk or in network traffic (packed)
https://support.unpac.me/howto/hunting-with-yara/#identifying-malware-on-disk-or-in-network-traffic-packed
Hunting (malware characteristics)
https://support.unpac.me/howto/hunting-with-yara/#hunting-malware-characteristics
-----
OALABS...
https://www.youtube.com/watch?v=xutDqu_OiH8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introduction to YARA Part 2 - Hunting on UnpacMe
In this OALABS Patreon tutorial we demonstrate a simple YARA hunting example using the UnpacMe free YARA scan service: https://www.unpac.me
Full notes have been unlocked on our Patreon here
https://www.patreon.com/posts/introduction-to-96637337
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=Xqvlju9ED1c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Introduction to YARA Part 1 - What is a YARA Rule
In this OALABS Patreon tutorial we cover the basics of YARA, what is it, how is it used, and how to write your first rule.
Full notes have been unlocked on our Patreon here
https://www.patreon.com/posts/introduction-to-96636471
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=3BpIhbsDR_I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Approaching Large Scope Targets Without Feeling Overwhelmed
In this video, we discuss how beginners can tackle large scope targets in bug bounty hunting. These targets offer more flexibility and potential for bug discovery, making them a great starting point for new hackers. However, they can be overwhelming due to their size and diversity. We suggest focusing on one part of the larger scope, which helps you understand the target's application development process without becoming overwhelmed. We also delve into different reconnaissance techniques, including subdomain enumeration, Google Dorking, API enumeration, OSINT, and more. Lastly, we emphasize that while reconnaissance is critical for large scope targets, it is just a stepping stone to actually hacking and finding vulnerabilities.
This series couldn't happen without the support of our sponsor...
https://www.youtube.com/watch?v=W4pafFxOOwc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
New OWASP API Top 10 for Hackers
Blog article isn't done yet but I'll get it up ASAP!
Today we explore the new OWASP API Top 10 in detail, the new version is much more hacker friendly and focuses on bugs we can find rather than defenders but how can we start to study these bugs and actually find them? Let's take a look at some of the changes in the new OWASP API top 10 2023, which ones I recommend for beginners just starting out with API hacking and when to look out for specific bugs
There are a ton of vulnerabilities out there, like Prototype Pollution, SQL Injection, and remote code execution. And while they can be fun to exploit during CTFs but when they are lurking in our code…it's not as fun
But that's where our sponsor Snyk comes in - Snyk scans your code, dependencies, containers, and configs, all in...
https://www.youtube.com/watch?v=sl1yqGhuVy4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
OALABS Holiday Variety Show 2023
𝘔𝘦𝘳𝘳𝘺 𝘐𝘋𝘈𝘮𝘢𝘴 𝘢𝘯𝘥 𝘢 𝘏𝘢𝘱𝘱𝘺 𝘉𝘪𝘯𝘫𝘢-𝘠𝘦𝘢𝘳
Join us for our holiday special reverse engineering variety show!
- Guess the prompt AI charades
- Random RE banter
- Suspicious liquids in bottles
We've got it all!
Merry Christmas everyone we will see you in 2024!
-----
OALABS PATREON
https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=XMVhX29AJbQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
A Vulnerability to Hack The World - CVE-2023-4863
Citizenlab discovered BLASTPASS, a 0day being actively exploited in the image format WebP. Known as CVE-2023-4863 and CVE-2023-41064, an issue in webp's build huffman table function can lead to a heap buffer overflow. This vulnerability is very interesting and I'm excited to share with you what I learned.
Want to learn hacking? Signup to https://hextree.io (ad)
Buy my shitty font: https://shop.liveoverflow.com/ (ad)
WebP Fix Commit: https://chromium.googlesource.com/webm/libwebp/+/902bc9190331343b2017211debcec8d2ab87e17a
Citizenlab: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
Ben Hawkes: https://blog.isosceles.com/the-webp-0day/
Software Updates
Apple https://support.apple.com/en-gb/106361
Chrome https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
Firefox...
https://www.youtube.com/watch?v=lAyhKaclsPM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
🔥Resume Roast from our Content Manager Rachel. #shorts #resume #career #hacking
https://www.youtube.com/shorts/012h_SV0bRs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Is there ageism in #cybersecurity? Matt thinks so! What do you think? #shorts #hacking #ageism
https://www.youtube.com/shorts/PH9CCcRhUbk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Tips For Analyzing Delphi Binaries in IDA (Danabot)
Reverse Engineering Delphi is a nightmare ... or it can be if you don't have the right setup! In this clip we cover some easy tips that can help make some of the analysis a bit easier.
Full notes with links for tools are available here:
https://research.openanalysis.net/danabot/loader/delphi/2023/12/04/danabot.html
Full stream with analysis of the Danabot loader is available on Patreon here:
https://www.patreon.com/posts/live-stream-vod-94510766
-----
OALABS PATREON
https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=04RsqP_P9Ss
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
How To Recognize Macro Encrypted Strings in Malware
How to identify when a macro is used to encrypt strings in malware... inferring source from disassembly!
-----
OALABS PATREON
https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=fEAGYjhKzJY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Reinventing Web Security
Follow me down the rabbit hole into the wonderful world of IT security.
Buy my terrible font (ad): https://shop.liveoverflow.com
Learn hacking (ad): https://hextree.io
Related Videos:
https://www.youtube.com/watch?v=866olNIzbrk
https://www.youtube.com/watch?v=lKzsNp4AveY
Tweets:
https://twitter.com/LiveOverflow/status/1720734431659376995
https://twitter.com/LiveOverflow/status/1720799912181284864
https://twitter.com/LiveOverflow/status/1721493232310214910
Understanding the Risks of Stolen Credentials: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46437.pdf
Chapters:
00:00 - Intro
00:40 - Security Terminology
01:38 - Direct Database Access
03:40 - Introducing a Security Boundary
05:36 - Typical Web Security Vulnerabilities
07:03 - Clear-text Passwords...
https://www.youtube.com/watch?v=LxUAnZY_08o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Direct vs. Indirect Syscalls What Is All The HYPE?! [OALABS Call-In Show]
Our live discord call-in show debates! Are indirect syscalls even required? What are they and how are they used?! What are EDR vendors doing to detect them and why you might care....
-----
OALABS PATREON
https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=W2SeruUxhDs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Are Red Team Tools Helping or Hurting Our Industry? [OALABS Call-In Show]
Our live discord call-in show debates! Are red team tools really helping our industry or are they just giving malware operators a free lunch?!
-----
OALABS PATREON
https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----
https://www.youtube.com/watch?v=ur6csODQHKI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The Circle of Unfixable Security Issues
Not every security issues can be fixed. There exist (what I call) "unfixable" bugs, where you can always argue and shift the goal posts. The idea is to only report these kind of issues to create an endless stream of bug bounty money!
Buy my terrible font (ad): https://shop.liveoverflow.com
Learn hacking (ad): https://hextree.io
What is a vulnerability? https://www.youtube.com/watch?v=866olNIzbrk
hackerone reports:
https://hackerone.com/reports/812754
https://hackerone.com/reports/6883
https://hackerone.com/reports/223337
https://hackerone.com/reports/819930
https://hackerone.com/reports/224460
https://hackerone.com/reports/160109
https://hackerone.com/reports/557154
OWASP: https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks
Chapters:
00:00 - Intro
00:30 - Denial of Service...
https://www.youtube.com/watch?v=lr1KuL8OmJY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
October 12, 2023
https://www.youtube.com/shorts/1GbAFa_i-bk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Binary Exploitation vs. Web Security
Want to learn hacking? (ad) https://hextree.io
https://www.youtube.com/shorts/FbeaklEkMgM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Hacker Tweets Explained
Let me explain to you what you can learn from these tweets. Did you know the name trick?
Buy my terrible font (ad): https://shop.liveoverflow.com
Learn hacking (ad): https://hextree.io
Quote Tweet: https://twitter.com/avlidienbrunn/status/1697869590569582932
Original Tweet: https://twitter.com/Rhynorater/status/1696862832841916679
Critical Thinking Podcast: https://www.criticalthinkingpodcast.io/
XSS Origin Series: https://www.youtube.com/playlist?list=PLhixgUqwRTjyakFK7puB3fHVfXMinqMSi
Chapters:
00:00 - Intro
00:37 - Tweets About Tricky XSS
01:24 - XSS Testbed Setup with php
03:45 - Exploring the XSS Context
05:24 - The window Object
06:46 - Tweet 1: Justin's XSS Explained
08:22 - Tweet 2: Mathias's Variant With Object
09:52 - Tweet 2: Mathias's Variant Creating Class
10:30 - The window.name...
https://www.youtube.com/watch?v=3zShGLEqDn8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
401 Access Denied Ep88: The RISE of the CISO with Merike Kaeo
This week Joe Carson is joined by Merike Kaeo as they discuss the dynamic role of the CISO within an organization. They dive deeper into the role and how it interacts with different areas of the business, and what specific assets need protection and within what frameworks. An episode not to be missed!
Jump-start your cybersecurity career for FREE with Cybrary!
Follow us on Social!
~Cybrary Twitter
~Delinea Twitter
~Instagram
~Facebook
~YouTube
https://www.youtube.com/watch?v=FklaFGnBEyQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Zenbleed (CVE-2023-20593)
Let's explore the "most exciting" CPU vulnerability affecting Zen2 CPUs from AMD.
Watch part 1 about fuzzing: https://www.youtube.com/watch?v=neWc0H1k2Lc
buy my font (advertisement): https://shop.liveoverflow.com/
This video is sponsored by Google: https://security.googleblog.com/2023/08/downfall-and-zenbleed-googlers-helping.html
Original Zenbleed Writeup: https://lock.cmpxchg8b.com/zenbleed.html
Grab the code: https://github.com/google/security-research/tree/master/pocs/cpus/zenbleed
cvtsi2ss: https://www.felixcloutier.com/x86/cvtsi2ss.html
AMD Security Bulletin: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html
RIDL Video: https://www.youtube.com/watch?v=x_R1DeZxGc0
Tavis Ormandy: https://twitter.com/taviso
Chapters:
00:00 - Intro
02:27 - zenleak.asm Patterns
03:56...
https://www.youtube.com/watch?v=9EY_9KtxyPg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Intruder Alert Ep. 6 | Deconstructing Malware Attacks & Forging a Career in Cybersecurity
In this episode of Intruder Alert, Marcus Hutchins is joined by cybersecurity expert Caitlin Sarian, known for her role as the Global Lead of Cybersecurity Advocacy and Culture at TikTok and her expertise in data protection and privacy compliance. Marcus and Caitlin provide technical insight into the latest US malware attacks and share invaluable advice on breaking into the cybersecurity field.
Follow us on Social!!
~Twitter
~Instagram
~FaceBook
~YouTube
~LinkedIn
Jump-start your cybersecurity career for FREE with Cybrary!
https://www.youtube.com/watch?v=2aRgdmTdtK0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Is your favorite on here?? #favorite #cybersecurity #hacker
https://www.youtube.com/shorts/KPPH7vJZajQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
401 Access Denied: Protecting Society and the Role of CERT with Tonu
In this episode we join host Joe Carson as he discusses state cybersecurity with Tonu Tammer of the Estonian National Cybersecurity Center. Tonu goes into the day-to-day operations of defending a country and its citizens from adversaries, as well as ransomware and DDOS attacks. Come along for an in-depth discussion with a cyber defender with years of experience in this exciting new episode!
Jump-start your cybersecurity career for FREE with Cybrary!
Follow us on Social!
~Cybrary Twitter
~Delinea Twitter
~Instagram
~Facebook
~YouTube
https://www.youtube.com/watch?v=aYCyFDlK7vg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Intruder Alert Ep. 5 | Community Uprising: Unravelling the Reddit Blackout
In the latest episode of Intruder Alert, Marcus Hutchins and Cybrary blue teamer, Marc Balingit, delve into the the uproar around Reddit's blackout. They unravel the intricacies of Reddit's contentious API changes, which have cornered third-party apps like Apollo, sparking a sweeping blackout protest across thousands of subreddits. Furthermore, they explore the impact of Twitch's fresh policy adjustments, which are a threat to streamers' ad revenue, and other news impacting online communities.
Follow us on Social!!
~Twitter
~Instagram
~FaceBook
~YouTube
~LinkedIn
Jump-start your cybersecurity career for FREE with Cybrary!
https://www.youtube.com/watch?v=8_CEqpKU8AA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Trying to demo the #hacker side without getting 🤐🤐🤐 by the platform. Oops! #cybersecurity
https://www.youtube.com/shorts/p_OgaSkmBMM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
401 Access Denied: Ep. 85 | Key Takeaways from the Verizon DBIR with Tony Goulding
Join host Joseph Carson and guest Tony Goulding as they break down the annual Verizon breach report. With over 16,000 incidents and more than 5,200 data breaches, there's a lot to look at. Tony and Joe have some great takeaways from this critical annual report and share their expert insights on what's new, what's changed, and what we're not doing so bad at (hint: MFA goes a long way!)
Jump-start your cybersecurity career for FREE with Cybrary!
Follow us on Social!
~Cybrary Twitter
~Delinea Twitter
~Instagram
~Facebook
~YouTube
https://www.youtube.com/watch?v=luXnfWO_U7I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Hack you exe's phone? 😂 #podcast #cybersecurity
https://www.youtube.com/shorts/ufdeWuwsWaA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
401 Access Denied: Ep. 84 | The Best of RSAC & Cybersecurity Strategies with Bob Burns
RSAC was the place to be for cybersecurity in 2023, and Joe Carson is joined by Bob Burns to talk all about it. From the sessions that really resonated to the incredible human connections and networking, join Joe and Bob to deconstruct this year's most comprehensive conference. Were you at RSAC this year? Join us in the comments to let us know your favorite session!
Jump-start your cybersecurity career for FREE with Cybrary!
Follow us on Social!
~Cybrary Twitter
~Delinea Twitter
~Instagram
~Facebook
~YouTube
https://www.youtube.com/watch?v=qU40Yg7pfbo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
The AI Revolution with Diana Kelley | 401 Access Denied Podcast Ep. 83
The AI Revolution with Diana Kelley | 401 Access Denied Podcast Ep. 83
Join Us: https://www.cybrary.it/?utm_source=youtube&utm_medium=video&utm_campaign=the-ai-revolution-with-diana-kelley
Everybody's talking about it - the AI revolution is here. But given the rapid evolution in this field, it's hard to keep up with the sweeping effects this technology is causing. Luckily, Joe Carson is joined by longtime AI expert Diana Kelley to shed light on all of these changes. She addresses the many misconceptions and media misrepresentations surrounding AI, breaks down the different forms of this technology, and emphasizes the need for a better understanding of AI's capabilities and limitations. They also discuss the ethical and legal implications that will only become more potent as AI...
https://www.youtube.com/watch?v=ow9JszgoC1M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Hacking the Government with Bryan Seely | 401 Access Denied Podcast Ep. 82
Hacking the Government with Bryan Seely | 401 Access Denied Podcast Ep. 82
Join Us: https://www.cybrary.it/?utm_source=youtube&utm_medium=video&utm_campaign=hacking-the-government-with-bryan-seely
In this eye-opening episode, dive into the captivating world of cybercrime and social engineering with our host, Joe Carson, and special guest Bryan Seely! Bryan, a keynote speaker and cybersecurity expert best known for his Secret Service exposé, discusses his journey from a young computer enthusiast to a renowned public speaker. Join them as they investigate the mindset and techniques used by hackers, such as the use of aliases to deceive and manipulate their targets, as well as the importance of responsible disclosure and changing cybersecurity laws.
Follow us for exclusive updates:
~https://twitter.com/cybraryIT
~https://www.instagram.com/cybrary.it/
~https://www.facebook.com/cybraryit/
Follow...
https://www.youtube.com/watch?v=aagD2SxYUJM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)
Intruder Alert Ep. 4 | Unmasking The New Global Malware Threat On Android Devices
Head to Cybrary.it to open your free account and start learning today!
In this episode of Intruder Alert, join host Marcus Hutchins, world-renowned hacker, and red teamer Matt Mullins while they discuss the millions of devices recently infected with malware during production, and whether or not our devices are spying on us.
For more information on how to jumpstart your career with the most cutting-edge cybersecurity training, head over to Cybrary.it to create your free account and get started on your learning journey!
Make sure to subscribe so that you don't miss the latest new episodes, premiering live every two weeks, and dropping on YouTube On Demand.
https://www.youtube.com/watch?v=wc8T_RcwOkY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)