Les vidéos internationales du Jour Hacking, Cybersécurité, RGPD, Pentest, Bug Bounty

DEF CON 33 Voting Village - Risk Limiting Audits: What They Are and Aren't - Philip Stark
Risk-limiting audits (RLAs) limit the "risk" of certifying that the wrong candidates won. There are RLA methods for almost every type of political election in the US, including plurality, multiwinner plurality, supermajority, and instant-runoff voting. The latest RLA methods make it practical to audit every contest in every election, even in large jurisdictions with hundreds of contests. RLAs can "tie a bow around" a well-run election that uses trustworthy, organized methods to record and store votes. They cannot magically make a poorly run election trustworthy any more than fastening your seatbelt after an accident will prevent injury. Applying RLA procedures to an untrustworthy vote record is "security theater" that does not limit the risk of certifying the wrong winners.
https://www.youtube.com/watch?v=f-QuFskAyOM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - It's Not Safe Yet: Online Voting in Practice - Michael Specter

https://www.youtube.com/watch?v=g0GXWp4QmAs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - Is E2E Verifiability a Magic Bullet for Online Voting - John Odum
End-to-End-Verifiability (E2E-V) is a cryptographic paradigm that, as applied to voting systems, allows voters to independently verify that their votes were cast as intended, guaranteeing that votes were recorded as cast, and tallied as recorded. As such, it is being promoted to public officers and elected officials at the county and state levels as the “magic bullet” allowing for secure voting over the internet. This talk will present, in a relatively low-tech way, that E2E-V is irrelevant to some attacks – both to servers outside the cryptographic “loop,” and particularly to client-side systems. E2E-V-equipped voting systems are primarily vulnerable to client-side malware, which would still be free to alter or sabotage voting applications and devices. The talk will present...
https://www.youtube.com/watch?v=gMvNKsl65NA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 Voting Village - Dominion ICX Simple Hacks Daunting Recoveries - Springall, Davis, Marks
Using the Dominion touchscreen BMD debuted at Voting Village 2023, we will discuss and demonstrate in real-time how technically simple "hacks" to the ballot displayed on the voter's touchscreen can directly impact the vote count, or alternatively impact the voter's decisions. These simple “hacks” to the election definition (with no need to inject malware) include the manipulation of display of candidate choices, silent removal of candidates from the display, and using false instructions on the touchscreen to intentionally misinform voters regarding candidates or ballot questions. Furthermore, attempting to determine/recover from such hacks on the election outcomes can range from difficult to impossible. In addition to discussing the tactics and potential impacts, we will illuminate...
https://www.youtube.com/watch?v=gRU0-z1of2Y
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - CARVER Vuln Analysis & US Voting System - Moore, Young, Baggett
During World War II, the predecessor to the CIA, the Office of Strategic Services, developed a framework for the French Resistance to identify vulnerabilities in key German defenses and infrastructure. The framework, titled “CARVER” applies the following designations to enumerated components of complex systems: Criticality, Accessibility, Recepurability, Vulnerability, Effect, Recognizability. The same framework, viewed through a security framework, will highlight a system's strengths or weaknesses, depending on the analyst's tasking. This panel will examine voting systems in the context of the CARVER framework.
https://www.youtube.com/watch?v=rqMNllTo6wc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - "Fortress Island" Physical Security in Voting Systems - Drew Springall
Physical security has long been a core component of voting system defenses through the use of keyed locks and tamper-evident seals/tape/stickers. With procedural protections requiring their use, arbitrary voters are explicitly permitted to physically interact with these systems in a semi-private setting (voting booth) under the assumption that the hardware's attack surface can be sufficiently scoped to a set of intended, known-safe interactions (i.e. limit/prevent access to I/O interfaces, administrative controls, storage devices, etc.). Some have even cited these specific defenses as preexisting and sufficient mitigations for vulnerabilities in already-deployed voting system such that further remediation is not needed. Unfortunately, this assumption does not hold under scrutiny. This presentation...
https://www.youtube.com/watch?v=yvbe6n82f0I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - Regulatory Failures with Ballot Marking Devices - Marnie Mahoney
The most obvious, fundamental problem with Ballot Marking Devices is encoding voters' choices in images voters cannot read and tabulating from those images. Compounding BMD problems, these systems produce at least three distinct images of voters' selections: the choices in QR/bar code images, a printed text list purporting to show those encoded choices, and a ballot image produced by precinct scanners. These images and printed list may be subject to different possible
https://www.youtube.com/watch?v=y1zZtEm_rvk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - A Review of Post Election Audits in Swing States - Susan Greenhalgh
The presentation is based on a new paper that examines which elements of a post-election audit are necessary to provide publicly available evidence to confirm the outcome of an election is correct. The paper and presentation take a close look at the post-election audits conducted after the 2024 election in the seven closely contested swing states and examines whether or not the audits conducted after the November election meet the criteria for effective, trustworthy, meaningful, and reliable audits.
https://www.youtube.com/watch?v=5mWnGZWUEMQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 -Voting Village - Protecting Election Researchers Globally - Miracle Owolabi
Across the world, ethical hackers and researchers working to improve election security often operate in legal gray zones. While the U.S. has seen high-profile efforts around voting machine testing, post-election audits, and researcher collaboration, many countries in the Global South still criminalize or discourage independent security testing even when it aims to protect democracy. This talk explores the legal and institutional risks faced by election security researchers in countries like Nigeria, where old cybercrime laws, state distrust, and political retaliation pose real threats. I'll compare legal environments in the U.S. and emerging democracies, highlighting how Nigeria's laws suppress the same practices that once exposed major flaws in U.S. voting systems. Through case studies...
https://www.youtube.com/watch?v=5qmpv44knF8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - When the Paper Trail Leads Nowhere - Ian Patton
In the March 2020 'Super Tuesday' Primary Election, LA County debuted its brand new, 0 million, bespoke, Smartmatic-contracted VSAP (Voting Solutions for All People) voting system. Before the night was over, the Bernie Sanders presidential campaign had already filed suit (due to multiple technology failures resulting in hours-long lines). That election night proved to be illustrative of the myriad problems with VSAP, including numerous security vulnerabilities. These were compounded by the failure to fulfill a much-ballyhooed commitment by the County to open source the code. Perhaps the most significant failing was only revealed weeks later after the machine count had finally been completed. A knife's edge result in LA County's second largest city, Long Beach, for a local ballot measure,...
https://www.youtube.com/watch?v=URWjVRUDNiI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village- Evidence Based Elections and Software Independence - Ron Rivest
"Software Independence" and "evidence-based elections" are two election security concepts that emerged in the aftermath of the Top-to-Bottom Review. Prof. Rivest explains these two fundamental notion and how they can apply practically to dramatically strengthen election security.
https://www.youtube.com/watch?v=8rIM5aTApKo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - History and Significance of the TTBR and PEASWG - Debra Bowen
In the wake of several alarming studies of election system security, and the improper installation of uncertified voting software in California jurisdictions in the 2000s, then-California Secretary of State Debra Bowen conducted a ground-breaking and seminal Top-to-Bottom Review (TTBR) of the voting equipment in use in the state. The review involved top computer security researchers, attorneys and accessibility experts, and provided the nation with an unprecedented view into the state of voting machines. The TTBR led to critical changes to improve California's elections and influenced other states to move away from the most insecure voting systems. In 2008, Bowen was awarded the JFK Profile in Courage award for her work. This keynote talk will provide an overview of the TTBR, its findings,...
https://www.youtube.com/watch?v=F_Xz9rMgWzE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - When Insiders Are the Threat - Burbank, Greenhalgh, Marks, Jefferson
Recent news accounts have reported that representatives of the Trump administration are seeking extralegal access to voting equipment. This latest effort mirrors a multi-state scheme, carried out from 2020-2022, by allies of Donald Trump that successfully accessed voting machines in Colorado, Georgia, Michigan, and Pennsylvania and obtained copies of the voting system software. This discussion will outline what is known about multistate plot, what we know (and don't know) about the status and the purloined software, and what this could mean for elections in the future.
https://www.youtube.com/watch?v=OyUNja7QSv8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 - Voting Village - DMCA Security Research Exemption and Election Security - Tori Noble
This talk discusses a particular feature of the Digital Millennium Copyright Act (DMCA) that give a specific exemption for good faith security research on voting systems. This feature of the law is what allows work probing election systems, such as we do at the DEF CON Voting Village, to continue.
https://www.youtube.com/watch?v=XVJd08ehNs4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEF CON 33 Voting Village - Welcome and Introductions
Introduction to the Voting Village and the Symposium
https://www.youtube.com/watch?v=YBcJEiP_k7k
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Soutenez No Hack Me sur Tipeee

L'Actu de la veille

This Hacker Made Over ,000 Hacking AI
Signup for the GraySwan Academy 👉🏼 https://app.grayswan.ai/arena LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023...
https://www.youtube.com/watch?v=xy1vQOHGQQY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

IDA Free Reverse Engineering - Step-by-Step EXE Analysis
Step-by-step reverse engineering tutorial with IDA Free covering decompiling, types, enums, function definitions, and naming for EXEs. Sample can be found on unpac.me 7b5b060d9013725413f3f77719d0881035246b281e18005c0040e78a32e1c6cc Full tutorial series on the OALABS Patreon https://www.patreon.com/collection/1259251?view=expanded
https://www.youtube.com/watch?v=u1ZEh3bb6h4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

L'Actu à J-2

Build Your First OSINT Bookmarklet in 5 Minutes
Big thanks to Brilliant for sponsoring this video. To try everything Brilliant has to offer, visit https://brilliant.org/davidbombal or scan the QR code onscreen - You'll also get 20% off and annual premium subscription Two veteran OSINT investigators show how they pull hidden data from TikTok, Telegram, X, Cash App and WordPress using simple browser bookmarklets. No malware, no exploits, just JavaScript in your browser. They also show how to build these tools with AI in minutes, even if you can't code, and how to stay safe with sock puppets, VMs and VPNs. Timestamps below. // Affiliate LINKS // Get 10% off our All OSINT Course Bundle and our OSINT Immersion Bundle by using the Coupon Code: bombal-mot-10  Bundle links and descriptions are https://www.myosint.training/pages/bundles  //...
https://www.youtube.com/watch?v=-nQWos7H1LQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

L'Actu des jours précédents

Would You Write Your Passwords in a Book?
Big thank you to DeleteMe for sponsoring this video. Use my link http://joindeleteme.com/Bombal to receive a 20% discount or use the QR Code in the video. Should you ever keep passwords in a notebook? In this video we compare a paper logbook with a password manager, look at real threat models, and outline when each choice makes sense. We cover physical risks, theft, loss, phishing, cloud leaks, recovery, and 2FA. You will learn a safe offline workflow for non-technical family members, how to store and hide a paper logbook, and when to prefer a password manager with strong 2FA, backups, and emergency access. Clear, practical steps to improve security without adding friction. // David's SOCIAL // Discord: https://discord.com/invite/usKSyzb X: https://www.twitter.com/davidbombal Instagram:...
https://www.youtube.com/watch?v=ikkA3EMI3vc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How Hackers Become Admin (they just ask)
https://jh.live/panther || Take control of your security operations with Panther! You can ditch legacy SIEMs and embrace an AI-driven, autonomous and engineer-first SOC platform and solution: https://jh.live/panther Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training See what else I'm up to with: https://jh.live/newsletter ℹ️ Affiliates: Learn how to code with CodeCrafters: https://jh.live/codecrafters Host your own VPN with OpenVPN: https://jh.live/openvpn Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=JpWbytYrL2s
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Hidden Product Activation and Serial Keygen - "Ultimate Calculator 3000" [Rev/Web Challenge]
🚩 Video walkthrough for the "Ultimate Calculator 3000" (rev/web) challenge I created and hosted on my website (https://cryptocat.me). Players had to locate a hidden validator routine inside the calculator binary, uncover a secondary HTTP service, and obtain the support team's offline validation tool. Reversing the Go binary exposed an HMAC-based serial check, allowing crafted serials to pass verification and reveal the flag 😎 #CTF #Challenge #CryptoCat Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/monthly/cryptocat/ultimate_calculator Join discord for source code and early access to future challenges: https://discord.cryptocat.me 🐛CryptoCat CTF Challenges🐞 https://challenge.cryptocat.me - https://discord.gg/qHbAN3wfRK 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00...
https://www.youtube.com/watch?v=lRJno96za5A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

AWS Went Down - What Happened? Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️ @endingwithali → Twitch: https://twitch.tv/endingwithali Twitter: https://twitter.com/endingwithali YouTube: https://youtube.com/@endingwithali Everywhere else: https://links.ali.dev Want to work with Ali? endingwithalicollabs@gmail.com [❗] Join the Patreon→ https://patreon.com/threatwire 00:00 0 - Intro 00:12 1 - How AWS Failed 04:15 2 - Court Tells NSO Group To Stop 06:04 3 - OpenAI Browser Already Vulnerable 07:30 4 - Outro LINKS 🔗 Story 1: How AWS Failed https://aws.amazon.com/message/101925/ https://health.aws.amazon.com/health/status?eventID=arn:aws:health:us-east-1::event/MULTIPLE_SERVICES/AWS_MULTIPLE_SERVICES_OPERATIONAL_ISSUE/AWS_MULTIPLE_SERVICES_OPERATIONAL_ISSUE_BA540_514A652BE1A 🔗 Story 2: Court Tells NSO...
https://www.youtube.com/watch?v=RMwUOJM7kPM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Will AI Music Replace Human Artists?
Belgian retailers are switching to royalty-free AI music to cut costs and tailor in-store ads. What does this mean for musicians, shoppers, and the future of retail soundscapes? // David's SOCIAL // Discord: https://discord.com/invite/usKSyzb X: https://www.twitter.com/davidbombal Instagram: https://www.instagram.com/davidbombal LinkedIn: https://www.linkedin.com/in/davidbombal Facebook: https://www.facebook.com/davidbombal.co TikTok: http://tiktok.com/@davidbombal YouTube: https://www.youtube.com/@davidbombal Spotify: https://open.spotify.com/show/3f6k6gERfuriI96efWWLQQ SoundCloud: https://soundcloud.com/davidbombal Apple Podcast: https://podcasts.apple.com/us/podcast/david-bombal/id1466865532 // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested...
https://www.youtube.com/watch?v=BK2-cIJ6k6U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

No Code Bug Bounty Automation Using n8n
Sign up for Hostinger's Black Friday Sale 👉 https://hostinger.com/nahamsec gland get 10% off using the code nahamsec LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in...
https://www.youtube.com/watch?v=PemrRgzckVE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The Easy Way to Analyze Linux Memory
In this episode, we'll take a look at a quick and easy way to find the Intermediate Symbol File (ISF) for the Linux memory image you're analyzing. This method will save you time and help streamline your memory analysis workflow. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:37 - Demo 🛠 Resources Abyss-W4tcher ISFs: https://github.com/Abyss-W4tcher/volatility3-symbols leludo84 ISFs: https://github.com/leludo84/vol3-linux-profiles #Forensics #DigitalForensics #DFIR #ComputerForensics #LinuxForensics
https://www.youtube.com/watch?v=W40gdWNdwUI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Cybersecurity Awareness for Hackers! with Huntress and Just Hacking Training
Cybersecurity Awareness for Hackers! Practical education livestream with Huntress and Just Hacking Training, Friday October 24th at 10am Pacific / 1pm Eastern Time
https://www.youtube.com/watch?v=u6QLuJy1FHw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Framework Computer Users Are At Risk! - Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️ @endingwithali → Twitch: https://twitch.tv/endingwithali Twitter: https://twitter.com/endingwithali YouTube: https://youtube.com/@endingwithali Everywhere else: https://links.ali.dev Want to work with Ali? endingwithalicollabs@gmail.com [❗] Join the Patreon→ https://patreon.com/threatwire 00:00 0 - Intro 00:12 1 - What Brought AWS Down? 01:59 2 - Apple Increasing Bounty Payouts 03:44 3 - Framework Vulnerability Is In Production 05:17 4 - Outro LINKS 🔗 Story 1: What Brought AWS Down? https://www.theverge.com/news/802486/aws-outage-alexa-fortnite-snapchat-offline https://techcrunch.com/2025/10/20/amazon-dns-outage-breaks-much-of-the-internet/ https://health.aws.amazon.com/health/status 🔗 Story 2: Apple Increasing Bounty...
https://www.youtube.com/watch?v=S5Rspg1Pzwg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Stay Ahead of Ransomware - Ransomware and Cyber Extortion on the Rise in the Cloud
Ransomware and cyber extortion are running rampant in all parts of the security realm. Unfortunately, this includes within cloud-based environments. While many organizations are bracing themselves for endpoint-based impact, many are ignoring their cloud environments. What does ransomware and/or cyber extortion look like in the cloud? What examples have we seen? What can YOU do to better protect your cloud environment from being impacted by these threats? Join us on this month's Stay Ahead of Ransomware livestream as we talk about this matter with cloud expert Megan Roddie-Fonseca, co-author of FOR509: Enterprise Cloud Forensics and Incident Response. You won't want to miss this one!
https://www.youtube.com/watch?v=RU7sFz8BeUc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Are These The Best Hacking Tools for 2026?
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=l5zrNrNEJoA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Black Hat | Connect. Learn. Lead in Cybersecurity
Since 1997, Black Hat has been the global stage for cutting-edge cybersecurity. With events across the US, Europe, Asia, the Middle East & Africa, and Canada, we bring together top minds to share the latest research, trends, and innovations. Whether you're a seasoned pro, a rising talent, or a tech innovator—Black Hat delivers: • Expert-led Briefings & Trainings, handpicked by our independent Black Hat Review Board • Networking with thousands of security professionals • The latest Arsenal tools in our Business Hall • Career connections & exclusive Summits Join the community shaping cybersecurity's next chapter. 🔗 blackhat.com #BlackHat #Cybersecurity #Cybersecurity #TechConference #BHEU #BHUSA #BHASIA #Sectorca #BlackHatTrainings
https://www.youtube.com/watch?v=2G9dyPgnOUM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Hackers Bruteforce Passwords to Microsoft Online
https://jh.live/flare || Get the new Entra ID integration for Identity Exposure Management to keep your business accounts protected with Flare! Try a free trial and see what info is out there: https://jh.live/flare https://github.com/openbullet/OpenBullet2 https://github.com/dafthack/MSOLSpray https://github.com/dunderhay/entraspray https://www.forbes.com/sites/daveywinder/2025/04/30/microsoft-confirms-password-spraying-attack---what-you-need-to-know/ https://www.bleepingcomputer.com/news/security/password-spraying-attacks-target-80-000-microsoft-entra-id-accounts/ https://thehackernews.com/2025/06/over-80000-microsoft-entra-id-accounts.html https://www.scworld.com/brief/teamfiltration-pentesting-tool-harnessed-in-global-microsoft-entra-id-attack-campaign https://github.com/Flangvik/TeamFiltration https://x.com/Flangvik https://x.com/Flangvik/status/1973076462883176525 https://github.com/ustayready/fireprox https://blog.zsec.uk/omniprox/ https://github.com/ZephrFish/OmniProx https://github.com/synacktiv/IPSpinner https://www.torproject.org/ Learn...
https://www.youtube.com/watch?v=oWv50EF0juc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

when you change your password, it's already stolen
https://jh.live/specops-yt || Protect your organization with stronger passwords, and continuously scan and block over FOUR BILLION breached passwords with Specops Software! https://jh.live/specops-yt mubix's blog post: "Stealing passwords every time they change" https://malicious.link/posts/2013/2013-09-11-stealing-passwords-every-time-they-change/ (I was mistakenly not reading out of the original post on his own blog website -- I'm sorry! This is the page that I was on: https://blog.carnal0wnage.com/2013/09/stealing-passwords-every-time-they.html ) https://attack.mitre.org/techniques/T1556/002/ Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training See what else I'm up to with: https://jh.live/newsletter ℹ️ Affiliates: Learn how to code with CodeCrafters:...
https://www.youtube.com/watch?v=DhP2Hw-6DgY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

BreachForums is Down Again - Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️ @endingwithali → Twitch: https://twitch.tv/endingwithali Twitter: https://twitter.com/endingwithali YouTube: https://youtube.com/@endingwithali Everywhere else: https://links.ali.dev Want to work with Ali? endingwithalicollabs@gmail.com [❗] Join the Patreon→ https://patreon.com/threatwire 00:00 0 - Intro 00:10 1 - Discord Leak is Bigger Than Expected 01:22 2 - LLM Poisoning Is Actually Easy 03:24 3 - BreachForums is Down Again 03:554 4 - Outro LINKS 🔗 Story 1: Discord Leak is Bigger Than Expected https://www.bleepingcomputer.com/news/security/discord-discloses-data-breach-after-hackers-steal-support-tickets/ https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service https://arstechnica.com/security/2025/10/discord-says-hackers-stole-government-ids-of-70000-users/ 🔗...
https://www.youtube.com/watch?v=7rg46Z6ZwCc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Learn Hardware Hacking!
Just Hacking Training livestream with Trevor Stevado, Wednesday October 15th at 9am Pacific / 12pm Eastern.
https://www.youtube.com/watch?v=F1Ll6TKMfxA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The AI Black Box Problem - [Latent Space Exploration]
Latent space exploration. Created from multiple sources using NotebookLM.
https://www.youtube.com/watch?v=HfCUbauGUNs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Script-Based Malware Analysis!
Just Hacking Training Livestream week! Tuesday, October 14 at 9am Pacific / 12:00pm Eastern
https://www.youtube.com/watch?v=g2sWZvBdmrg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

AI Ethics That Work: Privacy, Fairness & Security
How do we build AI security that is ethical, resilient, and trustworthy without turning “ethics” into a checkbox? Host Jason Firch sits down with Tom Vazdar (Chief AI Officer, PurpleSec) and Josh Salvage (CTO, PurpleSec) to unpack the real-world tensions between privacy, fairness, explainability, regulation, human oversight, and adversarial threats. If you're a security leader, engineer, or business decision-maker, this conversation will help you separate PR from practice and design AI systems that respect rights, dignity, and safety—while staying practical for SMBs and enterprises alike. 🔒 Secure Your LLMs With PromptShield™ --------------------------------------------------------------- Sitting between users and your AI models, PromptShield™ detects, blocks, and educates...
https://www.youtube.com/watch?v=lsZ0h4_b5T0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

hacking copilot AI (with Tobias Diehl)
Check out Tobias' full DEFCON talk: https://www.youtube.com/watch?v=NgjyBKfqJEs Tobias' LinkedIn: https://www.linkedin.com/in/tobias-diehl-19ba901b5/ Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training See what else I'm up to with: https://jh.live/newsletter ℹ️ Affiliates: Learn how to code with CodeCrafters: https://jh.live/codecrafters Host your own VPN with OpenVPN: https://jh.live/openvpn Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=r14c5jP-51A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Learn OSINT!
Learn OSINT! Live and in-person training during Bsides Chicago -- JHT livestream with Mishaal Khan, Monday October 13th at 9am PT | 12pm ET.
https://www.youtube.com/watch?v=ykAD-NvtAio
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Regex for Hackers (with Python)
https://hhub.io/jhregex || Check out the Regex for Hackers course on Hacking Hub! Code JHREGEX takes 50% off 😎 https://hhub.io/jhregex Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training See what else I'm up to with: https://jh.live/newsletter ℹ️ Affiliates: Learn how to code with CodeCrafters: https://jh.live/codecrafters Host your own VPN with OpenVPN: https://jh.live/openvpn Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=VRFvB62Mr84
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

This Hackers Hacked, Tracked & Unlocked Every Subaru
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=7D_n3epvO_w
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Global Board of Directors - September 2025
Minutes here: Managed by the OWASP® Foundation https://owasp.org/
https://www.youtube.com/watch?v=voziHgnXMps
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

JHT Anniversary Party!
JHT Anniversary Party! and BsidesChicago LIVE Training Preview livestream on October 9th, 2025 at 9am PT / 12pm ET
https://www.youtube.com/watch?v=j5KfwAk8ww4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Stay Ahead of Ransomware: Proper Incident Containment… and Horror Stories
Ransomware is a scourge on our computing lives that can strike at any time. But what do you do first upon identifying a potential ransomware incident? What processes should you engage quickly? When it comes to containment, what do you need to have processes in place for? Where and how might you need to act quickly? What about preservation and collection of data? Do you currently have a technical process in place for increasing your data retention immediately? How about data collection and acquisition? Do you have a process and the technical means in place? If the above doesn't happen quickly and efficiently, what might happen? Join us for this month's episode in which we cover these topics and more with Eric Taylor, Owner and Chief Forensics Operator with Barricade Cyber Solutions. Eric...
https://www.youtube.com/watch?v=S8mOvwCo7K0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

AI Security Frameworks: Must-Know Challenges & Solutions For 2025
Uncover the biggest challenges organizations face in implementing AI security frameworks and explore expert solutions to stay ahead in 2025! Join Security Beyond The Checkbox host Jason Firch, alongside PurpleSec's Chief AI Officer Tom Vazdar, and CTO Joshua Selvidge, as they break down the essentials of securing AI systems. From cloud-based deployments to zero trust models, learn how to protect critical infrastructure like hospitals and banks from emerging threats like data poisoning and model manipulation. Discover why frameworks like ISO 42001 and NIST AI RMF are vital for governance, ethics, and robust security. Gain insights into the importance of industry-academia-policy collaboration to strengthen AI security standards. 🔒 Secure Your LLMs With PromptShield™ --------------------------------------------------------------- Sitting...
https://www.youtube.com/watch?v=UJ7FFF33kik
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

a hacker's new website
https://jh.live/keeper-ai || Check out Keeper AI to help lock down your privileged sessions, and see everything that Keeper has to offer! https://jh.live/keeper-ai PS, contributing a ClickFix technique is SUPER EASY, don't even need YAML -- click "Contribute Technique": https://clickgrab.streamlit.app/ https://mhaggis.github.io/ClickGrab/ https://github.com/MHaggis/ClickGrab/ https://clickfix-wiki.github.io/ (https://clickfix.wiki) https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/ Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training See what else I'm up to with: https://jh.live/newsletter ℹ️ Affiliates: Learn how to code with CodeCrafters: https://jh.live/codecrafters Host...
https://www.youtube.com/watch?v=UQqsaO5k2M0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

ISACA's New AI Security Certification: Is It Worth It? | Keatron Evans & Kirsten Lora
— Learn about ISACA AAISM training: https://www.infosecinstitute.com/courses/aaism-boot-camp/?utm_source=youtube&utm_medium=video&utm_campaign=aaism — View course dates: https://www.infosecinstitute.com/courses/schedule/?Boot%20camps=ISACA+Advanced+in+AI+Security+Management+(AAISM)+Training+Boot+Camp&utm_source=youtube&utm_medium=video&utm_campaign=aaism — Download ISACA AI Policy Template: https://www.infosecinstitute.com/globalassets/downloads/isaca-ai-acceptable-use-policy.pdf One in four CISOs has already experienced an AI-generated attack this year. Even more concerning? IBM's 2025 research found 63% of breached organizations had no AI policies in place — leaving them exposed to attacks that now cost U.S. organizations an average of .2 million. Enter...
https://www.youtube.com/watch?v=hj95VpIePCc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

A ,000 Remote Code Execution (Walkthrough)
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=ajax3D60diU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Learn API Hacking with InsiderPhD!
Learn API Hacking! Just Hacking Training Livestream with Katie Paxton-Fear (InsiderPhD) on Friday, October 3rd, 2025 at 1:00pm Eastern Time.
https://www.youtube.com/watch?v=rE3gN9tENTo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Spy Device Farm Found In New York City - Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️ @endingwithali → Twitch: https://twitch.tv/endingwithali Twitter: https://twitter.com/endingwithali YouTube: https://youtube.com/@endingwithali Everywhere else: https://links.ali.dev Want to work with Ali? endingwithalicollabs@gmail.com [❗] Join the Patreon→ https://patreon.com/threatwire 00:00 0 - Intro 00:12 1 - GitHub Could Get Banned In Australia 01:40 2 - Cisco CVE With No Work Around 02:47 3 - Threat Actors Found In New York City 03:48 4 - Malicious MCP Servers Are Here 05:15 5 - Outro LINKS 🔗 Story 1: GitHub Could Get Banned In Australia https://www.abc.net.au/news/2025-09-24/digital-dilemna-social-media-age-ban-platforms/105807302 https://cybernews.com/news/australia-github-age-restriction-kids-protection/ https://www.theregister.com/2025/09/25/australia_social_media_ban_github/ 🔗...
https://www.youtube.com/watch?v=NFF801fc5xY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

reverse engineering doesn't have to be hard
https://jh.live/hex-rays || Disassemble, decompile and debug with IDA Pro! Use promo code HAMMOND50 for 50% off any IDA Pro product (license discount is only applicable to individuals for any product, not corporations https://hex-rays.com/pricing) and code HAMMOND30 for 30% off any IDA Pro online training https://hex-rays.com/training. Offer expires one year after video release date. Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training See what else I'm up to with: https://jh.live/newsletter ℹ️ Affiliates: Learn how to code with CodeCrafters: https://jh.live/codecrafters Host your own VPN with OpenVPN: https://jh.live/openvpn Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
https://www.youtube.com/watch?v=4-7zcq5-cNA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

new capture the flag (hacking competition)
https://ctf.huntress.com/
https://www.youtube.com/watch?v=rfP_6Ieczek
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Shadow AI: The Silent Cybersecurity Threat Businesses Can't Ignore
In this episode of Security Beyond the Checkbox, host Jason Firch sits down with PurpleSec's Chief AI Officer Tom Vazdar, and CTO Joshua Selvidge to unpack Shadow AI, which is the unauthorized use of AI tools like ChatGPT that mirrors the risks of Shadow IT. As SMBs grapple with emerging threats like ransomware and phishing, Shadow AI is exploding due to its easy access and massive productivity gains, but it brings serious dangers if left unchecked. We dive into why employees turn to these tools (often non-maliciously) to boost efficiency, and the real risks: data leaks, intellectual property theft, regulatory violations under GDPR or HIPAA, and reputational harm. Hear real-world examples, including Samsung's ban on ChatGPT after engineers leaked proprietary code, and Air Canada's chatbot...
https://www.youtube.com/watch?v=MLUBbgReax8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Detecting AI Deception: How to Identify Deepfakes, Voice clones & AI Scams | Free Toolkit
— Get your free toolkit: https://www.infosecinstitute.com/form/digital-detective-campaign-kit/?utm_source=youtube&utm_medium=video&utm_campaign=cam Dive into the alarming rise of AI-enabled cyber attacks, including the jaw-dropping .6 million deepfake scam that fooled a finance worker in Hong Kong. Learn how criminals are using AI to create convincing video calls, voice clones and fake content to infiltrate organizations. This webinar arms you with practical detection techniques and introduces Infosec's free Digital Detective Toolkit — perfect for Cybersecurity Awareness Month and beyond. Featuring insights from cybersecurity expert Keatron Evans, you'll discover the telltale signs of AI-generated videos, audio, images and text that could save your organization from devastating...
https://www.youtube.com/watch?v=cXYDNma-bD4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The ByzRP Solution: A Global Operational Shield for RPKI Validators
The Border Gateway Protocol (BGP) is the core routing protocol on the Internet, but it lacks security mechanisms. At the same time, the democratization of access has transformed the Internet into the default platform, where global services and communications happen. As a result, routing security quickly became an issue of great economic and national security concern. The US Federal Communications Commission and the White House Office of the National Cyber Director formally recognized the urgent need to invest more on protecting Internet routing, and standardize efficient security protocols. The Resource Public Key Infrastructure (RPKI) protocol is rapidly becoming the global standard for enforcing Internet routing security for BGP. It currently covers over 50% of IPv4 and IPv6 prefixes and...
https://www.youtube.com/watch?v=3eZ0VEMgEUg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Dismantling the SEOS Protocol
In this talk, we present the first open source implementation of HID SEOS communication protocol over RFID. HID SEOS is a credential technology designed to provide enhanced security, flexibility, and convenience for access control and identity management applications. It's currently the leading access control solution for HID Global and is widely used in corporate, educational, healthcare, and government settings. The documentation for this card technology is not publicly available so no previous open source implementation exists. We will demonstrate how it works and give insights in our process of making this project happen. The source code has been incorporated into the Proxmark3 project. By: Iceman | Co-Founder, AuroraSec, RRG Adam (evildaemond) Foster | Senior Penetration Tester,...
https://www.youtube.com/watch?v=mnhGx1i6x08
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Is BurpAI Going to Replace Me?
Learn about BurpAI here 👉🏼 https://shorturl.at/QdSuA LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to...
https://www.youtube.com/watch?v=8ox3s15n-Yc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The Drone Supply Chain's Grand Siege: From Initial Breaches to Long-Term Espionage
The Drone Supply Chain's Grand Siege: From Initial Breaches to Long-Term Espionage on High-Value Targets In mid-2024, we disclosed a cyber campaign named TIDRONE, attributed to an unidentified threat actor likely linked to Chinese-speaking groups. This campaign revealed a strong focus on the military industry, specifically targeting drone manufacturers in Taiwan. Further investigation led to the identification of a related campaign, VENOM, attributed to the cyberespionage group Earth Ammit, which targets military-related industries in Eastern Asia. Since 2022, the VENOM campaign demonstrated Earth Ammit's supply-chain attack strategy, focusing initially on service providers as an entry point to their ultimate targets. This campaign prefers applying shared tools, making attribution difficult,...
https://www.youtube.com/watch?v=c9SAHP92niA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Using Deep Learning Attribution Methods for Fault Injection Attacks
I Have Got to Warn You, It Is a Learning Robot: Using Deep Learning Attribution Methods for Fault Injection Attacks Deep Learning (DL) has recently received significant attention in breaking cryptographic implementations on embedded systems. However, research on the subject mostly focused on side-channel attacks (SCAs). In this talk, we present for the first time the use of DL attribution methods used for image processing as a reverse engineering tool for fault injection (FI). We present a practical example in the case of attacking a secure EEPROM (Analog Devices DeepCover DS28C36) in black box approach. We collect power consumption traces from the chip while the read memory command is executed. This acquisition is performed when the EEPROM is protected and unprotected. Then, we deliver...
https://www.youtube.com/watch?v=cjQIvLHUEws
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Impostor Syndrome - Hacking Apple MDMs Using Rogue Device Enrolments
Apple's solution for mobile device management seems like an airtight process. Enterprise customers buy devices from registered retailers, these are automatically registered in Apple Business Manager which in turn integrates seamlessly with the customer's choice of MDM platform. A company can have devices set up and shipped to remote employees without ever touching them. With many seemingly airtight systems, the devil is in the details. How do all these systems fit together? How do they authenticate each other? And most importantly who is responsible for security? This talk will focus on the gaps between the systems and how an attacker can leverage those to compromise enterprise customers. We will reverse engineer the enrolment process in MacOS, bypass security controls, build rogue machines...
https://www.youtube.com/watch?v=qFxBneMlYZQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Keynote: Perspectives on Trust in Hardware Supply Chains
Hardware is born of supply chains - an opaque global network of agents, each working to optimize their local gains. In this talk, bunnie shares some of his experiences navigating the shady underbelly of hardware supply chains. These experiences inform us of important practical differences between securing software and hardware supply chains. We'll wrap up by distilling these experiences into a classification system that anyone can use to establish a grounded perspective on trust in hardware. Open to all Black Hat Pass Holders. By: Bunnie Huang | Founder, Bunnie Studios Full Abstract Available: https://www.blackhat.com/asia-25/briefings/schedule/#keynote-perspectives-on-trust-in-hardware-supply-chains-44613
https://www.youtube.com/watch?v=Nv92TuocnwA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Operation BlackEcho: Voice Phishing Using Fake Financial and Vaccine Apps
Voice phishing (a.k.a. vishing) is a crime in which scammers deceive victims through phone calls in order to fraudulently obtain funds or steal personal information. Malicious apps are needed for voice phishing attacks targeting smartphone users. These apps intercept and block phone calls, and tamper with call screens and call logs. We have identified an attack group that uses malicious apps disguised as financial and vaccine apps for voice phishing. We estimated that the group has been active since late 2021. The attack group lures victims through ads or text messages about low-interest loans or government subsidies. If victims take the bait, the group distributes the 1st malicious app disguised as a financial app. The 1st app installs a 2nd malicious app disguised as a vaccine app and steals...
https://www.youtube.com/watch?v=VV0Ht_5YDUg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Should We Chat, Too? Security Analysis of WeChat's MMTLS Encryption Protocol
WeChat, with over 1.2 billion monthly active users, stands as the most popular messaging and social media platform in China and third globally. Instead of TLS, WeChat mainly uses a proprietary network encryption protocol called "MMTLS". We performed the first public analysis of the security and privacy properties of MMTLS and found it to be a modified version of TLS 1.3, with many of the modifications that WeChat developers made to the cryptography introducing weaknesses. We also discovered a second layer of encryption inside MMTLS which we refer to as "Business-layer encryption". We analyzed the security and privacy of Business-layer encryption and found serious issues including metadata leak, forgeable integrity check signatures, potential AES-CBC padding oracle and Key, IV re-use in block...
https://www.youtube.com/watch?v=i98Ce4NhjhA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Brother Printer Vulnerabilities Explained - Info Leak, Auth Bypass, Buffer Overflow, SSRF, DoS
🖨 Print Scan Hacks: Multiple vulnerabilities were identified across various Brother devices by Stephen Fewer ( @OfficialRapid7 ) 🔬 In this video, we'll analyse the zero-day research whitepaper and review the 8 vulnerabilities/exploits (CVE-2024-51977 through CVE-2024-51984) that were disclosed. Topics covered include info leak, remote auth bypass, buffer overflow, SSRF, DoS and credential exposure. Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #Vulnerability #Research #OffSec 🐛Brother Printer Vulnerability Research🐞 Blog: https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed Whitepaper: https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf Exploits:...
https://www.youtube.com/watch?v=--SaQKmcyiU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

This Is Now The Largest Supply Chain Attack of All Time - Threat Wire
⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️ @endingwithali → Twitch: https://twitch.tv/endingwithali Twitter: https://twitter.com/endingwithali YouTube: https://youtube.com/@endingwithali Everywhere else: https://links.ali.dev Want to work with Ali? endingwithalicollabs@gmail.com [❗] Join the Patreon→ https://patreon.com/threatwire 00:00 0 - Intro 00:11 1 - Cryptodrainer Found In Steam Game 01:18 2 - Google SEO Continues To Be Exploited 02:28 3 - NPM Worm Update 03:22 4 - Outro4 LINKS4 🔗 Story 1: Cryptodrainer Found In Steam Game https://www.bleepingcomputer.com/news/security/verified-steam-game-steals-streamers-cancer-treatment-donations/ https://docs.google.com/document/d/1vI4uKIYLl5iw6k1gspG4KY1JOoMIBGC1B6drPHmIZic/edit?tab=t.0#heading=h.u52snj6f3ie3 🔗 Story...
https://www.youtube.com/watch?v=CThsLuUYsE4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Who Cares Where Waldo Is. Locating macOS Users Without Their Consent
Where is Waldo? You've probably experienced how challenging it can be to spot him in the popular illustrations shared on social media. But is determining a macOS user's location just as difficult? This presentation will demonstrate that it's surprisingly easy. We'll begin by exploring the macOS privacy framework, focusing on why location services are treated as a distinct privacy subsystem. The talk will delve into how location permissions are stored on macOS and examine architectural weaknesses in the location database. We'll also discuss the attack surface of location services, side-channel attacks, and techniques for obtaining non-precise location data. Building on this foundation, I will share insights into my previous and newly discovered vulnerabilities that lead to precise location...
https://www.youtube.com/watch?v=vNVYDr-rxyQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

One Bug to Rule Them All: Stably Exploiting a Preauth RCE Vulnerability on Windows Server 2025
As the security protection mechanisms of the Windows operating system are constantly being proposed and applied, it is becoming increasingly difficult to find exploitable vulnerabilities on current Windows, especially vulnerabilities that can cause preauth 0-click RCE. But, is there really no such vulnerabilities? A few months ago, we conducted an in-depth analysis of the Windows Remote Desktop Services and we found several Preauth RCE vulnerabilities in the Remote Desktop Licensing Service, some of them will lead to unauthenticated non-sandboxed 0-click RCE. In this talk, we will explore the attack surface of the Remote Desktop Licensing Service, focusing on the newly identified vulnerability, CVE-2024-38077, which impacts all versions of Windows Server from 2003 to 2025. Despite Microsoft's...
https://www.youtube.com/watch?v=CLLCcfqsuD4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

A Journey into Advanced Theoretical Reverse Engineering
Unveiling the Mysteries of Qualcomm's QDSP6 JTAG: A Journey into Advanced Theoretical Reverse Engineering This talk invites you on an exploration of advanced reverse engineering techniques applied to sophisticated proprietary hardware. Rather than focusing on well-known hands-on methods such as hardware decapsulation and schematic analysis, I will demonstrate how a unique combination of patent analysis, firmware reverse engineering, and theoretical modeling can unlock the intricacies of undocumented hardware technologies and their application semantics. Qualcomm's QDSP6, also known as "Hexagon", is a little-known mobile-first microarchitecture distinct from ARM and RISC-V. In fact, Hexagon chips power critical components like cellular modems and DSPs within Snapdragon processors, which,...
https://www.youtube.com/watch?v=_0W3zeQhBB8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

AI Security: AMA Session with Security Experts
Back by popular demand, this ask-me-anything (AMA) session covers all things AI. From adversarial manipulation and shadow AI to autonomous agents making unsupervised decisions. Whether you're just beginning to evaluate AI or are already deploying models across your enterprise, this session offers actionable insights to help you secure your AI stack, before attackers exploit it. What you'll take away: ⭐ How AI red teaming and agentic testing differ from traditional approaches, and why they matter now ⭐ The latest emerging threats to AI systems (e.g., data poisoning, model inversion, policy bypass, autonomous misuse) ⭐ How to build an AI security strategy that balances innovation with risk ⭐ Key controls and questions to ask when adopting or partnering on AI
https://www.youtube.com/watch?v=N4ZzCoW1PS0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Tinker Tailor LLM Spy: Investigate & Respond to Attacks on GenAI Chatbots
It's coming, and you aren't ready—your first generative AI chatbot incident. GenAI chatbots, leveraging LLMs, are revolutionizing customer engagement by providing real-time, automated 24/7 chat support. But when your company's virtual agent starts responding inappropriately to requests and handing out customer PII to anyone who asks nicely, who are they going to call? You. You've seen the cool prompt injection attack demos and may even be vaguely aware of preventions like LLM guardrails; but are you ready to investigate and respond when those preventions inevitably fail? Would you even know where to start? It's time to connect traditional investigation and response procedures with the exciting new world of GenAI chatbots. In this talk, you'll learn how to investigate and respond to the...
https://www.youtube.com/watch?v=QfUdKtkBRjA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

JDD: In-depth Mining of Java Deserialization Gadget Chains
JDD: In-depth Mining of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Payload Construction Java serialization and deserialization facilitate cooperation between different Java systems, enabling convenient data and code exchange. However, a significant vulnerability known as Java Object Injection (JOI) allows remote attackers to inject crafted serialized objects, triggering internal Java methods (gadgets) and resulting in severe consequences such as remote code execution (RCE). Previous works have attempted to detect and chain gadgets for JOI vulnerabilities using static searches and dynamic payload construction via fuzzing. However, these methods face two key challenges: (i) path explosion in static gadget searches and (ii) a lack of fine-grained object...
https://www.youtube.com/watch?v=HWMjP7uFA1s
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Think Inside the Box: In-the-Wild Abuse of Windows Sandbox in Targeted Attacks
Windows Sandbox is a lightweight virtualization mechanism introduced in 2018, designed to provide an isolated desktop environment for quickly testing suspicious applications. However, this feature can also serve as a "magic cloak" for adversaries. In 2024, we observed an abuse of Windows Sandbox by the APT group Earth Kasha, believed to operate under the APT10 umbrella. After gaining control of the target machine via a backdoor named "ANEL," delivered through a spear-phishing email, the adversary uploaded multiple components to deploy a secondary payload, dubbed "NOOPDOOR," within Windows Sandbox. Initially, the adversary configured Windows Sandbox using a .wsb file to enable network access and map a host folder to a folder within the Sandbox, allowing access to host files from within the...
https://www.youtube.com/watch?v=YFa_Cs_hSUM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Free Recon Course and Methodology For Bug Bounty Hunters
Signup for Hostinger and get 10% off using my code NahamSec 👉🏼 https://hostinger.com/nahamsec LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this -...
https://www.youtube.com/watch?v=evyxNUzl-HA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

4 Recon Sources That Always Get Me Results
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=KpN43ZE1P40
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

IDA Free Reverse Engineering - Step-by-Step DLL Analysis
Step-by-step reverse engineering tutorial with IDA Free covering decompiling, types, enums, function definitions, and naming for DLLs. Sample can be found on unpac.me 93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5ee90a1d424a5ed Full tutorial series on the OALABS Patreon https://www.patreon.com/collection/1259251?view=expanded
https://www.youtube.com/watch?v=tbIjHJ1ygBY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Secure Code Inspired Offensive Payloads [For Pentesters]
A compilation of attack vectors and payloads for penetration testing and offensive security, inspired from the OWASP Secure Code Review Guide. I've guided NotebookLM to create this presentation for offensive pentesters.
https://www.youtube.com/watch?v=XqwJusDJXEQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Every Hacker Needs These Linux Commands // Bug Bounty Edition
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=SWgIWNGrjTg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

AI vs. Windows Forensics
Is AI going to replace digital forensic investigators? In this episode, we'll test a local instance of DeepSeek-R1 in Windows forensics to see how it compares to a human investigator. Let's find out if AI can handle the job! *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:23 - The Questions Begin 10:43 - Closing Thoughts 🛠 Resources #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #AI #DeepSeek
https://www.youtube.com/watch?v=lvkBtIhvThk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How to Spot AI Fakes: Your Complete Detection Guide | Cybersecurity Awareness Month | Free Toolkit
— Get your FREE Digital Detective Toolkit: https://www.infosecinstitute.com/form/digital-detective-campaign-kit/?utm_source=youtube&utm_medium=organic%20social&utm_campaign=cam — More resources for Cybersecurity Awareness Month: https://www.infosecinstitute.com/iq/cybersecurity-awareness-month/?utm_source=youtube&utm_medium=organic%20social&utm_campaign=cam AI-generated content is everywhere — and criminals are using it to create sophisticated scams, spread misinformation and undermine trust. In this Cybersecurity Awareness Month video, Keatron Evans transforms you into a digital detective, teaching you the critical skills to identify AI-generated videos, audio, image and text before they can deceive you. Learn the telltale signs that give away fake content and protect...
https://www.youtube.com/watch?v=sE53a8SQKlY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Why You Suck at Bug Bounty Hunting (And How To Fix It)
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=NH4VCau_5xI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Global Board of Directors Meeting - August 2025
Minutes here: https://board.owasp.org/meetings-historical/2025/202508.html Managed by the OWASP® Foundation https://owasp.org/
https://www.youtube.com/watch?v=3qxGpzgR84A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Cornucopia Abuse Case Modeling
Visit https://cornucopia.owasp.org for all things OWASP Cornucopia! Learn how to play, download FREE resources, explore cards in detail, and access the repo Play online https://copi.securedelivery.io/ Managed by the OWASP® Foundation https://owasp.org/
https://www.youtube.com/watch?v=vLYzId7-ijI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC33 - Red Team Village - Recap
Thank you to everyone who attended the village this year at DEF CON! Another huge thank you to our core team, sponsors, volunteers, goons, and DEF CON! Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=oP27VgfmfuY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

These Regex Hacks Made me ,000+
Signup for Cape and get 33% off today 👉🏼 cape.1stcollab.com/nahamsec LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023...
https://www.youtube.com/watch?v=SWP8o_W0U3M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

This ImGui Cheat Engine Plugin is a GAME CHANGER!
🔥 Learn How Guided Hacking's IMGUI Cheat Engine Plugin can make cool GUIs! 👨‍💻 Buy Our Courses: https://guidedhacking.com/register/ 💰 Donate on Patreon: https://patreon.com/guidedhacking ❤️ Follow us on Social Media: https://linktr.ee/guidedhacking GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved. 🔗 Link: https://guidedhacking.com/threads/cemgui-guided-hackings-imgui-cheat-engine-library.20572/ 👨‍💻 Guided Hacking's CEmGui Software Developer: PeaceBeUponYou 👉 https://guidedhacking.com/members/peacebeuponyou.261747/ 👨‍💻 Video Creator: Sightem 👉 https://guidedhacking.com/members/sightem.219746/ 👨‍💻 Video Editor: Dulge 📜 Video Description: This video provides a comprehensive tutorial on using...
https://www.youtube.com/watch?v=YbRUu0cJ7D8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

HTTP Pipelining or Request Smuggling? - No More False Positives
Based on the amazing work of James Kettle from Portswigger. You can find it here: https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling. I've guided NotebookLM to create this presentation for offensive pentesters.
https://www.youtube.com/watch?v=SNQlR6jiGeg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

I Hacked My Way To the Red Bull F1 Races
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=K7LWAGtx3XY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Applying Modular Design to Maintain IR Playbooks at Scale
Playbook Power-Up: Applying Modular Design to Maintain IR Playbooks at Scale 🎙️ Jessica Gorman, Sr Director of Security Operations and Incident Response, Experian, Georgetown University 📍 Presented at SANS DFIR Summit 2025 With only 23% of surveyed security professionals stating their incident response (IR) playbooks are updated frequently enough to keep up with best practices, a new approach is needed to “power up” the way organizations maintain their playbooks. The rise of Security Orchestration, Automation, and Response (SOAR) technology offers promising potential for cybersecurity teams to modernize incident response processes, but the challenge of managing and updating IR playbooks at scale persists, especially when organizations find themselves managing dozens (or even...
https://www.youtube.com/watch?v=fZ-Qhx_UtMM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

When to Conduct Structured and Unstructured Threat Hunts
Making Sense of the Chaos: When to Conduct Structured and Unstructured Threat Hunts 🎙️ Lee Archinal, Senior Threat Hunt Analyst, Intel 471 🎙️ Arun Warikoo, Head of Cyber Threat Intelligence, CIB Americas BNP Paribas , BNP Paribas 📍 Presented at SANS DFIR Summit 2025 Making Sense of the Chaos explores two distinct threat hunting approaches. Structured, hypothesis-driven hunts, and Unstructured hunts, where data leads the way. We'll discuss when to apply each method, and examine how different triggers - like intel reports or APT activity, can initiate a structured hunt. The talk will also cover how unstructured hunts unfold through data discovery. Attendees will gain insights into leveraging both approaches to achieve different objectives in threat hunting. View upcoming...
https://www.youtube.com/watch?v=VAVj1JE6dG0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Keynote | DFIR AI-ze Your Workflow
Keynote | DFIR AI-ze Your Workflow 🎙️ Mari DeGrazia, SANS Certified Instructor 📍 Presented at SANS DFIR Summit 2025 Beyond all the AI hype, how can you leverage AI in your DFIR life? Take a journey with me as I discuss AI and how we can start applying it to DFIR workflows to go beyond “can you write me code to….” Or “Can you write a paragraph for me on….”. I will share how I found my way into AI and demonstrate how you can start AI-zing your daily tasks and investigations. View upcoming Summits: https://www.sans.org/u/DuS
https://www.youtube.com/watch?v=eG2wHGIPCaQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

A North Korean Cyber Operation
A North Korean Cyber Operation: Exposing ARP-Based Covert C2s, WebSocket Malware, and Video Conference Software Abuse 🎙️ Luis Garcia, Incident Response Expert, Sygnia 🎙️ Matthew Mosley, Manager of Incident Response, Sygnia 📍 Presented at SANS DFIR Summit 2025 This research uncovers a real-world covert remote-control system designed by a North Korean IT worker, who was caught operating within an unsuspecting organization. The forensic investigation that followed pieced together a highly sophisticated malware ecosystem, leveraging ARP-based payload execution, WebSockets for stealthy command & control, and Zoom for covert persistence and remote access. Through deep technical analysis and live attack demonstration, this session will break down how the attacker: - Built...
https://www.youtube.com/watch?v=T7x195M8g0o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Strengthening Your Forensic and Response Mindset
Think Like an Examiner: Strengthening Your Forensic and Response Mindset 🎙️ Tony Knutson, Principal Consultant, Palo Alto Unit 42 📍 Presented at SANS DFIR Summit 2025 Cybersecurity professionals are often faced with complex, high-stakes investigations where quick decision-making and investigative accuracy are critical. However, many practitioners struggle to balance the rapid response required in Incident Response (IR) with the deep analytical mindset needed for Digital Forensics (DF). Without a structured investigative approach, security teams risk missing key evidence, drawing premature conclusions, or failing to remediate threats effectively. This presentation, “Think Like an Examiner: Strengthening Your Forensic & Response Mindset,” explores how cybersecurity professionals...
https://www.youtube.com/watch?v=rpqO8edR9mQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

MacOS Endpoint Security Framework
MacOS Endpoint Security Framework: Not Another MacOS Log Source 🎙️ Jacob Latonis, Staff Software Engineer, Proofpoint 🎙️ Julia Paluch, Engineer, GreyNoise Intelligence 📍 Presented at SANS DFIR Summit 2025 As many Mac DFIR professionals know, MacOS is constantly changing. New features are regularly being added to the platform that may provide a new source of information that an examiner can use during an investigation. One such feature, the Endpoint Security Framework, was added in MacOS Catalina and new features are added in every major OS version update. In this talk, we will dive into the Endpoint Security Framework and discuss how to take advantage of the information it collects to complement other sources, such as the Apple Unified Log, to perform threat hunts. Although...
https://www.youtube.com/watch?v=vF83KleL9FU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

MDR to IR Handoffs: Stick The Landing
MDR to IR Handoffs: Stick The Landing 🎙️ Jess Burn, Principal Analyst, Forrester Research 🎙️ Jeff Pollard, VP, Principal Analyst, Forrester 📍 Presented at SANS DFIR Summit 2025 Security leaders and teams rely on MDR providers to deliver 24/7 monitoring of security events, augment the expertise of internal SOC analysts, assist with or perform response actions, and offer assurance that adversaries are not present in the environment through threat hunting. But sometimes, an attack or incident becomes a breach, requiring specialized IR services offered through the MDR provider itself or an IR services firm and covered under attorney client privilege. In a time when the regulatory compliance clock starts ticking for most organizations, the rapid, thorough transfer of information...
https://www.youtube.com/watch?v=GzfVIx4Ekfk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How Threat Actors Persist In Your Microsoft 365
Backdoors & Breadcrumbs: How Threat Actors Persist In Your Microsoft 365 🎙️ Federico Cedolini, DFIR Senior Consultant, Stroz Friedberg 📍 Presented at SANS DFIR Summit 2025 Threat actors don't just break in, they find creative ways to remain persistent. In this session, we will explore persistence techniques used in real-life Microsoft 365 incidents and how to identify them in your environment. From basic inbox rules to advanced techniques such as domain federation abuse, we'll break down the tactics and techniques used by threat actors to maintain long-term access. For example, this talk will walk through what a threat actor needs to use SSPR to re-enter an account after the organization has changed the account password and reset sessions, and we'll also cover how threat...
https://www.youtube.com/watch?v=Q_h_OuBB4q8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Ensuring Data Integrity in Incident Response
Ensuring Data Integrity in Incident Response: Tools and Techniques for Forensically Sound Log Extraction 🎙️ Colin Meek, DFIR Consultant, Stroz Friedberg 📍 Presented at SANS DFIR Summit 2025 Logs are foundational to nearly all DFIR engagements, yet reliably extracting logs from sources such as network appliances, SaaS applications, and cloud environments can be challenging. When standard UI-based exports fail, due to volume restrictions, technical limitations, or undocumented interfaces, investigators must turn to APIs for programmatic log collection. This session will share practical tips for API-driven log extraction, including a detailed real-life case study involving extraction from an undocumented API of a proprietary client application. Additionally, we will discuss real-life...
https://www.youtube.com/watch?v=gylFpAzRIoc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Finding Relevant Alerts, Events and Logs
Finding Relevant Alerts, Events and Logs 🎙️ Ezz Tahoun, Lead researcher, University of Waterloo 📍 Presented at SANS DFIR Summit 2025 In modern cybersecurity, the ability to connect isolated security alerts into coherent, actionable attack chains is essential. However, traditional detection methods often struggle to contextualize vast amounts of security data, leaving slow and stealthy attacks undetected within a sea of noise and false positives. This talk introduces a novel approach using open-source AI models to map, cluster, and correlate security alerts in order to uncover coordinated attacks. Through clustering, knowledge graphs, and AI-driven correlation, this approach offers significant improvements in SOC (Security Operations Center) efficiency and effectiveness. We detail...
https://www.youtube.com/watch?v=h_mzH3ezrnQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Investigating a Malicious Script in Microsoft Intune
Investigating a Malicious Script in Microsoft Intune: A DFIR Case Study 🎙️ Dennis Labossiere, Director, KPMG LLP 📍 Presented at SANS DFIR Summit 2025 The proliferation of cloud-based solutions has significantly transformed the landscape of enterprise security, with Microsoft Intune emerging as a pivotal tool for device and application management. This Digital Forensics and Incident Response (DFIR) case study delves into the forensic investigation of a malicious script within Microsoft Intune, highlighting procedural insights and analytical techniques. The incident, which occurred in 2023, involved unauthorized access to a client's Azure tenant by Scattered Spider. This presentation discusses the forensic analysis conducted to recreate the attack and understand its impact. This...
https://www.youtube.com/watch?v=j722t2yOLEk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

macOS Lockdown Mode: A DFIR Odyssey
macOS Lockdown Mode: A DFIR Odyssey 🎙️ Bhargav Rathod, Security Analyst, Salesforce 📍 Presented at SANS DFIR Summit 2025 With increasing cyber threats, Apple introduced a robust security feature known as ""Lockdown Mode."" This session delves into the intricacies of Lockdown Mode, exploring its purpose and evolution. Initially designed to shield users from potential cyber threats, Lockdown Mode introduces a new layer of security by restricting certain functionalities on the Apple OS like iOS, macOS, watchOS, and iPadOS. Participants will gain insights into the operational changes when Lockdown Mode is activated on macOS, including what functionalities are restricted. Due to restrictions imposed on macOS, this raises intriguing questions from a DFIR perspective and how it changes...
https://www.youtube.com/watch?v=qw50_vTUD5I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Forensic Analysis of TAILs
Does Slicing Onions Make You Cry - Forensic Analysis of TAILs 🎙️ Aaron Sparling, Principal Incident Response Engineer, Walmart - Cyber Security Incident Response 📍 Presented at SANS DFIR Summit 2025 Adversaries leverage the TAILs (The Amnesic Incognito Live System) operating system for conducting criminal activity. This presentation will address forensic imaging and analysis issues and illustrate techniques which can be used to access and analyze the much needed data. TAILs runs within the physical memory (RAM) of the host system, which if imaged and analyzed can provide numerous valuable forensic artifacts. This talk will address issued faced when confronted with systems running TAILs, options for imaging the TAILs instance and methods which can be applied to locate artifacts...
https://www.youtube.com/watch?v=AlWUrqYXP5c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Leaking Passwords via CSS Injection - "Fancy Login Form" [WHY CTF 2025]
🚩 Video walkthrough for the "Fancy Login Form" web challenge featured in the 2025 WHY CTF competition. The challenge involved exploiting a URL-based redirection to take control of a CSS file, then using blind exfiltration to extract each character of the admin's password from the login form field 😎 #CTF #Challenge #WHY2025 Check out the accompanying writeups here: https://book.cryptocat.me/blog/ctf/2025/why/web Join my discord server if you have any questions: https://discord.cryptocat.me 🐛What Hackers Yearn ( @WHY2025NL ) CTF🐞 https://ctf.why2025.org https://why2025.org https://discord.gg/fkn7qW3GRT https://ctftime.org/event/2680 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00 Intro 0:46 Fancy Login Form 2:27 Hijacking CSS file 6:10 Blind data exfiltration 9:37...
https://www.youtube.com/watch?v=jUjlj2z5jJk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Analysing the DOM to find Reflected XSS
Stuck watching YouTube videos about bug bounty hunting rather than a bounty hitting your inbox? In this series I partner with Bugcrowd to bring you everything you need to know to find their most common first bugs. In this video we explore one of the common first vulnerabilities - Reflected Cross-Site Scripting (XSS). Learn the basics of XSS, how to identify and exploit this vulnerability, and see a practical demonstration you can replicate on your own targets. With step-by-step methodology and tips, this episode will guide you through finding and validating the internets most common first bug. This series couldn't happen without the support of our sponsor Bugcrowd, Bugcrowd is the best place to start hacking with a wide range of public and private programs from APIs to Desktop Applications...
https://www.youtube.com/watch?v=CpV3XDqzYyE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DEFCON 33 Vlog
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=kxpkARgSjlI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

HTTP/1.1 - The Desync Endgame
Based on the amazing work of James Kettle of @PortSwiggerTV found at https://portswigger.net/research/http1-must-die. I've guided NotebookLM by @Google to create this presentation for offensive pentesters.
https://www.youtube.com/watch?v=zs1rZnZuJ6A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

On HTTP Request Smuggling - RFC 9110 Style
Based on the RFC 9110, I've guided NotebookLM by @Google to create this presentation for offensive pentesters, specifically on HTTP Methods. RFC 9110: https://www.rfc-editor.org/rfc/rfc9110.html
https://www.youtube.com/watch?v=CvEBA_Sm-mw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Global AppSec EU 2025 Closing Ceremony
Watch the closing ceremony to the OWASP Global AppSec EU 2025 conference.
https://www.youtube.com/watch?v=Fe_C8qGFTvI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Keynote: Nemo Resideo: Managing Application Security Through Rapid Change - Sarah-Jane Madden
Watch Sarah-Jane Madden's keynote talk from the 1st day of OWASP Global AppSec EU 2025 Barcelona.
https://www.youtube.com/watch?v=CZdSGKoi90Y
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Keynote: Outside the Ivory Tower: Connecting Practice and Science - Dr. Kate Labunets
Watch Dr. Kate Labunet's keynote talk from the 2nd day of OWASP Global AppSec EU 2025 Barcelona.
https://www.youtube.com/watch?v=2QQTbtFV-Kc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Sherif Mansour - Donate Blood Today!
Sherif Mansour, our Chair of the Global Board of Directors in 2021, has been diagnosed with leukemia, which is a cancer of the blood. Learn how you can help folks with leukemia, no matter where you are! Don't hesitate to contact your local blood donation service and make an appointment today. In the UK, you can donate via the NHS (https://www.blood.co.uk/why-give-blood/). You can donate via the Red Cross Blood Service or Red Cross Lifeblood in many countries. Search for "donate blood" in your search engine to find out more. 🌍 Global Resources World Health Organization – Blood Services Directory https://www.who.int/campaigns/world-blood-donor-day IFRC – Find a Red Cross/Red Crescent https://www.ifrc.org/national-societies 🇺🇸 USA – American Red Cross | AABB Blood Bank Locator...
https://www.youtube.com/watch?v=LKZTppmAS84
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

HTTP Methods for Offensive Pentesting
Based on the RFC 9110, I've guided NotebookLM by @Google to create this presentation for offensive pentesters, specifically on HTTP Methods. RFC 9110: https://www.rfc-editor.org/rfc/rfc9110.html
https://www.youtube.com/watch?v=ZtoPYQD0rXs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Global Board of Directors Meeting - July 2025
Minutes here: https://owasp.org/www-board/meetings-historical/2025/202507.html Managed by the OWASP® Foundation https://owasp.org/
https://www.youtube.com/watch?v=xYVKG4R9_kY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC33 - Red Team Village x Amazon
Thank you for being one of our platinum sponsors! Additional information about Amazon can be obtained from https://www.aboutamazon.com/ They're Hiring!: https://amazon.jobs/content/en/teams/amazon-security/devices-services Twitter/X: https://x.com/amazon LinkedIn: https://www.linkedin.com/company/amazon/ _________________________________________________________________________ Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=-KIEqwVejSE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

HTTP Request Smuggling Explained (with James Kettle)
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=QjPFjd8GJWY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Behind the Book: Threat Hunting macOS with Jaron Bradley
In this episode, I sit down with Jaron Bradley, author of the upcoming book Threat Hunting macOS. With the recent release of the new 13Cubed training course Investigating macOS Endpoints, this felt like the perfect time to bring Jaron on the channel to discuss his new book — a resource I believe will be an excellent companion to the course. 📘 Order Jaron's Book – Threat Hunting macOS https://themittenmac.com/threat-hunting-book/ 🌐 Visit Jaron's Website – The Mitten Mac https://themittenmac.com/ 🎓 Learn macOS Forensics! https://training.13cubed.com/investigating-macos-endpoints #Forensics #DigitalForensics #DFIR #ComputerForensics #macOSForensics
https://www.youtube.com/watch?v=8Uj2NbWnU6M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Build Your Own CHEAT ENGINE in PYTHON with PyQt5!
🔥 Learn How To Build a Python Memory Scanner Frontend with Python! 👨‍💻 Buy Our Courses: https://guidedhacking.com/register/ 💰 Donate on Patreon: https://patreon.com/guidedhacking ❤️ Follow us on Social Media: https://linktr.ee/guidedhacking GuidedHacking® - The Game Hacking Bible® - © 2025 Guided Hacking LLC. All Rights Reserved. 🔗 Article Link: https://guidedhacking.com/threads/python-memory-scanner-pgh109.20962/ 👨‍💻 Content Creator: codenulls 👉 https://guidedhacking.com/members/codenulls.272722/ ❤️ Free Courses from Perkins Fund: https://perkinsfund.org/courses 📜 Video Description: We're going to build a Python memory scanner from scratch, similar to Cheat Engine. This tool will allow selecting the target process and attach to it. One of the...
https://www.youtube.com/watch?v=tC86VhNdaFc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC33 - Red Team Village x Flare
Thank you for being one of our platinum sponsors! Additional information about Flare can be obtained from https://flare.io/. Twitter/X: https://twitter.com/FlareSystems LinkedIn: https://www.linkedin.com/company/flare-systems-inc Discord: https://discord.gg/qRGBT2TcEV YouTube: https://www.youtube.com/channel/UCU5Nr_7GpdxgxPOhuWuvXVg _________________________________________________________________________ Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=xapuRA5uEbg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Still not found your first bug? Try IDORs
Stuck watching YouTube videos about bug bounty hunting rather than your inbox? In this series I partner with Bugcrowd to bring you everything you need to know to find their most common first bugs. In this episode we're talking about the ever popular IDOR, and while yes, I am aware I have made videos on this topic many times, it's still a solid choice for your first bug, difficult to automate and scale, yet easy to understand and test for. Its tediousness means that top hackers often skip them in favour of trickier bugs, making it perfect for newer bug bounty hunters to focus on. This series couldn't happen without the support of our sponsor Bugcrowd, Bugcrowd is the best place to start hacking with a wide range of public and private programs from APIs to Desktop Applications and everything...
https://www.youtube.com/watch?v=8Uva1su3goc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC33 - Red Team Village x White Knight Labs
Thank you for being one of our platinum sponsors! Additional information about White Knight Labs can be obtained from https://whiteknightlabs.com. Twitter/X: https://twitter.com/WKL_cyber LinkedIn: https://www.linkedin.com/company/white-knight-labs/ Discord: https://discord.gg/qRGBT2TcEV _________________________________________________________________________ Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=RULalD2__Lg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC33 - Red Team Village x Kindo
Thank you for being one of our platinum sponsors! Additional information about Kindo can be obtained from https://www.kindo.ai/. Twitter/X: https://x.com/kindoai LinkedIn: https://linkedin.com/company/kindo-ai YouTube: https://www.youtube.com/channel/UC9ahwU5unSzp0ytNPcjVg8g _________________________________________________________________________ Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter/X: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=PT7zVhbdvpk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Lessons Learned From 0,000 In Blind Cross Site Scripting (Blind XSS)!
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training 💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io 💵 FREE 0 DigitalOcean Credit: https://m.do.co/c/3236319b9d0b 🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -https://amzn.to/3Re8Pa2 Hacking APIs: Breaking Web Application Programming Interfaces - https://amzn.to/45g4bOr Black Hat GraphQL: Attacking Next Generation APIs - https://amzn.to/455F9l3 🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this - https://youtu.be/z6O6McIDYhU 2023 How to Bug Bounty - https://youtu.be/FDeuOhE5MhU Bug Bounty Hunting...
https://www.youtube.com/watch?v=QSiXHb97E1c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Global AppSec USA 2025 Washington, D.C.
PURCHASE YOUR TICKETS NOW: https://owasp.glueup.com/event/owasp-2025-global-appsec-usa-washington-dc-131624/home.html Training Dates - November 3-5, 2025 Conference Dates - November 6-7, 2025 From November 6–7, 2025, connect with over 800 hundred security experts, thought leaders, and practitioners. Be a part of something extraordinary at the OWASP Global AppSec US Conference, OWASP's largest US Conference, taking place in the heart of Washington, D.C. This is your opportunity to immerse yourself in the leading event for application security professionals, where passion, innovation, and community converge. Ours is an event designed to fuel your passion for security. This is your chance to connect, learn, and grow with some of the brightest minds in the field. Be inspired by our keynote...
https://www.youtube.com/watch?v=5Xuvcfoha_I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Windows Memory Forensics Challenge
Welcome to a special Windows Memory Forensics Challenge from 13Cubed. This is an excellent opportunity to get some hands-on practice with Windows memory forensics. You'll find the questions below, as well as a link to download the memory sample needed to answer those questions. 🎉 Check out the official training courses from 13Cubed at https://training.13cubed.com! 🛑 CONTEST IS CLOSED 🛑 All winners have been selected. We still encourage you to participate in the lab, as we believe it will serve as an excellent practice opportunity. If you do participate, please consider creating a video or blog-based walkthrough of the process, as it would be a valuable resource for the community! ⚠️ CAUTION ⚠️ This memory sample contains a simulated ransomware for educational purposes....
https://www.youtube.com/watch?v=6JN6iAenEoA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Securing Access: Leveraging IGA, JIT & Policy Controls to Tackle OWASP Threats
Saai Krishnan Udayakumar and Dilip Mandadi discuss securing access - leveraging IGA, JIT and policy controls to tackle OWASP threats.
https://www.youtube.com/watch?v=Qj3Oq-5w1iA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Unlocking Secure Development: A Deep Dive into OWASP ASVS
Tejpal Garhwal discusses unlocking secure development with a deep dive into OWASP ASVS.
https://www.youtube.com/watch?v=6v5XHd6nFb4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Everyone Can Play! Building CTFs for Non-Security Folks
Joe Kuemerle discusses building CTFs for non-security folks.
https://www.youtube.com/watch?v=mwIW9ZZgW1E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Don't Make This Mistake: Painful Learnings of Applying AI in Security
Eitan Worcel discusses painful learnings of applying AI in security.
https://www.youtube.com/watch?v=i2Ogx9AuESM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OWASP Top 10 for LLMs
A discussion on OWASP Top 10 for LLMs.
https://www.youtube.com/watch?v=de9UPN7yD5U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

API Fuzzing in the SSDLC Problems and Possible Solutions
Arseniy Sitnikov and Vitaliy Panasenko discuss API fuzzing in the SSDLC problems and possible solutions.
https://www.youtube.com/watch?v=d6_7hZxoIBs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Top Skills Cybersecurity Professionals Need In 2025
Cybersecurity professionals must blend core technical skills with AI expertise to stay relevant as the field evolves. The following skills are essential for building a practical, effective defense in an AI-driven world. 📖 Read the full article: https://purplesec.us/learn/ai-replacing-cybersecurity-jobs/ Tom Vazdar is the Chief AI Officer at PurpleSec and brings more than two decades of cybersecurity expertise to this discussion. He is an expert in AI and leads the development of advanced cybersecurity strategies, enhancing data protection and compliance. As an AI strategist and mentor, Tom advocates for ethical AI integration. About The Experts ------------------------------ Jason Firch, MBA https://purplesec.us/about-us/leadership/jason-firch/ Tom Vazdar https://purplesec.us/about-us/leadership/tom-vazdar/ AI...
https://www.youtube.com/watch?v=KbyAwGCXfCc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How Security Leaders Build AI-Augmented Defense in Depth
Webinar from HackerOne: Learn how Zoom is adopting defense in depth for a world of constant code changes, rising AI-driven threats, and growing attack surfaces.
https://www.youtube.com/watch?v=8_GpJTqHHOQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Yes, AI Will Replace Cybersecurity Jobs (If You Let It)
Is AI coming for your cybersecurity job? In this episode of Security Beyond the Checkbox, host Jason Firch sits down with PurpleSec's Chief AI Officer, Tom Vazdar, to unpack the role of AI in cybersecurity and what it means for your career. From CrowdStrike's 2025 job cuts to a Reddit user's story of their team being replaced by AI, we dive into the headlines and separate fact from fear. Spoiler: AI isn't replacing cybersecurity jobs—it's evolving them. 📖 Read the full article: https://purplesec.us/learn/ai-replacing-cybersecurity-jobs/ Tom shares actionable insights on how AI is reshaping roles, creating hybrid opportunities like AI Security Engineer and AI Governance Specialist, and why skills like ethics, communication, and AI fluency are now critical. Learn how...
https://www.youtube.com/watch?v=reRHSeNkIm0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

New Course! Investigating macOS Endpoints
Check out Investigating macOS Endpoints, a comprehensive macOS forensics training course from 13Cubed! Starting with fundamental principles, Investigating macOS Endpoints advances to encompass log analysis, file systems, forensic artifacts, persistence mechanisms, evidence collection, and more! This course offers extensive hands-on practice and a capstone involving the analysis of a compromised system. Tailored for both beginners and seasoned professionals, it serves as an ideal resource for mastering macOS forensics! 🎉 Enroll today at https://training.13cubed.com! #Forensics #DigitalForensics #DFIR #macOSForensics
https://www.youtube.com/watch?v=_D6oHm-371A
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Offensive Security Web Expert (OSWE) Review + Tips/Tricks [OffSec]
Offensive Security Web Expert (OSWE) review, tips/tricks etc. Hopefully this video will be useful for aspiring bug bounty hunters, security researchers, pentesters, CTF players etc who might be interested in taking the Advanced Web Attacks and Exploitation course from Offensive Security (OffSec) 🙂 #OSWE #BugBounty #EthicalHacking #PenTesting #AppSec #WebSec #InfoSec #OffSec ↢OffSec OSWE↣ Web-300 course: https://www.offsec.com/courses/web-300 Web-300 syllabus: https://manage.offsec.com/app/uploads/2023/01/WEB-300-Syllabus-Google-Docs.pdf Web-300 FAQ: https://help.offsec.com/hc/en-us/articles/360046868971-WEB-300-Advanced-Web-Attacks-and-Exploitation-FAQ OSWE exam guide: https://help.offsec.com/hc/en-us/articles/360046869951-WEB-300-Advanced-Web-Attacks-and-Exploitation-OSWE-Exam-Guide OSWE...
https://www.youtube.com/watch?v=IK4t-i5lDEs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTVcron: Introduction to Ghidra and Version Tracking
RTVcron is our monthly live stream where we bring workshops to you! Learn more about cron and RTV at https://redteamvillage.io Mike will demonstrate basic Ghidra functionality such as importing programs, launching tools, and using the standard windows and plugins. Next he will explain the design and use of the Version Tracking tool, and how it can help your workflow understanding functionality while analyzing upgrades to software. Finally, time permitting, he will show beginning usage of the BSim capability and how this can be a game changer for discovering lineage of software en masse. Participants are encouraged to ask questions about the application, as Mike will be demonstrating everything live without a net.
https://www.youtube.com/watch?v=6ou3Qcwuao8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Vibe Coding in Cursor for Cyber Security
In the past few weeks I've dove headfirst into vibe coding with Cursor, so I wanted to share what I've been working on and some tips and tricks. In this video we'll cover all things vibe coding for hackers: What is it? How is it making waves on Twitter and within the startup and AI influencer communities? More importantly, what does it mean for us bug bounty hunters and hackers? I'll share tips on using AI for coding, how to get started with tools like Cursor, Gemini, and Docker, and even give you a peek at a vibe-coded pet adoption website I worked on. Whether you're a coding newbie or looking to simplify your process, this video has something for you. Enjoy! Links: Awesome .cursorrules: https://github.com/PatrickJS/awesome-cursorrules Spec-drive Vibe Coding (how to write design docs for...
https://www.youtube.com/watch?v=wnVpmSrhNRo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

A New(ish) Way to Detect Process Hollowing
In this episode, we'll briefly explore how process hollowing works. Then, we'll examine the relatively new windows.hollowprocesses plugin for Volatility 3—a more recent alternative to the popular HollowFind plugin from Volatility 2. As you'll see, this new plugin isn't a one-for-one replacement for HollowFind, but it can still be useful. ⚠️ Deprecation Notice The windows.hollowprocesses plugin is being renamed to windows.malware.hollowprocesses in an upcoming Volatility 3 release. The plugin's behavior and output remain unchanged. ❤️ Special thanks to Mike Peterson of https://nullsec.us for research and testing. Download the memory samples here: https://cdn.13cubed.com/downloads/hollow.zip *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed....
https://www.youtube.com/watch?v=x5mGPAG41I4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Tsuku CTF Web Challenge Walkthroughs (2025)
🚩 Video walkthrough for the 3 web challenges featured in the 2025 Tsuku CTF competition. Challenges include JSON injection, sensitive file disclosure and flawed PRNG implementation, YAML injection with WAF 😎 #CTF #Challenge #Tsuku Check out the accompanying writeups here: https://book.cryptocat.me/blog/ctf/2025/tsuku/web Join my discord server if you have any questions: https://discord.cryptocat.me 🐛CIT@CTF🐞 https://tsukuctf.org https://discord.gg/xNgh3a6Ynp 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00 Intro 0:08 len_len 2:47 flash 8:28 YAMLwaf 12:23 Conclusion
https://www.youtube.com/watch?v=qGd4d0zmhy8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

CTF@CIT Web Challenge Walkthroughs (2025)
🚩 Video walkthrough for the 5 web challenges featured in the 2025 CIT@CTF competition. Challenges include SQL injection (SQLi), git repo version history (git-dumper), local file read (with basic filter), flask session cookie tampering + server-side template injection (SSTI) and credential reuse / HTTP method tampering 😎 #CTF #Challenge #CIT Check out the accompanying writeups here: https://book.cryptocat.me/blog/ctf/2025/ctf-cit/web Join my discord server if you have any questions: https://discord.cryptocat.me 🐛CIT@CTF🐞 https://ctf.cyber-cit.club https://discord.gg/GzUAsFvhbk 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00 Intro 0:06 Breaking authentication (SQLi) 2:20 Commit & Order: Version Control Unit (git dumping / history) 4:25 How I Parsed your...
https://www.youtube.com/watch?v=ZBdApaw0r0M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTVcron | Systematic Malware: A Rule-Based Approach to Creating Payloads
RTVcron is our monthly live stream where we bring workshops to you! Learn more about cron and RTV at https://redteamvillage.io This month we're joined by Kevin Clark and Skyler Knecht for "Systematic Malware: A Rule-Based Approach to Creating Payloads" Creating evasive payloads in the modern EDR landscape is less about knowing what to do, and more about learning what not to do. Although EDR has moved away from relying on static binary signatures, rule-based detections are still in play. Every step of payload execution is an opportunity to be detected. In this workshop, we showcase step-by-step instructions on how to craft evasive payloads. Kevin Clark Security Consultant at TrustedSec Kevin Clark is a Software Developer turned Penetration Tester at TrustedSec. He focuses on initial access...
https://www.youtube.com/watch?v=-xStGweK9KI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Reverse Engineering Access Tokens Part 2
This tutorial covers Windows Access Tokens, the Logon Session, Token Elevation, AdjustTokenPrivileges and the Windows Access Control Model. This is part of our IDA Pro reverse engineering series. The full series can be found on our patron... https://www.patreon.com/collection/1259251 ----- References Token Viewer (Tool) https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools LogonSessions (Tool) https://learn.microsoft.com/en-us/sysinternals/downloads/logonsessions Elastic - Introduction to Windows tokens for security practitioners https://www.elastic.co/blog/introduction-to-windows-tokens-for-security-practitioners UAC Overview (old but good) https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-1.html Access Control Model (Microsoft) https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-components LSA...
https://www.youtube.com/watch?v=Y58eBWyJxDA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Getting Started with Fuji - The Logical Choice for Mac Imaging
In this episode, we'll look at Fuji—a free, open-source tool for performing live, logical forensic acquisitions of Mac computers (Intel or Apple Silicon). You'll see how Fuji leverages built-in macOS tools to generate a DMG and sparseimage, ready for analysis in your forensic tool of choice. This video is an excerpt from the 13Cubed training course "Investigating macOS Endpoints." Visit https://training.13cubed.com to learn more! 🛠 Resources Fuji: https://github.com/Lazza/Fuji
https://www.youtube.com/watch?v=9bEiizjySHA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How FIN6 Exfiltrates Files Over FTP
Access the FIN6 Exfiltration Lab: https://bit.ly/3XsXFRZ In this final episode of our FIN6 Adversary Emulation mini-series, we demonstrate how to emulate FIN6's exfiltration techniques, focusing on how this financially motivated threat actor collects, stages, archives, and exfiltrates sensitive data from compromised systems. // CYBER RANGES Adversary Emulation Labs ► New to CYBER RANGES? Register for a free account here: https://bit.ly/42VxDu5 ► Access the FIN6 Exfiltration Lab: https://bit.ly/3XsXFRZ ► Adversary Emulation Fundamentals Labs (Free): https://bit.ly/4gQd8SB 🔗 Video Resources & References CTID Adversary Emulation Library: https://github.com/center-for-threat-informed-defense/adversary_emulation_library 🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6 //...
https://www.youtube.com/watch?v=SbZ7JUII-SQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

From Zero to Zero Day (and beyond) - Life of a Hacker: Jonathan Jacobi
I met Jonathan in 2018 at the CCC when he was just 18 years old. Back then he referenced my videos which had a little bit of impact on his life. Now a lot of time has passed and in this interview I want to get to know Jonathan better. How did he get into hacking, founding of the CTF team perfect blue, working as a vulnerability researcher and ultimately transitioning into a new career. From Zero to Zero Day (2018): https://www.youtube.com/watch?v=xp1YDOtWohw Jonathan on Twitter: https://x.com/j0nathanj 00:00:00 - How we met 00:02:16 - Jonathan's early life 00:04:24 - Going to college as a teenager 00:18:52 - Meeting like-minded people in CTF 00:27:29 - Getting first VR internship at Checkpoint 00:32:34 - Creating opportunities through networking 00:43:40 - Working at Microsoft Security Response...
https://www.youtube.com/watch?v=BOLN_B0qnZk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Is Your AI Deployment Risky? How to Address AI Safety, Security, and Reliability Risks
Most organizations are committed to adopting generative AI in some form to drive innovation and efficiency. Yet, many leaders responsible for AI risk still grapple with how to minimize the chances their organization's AI deployment turns into a very public AI embarrassment that could compromise trust and reputation. In this webinar, hear from HackerOne co-founder Michiel Prins and Haize Labs co-founder Leonard Tang about actionable strategies that can help you proactively manage AI risk and turn your deployment into a competitive advantage rather than a liability. Michiel and Leonard will share insights on establishing clear ownership within your organization and provide practical guidance on identifying and addressing AI safety risks relevant to your industry and use cases. You will...
https://www.youtube.com/watch?v=Z6GU6tGqs1o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Automated AI Reverse Engineering with MCP for IDA and Ghidra (Live VIBE RE)
Testing MCP plugins for IDA and Ghidra live with @mrexodia IDA MCP https://github.com/mrexodia/ida-pro-mcp Ghidra MCP (thanks @lauriewired ) https://github.com/LaurieWired/GhidraMCP Malware sample 7b5b060d9013725413f3f77719d0881035246b281e18005c0040e78a32e1c6cc ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=iFxNuk3kxhk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTVcron - Influcence_Ops: Tactical Pretexting
Welcome to RTVcron, our monthly live stream, held on the last Thursday of every month. Each two-hour session features a unique workshop led by a different expert, offering hands-on experience in offensive security tactics and strategies. Follow us: https://redteamvillage.io This month our workshop is provided by Jeff Tomkiewicz! Jeff Tomkiewicz is a Offensive Security Engineer for a Healthcare Fortune 40 organization, where he specializes in network penetration testing, social engineering, and physical penetration testing. With a rich background as a 21-year Air Force veteran, Jeff has served in various capacities, including K9 handler and trainer, Intelligence, and Special Operations. Residing in Colorado Springs, CO, where interests span upon horror films, performing in improv shows,...
https://www.youtube.com/watch?v=vlow4qZSOSE
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Reverse Engineering Access Tokens Part 1
This tutorial walks through the process of reverse engineering malware which uses AdjustTokenPrivileges to enable SeDebugPrivilege. No steps are skipped in the process! This is Module 2.2 of our IDA Pro reverse engineering series. The full series can be found on our patron... https://www.patreon.com/collection/1259251 ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=iT2U3UXhic4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 0. Introduction
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=1AAZDkSZePs
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 11 - Additional Resources and Personal Message
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=zVgV__cRhvo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 10 - Finding Hidden Wireless Networks with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=0EB5U8dcAVc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 9 - Spoofing your MAC Address with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=OtvSfjX6kGY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 8 - Cracking Hashes with Python and Hashlib
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=EA4JFh8hj9E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 7 - Discovering Subdomains with Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=X9oyU7kUob8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 6 - Attacking Web Forms with requests and BeautifulSoup in Python
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=sYg3dyetcYA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 5 - The Scapy Module for Network Traffic Sniffing and Manipulation
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=M_5YKbsk4eY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Python for Pentesters II - 4 - The Socket Module for Network Communication - A TCP Server Client
Part of the Python for Pentesters II course: https://www.youtube.com/playlist?list=PLonlF40eS6nyj9h8wwrOgf1yBGDB2CYT1 Connect with me: X: https://twitter.com/cristivlad25 IG: https://instagram.com/cristivladz
https://www.youtube.com/watch?v=bHDITf8TMmY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Turn Your Cybersecurity to Cyberstrength with HackerOne
This new era of cybersecurity combines AI and Human Intelligence for faster, smarter, and more adaptive protection. Ready to move beyond traditional security and into cyberstrength? Visit https://bit.ly/4kMXE5a to learn more.
https://www.youtube.com/watch?v=f7M8WO6Nz8o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

18 - API Security (low/med/high) - Damn Vulnerable Web Application (DVWA)
18 - API Testing (low/med/high difficulties) video from the Damn Vulnerable Web Application (DVWA) walkthrough/tutorial series. DVWA is an intentionally vulnerable application for you to learn about ethical hacking. I made this series for students on the MSc in cybersecurity course at Queen's University Belfast but hopefully it can help others too! Hope you enjoy 🙂 ↢Damn Vulnerable Web Application (DVWA)↣ https://github.com/digininja/DVWA 👷‍♂️Resources🛠 https://cryptocat.me/resources ↢Chapters↣ Start - 0:00 Low - 0:38 Med - 3:59 High - 7:07 Impossible - 13:19 End - 13:35
https://www.youtube.com/watch?v=c_6RaCekH40
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Quantifying the Financial Impact of Cybersecurity with Return on Mitigation (RoM)
Join HackerOne for an insightful session introducing return on mitigation (RoM)—a novel framework that redefines cybersecurity's role in protecting profits and reducing risk. With RoM, you'll learn to quantify the financial impact of mitigated breaches and position cybersecurity as a strategic business enabler. In this session, you'll discover how to: -Use the RoM calculator, built on widely accepted industry benchmarks like IBM's Cost of a Data Breach Report -Automate RoM calculations and generate real-time summaries tailored to your organization's business and risk profile—by using Hai Play, part of the -HackerOne Platform's AI copilot -Make data-driven business cases to your board and executive team, showing why offensive security programs as essential to operational continuity,...
https://www.youtube.com/watch?v=CbiiKnQXGyY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The German Hacking Championship
An amazing event for aspiring German hackers is happening right now. I went to the finals in 2024, share a few impressions and tell you about this year's event. Learn hacking: https://www.hextree.io/ (ad) CSCG 2025 runs from 1. March 2025 until 1. May 2025 Rules: https://play.cscg.live/rules Die Hacking Meisterschaft: https://hacking-meisterschaft.de/ NFITS: https://nfits.de/spenden/ European Cybersecurity Challenge: https://ecsc.eu/ 00:00 - Intro DHM 2024 00:52 - CTF Teams vs. CSCG Teams 01:48 - Sponsor Challenges 03:04 - My CSCG History 04:18 - NFITS 05:06 - Die Deutsche Hacking Meisterschaft (DHM) 07:00 - Take the Opportunity! 07:47 - Outro =[ ❤️ Support ]= → My courses: https://www.hextree.io/ → My font: https://shop.liveoverflow.com/ → per Video: https://www.patreon.com/join/liveoverflow →...
https://www.youtube.com/watch?v=f0C3RH7baEw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

17 - Cryptography (low/med/high) - Damn Vulnerable Web Application (DVWA)
17 - Cryptography (low/med/high difficulties) video from the Damn Vulnerable Web Application (DVWA) walkthrough/tutorial series. DVWA is an intentionally vulnerable application for you to learn about ethical hacking. I made this series for students on the MSc in cybersecurity course at Queen's University Belfast but hopefully it can help others too! Hope you enjoy 🙂 ↢Damn Vulnerable Web Application (DVWA)↣ https://github.com/digininja/DVWA ↢Cryptography↣ https://cryptohack.org @pastiesbin2254 : https://www.youtube.com/watch?v=8Tr2aj6JETg https://www.nccgroup.com/uk/research-blog/cryptopals-exploiting-cbc-padding-oracles @nccgroup : https://www.youtube.com/watch?v=6yHM19rQjDo 👷‍♂️Resources🛠 https://cryptocat.me/resources ↢Chapters↣ Start - 0:00 Low - 0:14 Med...
https://www.youtube.com/watch?v=7WySPRERN0Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The latest insights on global VDP adoption & IoT security trends
The 2024 report on global Vulnerability Disclosure Policy (VDP) adoption reveals significant strides in IoT security—yet critical gaps remain. Join our exclusive webinar as industry experts break down the key findings, including: - 11.6% growth in VDP adoption—who's leading and who's lagging - The impact of the UK's PSTI Act on IoT security standards - Upcoming regulations in the EU and U.S. and what they mean for businesses - Enterprise vs. consumer IoT security—where vulnerabilities persist Don't miss this opportunity to gain actionable insights and stay ahead of evolving security regulations. For more information visit: https://www.hackerone.com/
https://www.youtube.com/watch?v=CowQQK195Ao
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTV Overflow: "Breaching Bare Metal Kubernetes Clusters" with Graham Helton
Graham Helton - Arbiter of (in scope) chaos - "Attackers thrive in complex environments because they're motivated to dive deep into ambiguous technical details. In this workshop I will guide you through those ambiguous technical details by walking through multiple attack scenarios that can be used to fully compromise a bare metal Kubernetes cluster. After each attack, we'll discuss controls that could stop or mitigate each attack, what tools you should carry in your toolbox when performing a Kubernetes assessment, and the security implications (and misconceptions) of Kubernetes. By the end of this workshop, you will be paranoid by the power you possess next time you land a shell in a Kubernetes pod." Web: https://grahamhelton.com/ Twitter/X: @GrahamHelton3 linkedin.com/in/grahamhelton/ ...
https://www.youtube.com/watch?v=iR064xsllqk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTV Overflow "An Operators Guide: Hunting SCCM in the Real World" w/ Zachary Stein & Garrett Foster
Zachary Stein (Security Consultant at SpecterOps) and Garrett Foster (Senior Security Consultant at SpecterOps) - "SCCM abuse has become a popular technique in the offensive security community but can be intimidating to test in production environments due to its complexity. This workshop aims to provide operators not only a safe environment to practice tradecraft but also provide them with the confidence to properly find and assess SCCM during their engagements." Twitter/X: @unsigned_sh0rt Twitter/X: @synzack21 https://www.linkedin.com/in/garrett-foster86/ https://www.linkedin.com/in/zacharydstein/ ________________________________________________________________ The Red Team Village Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter:...
https://www.youtube.com/watch?v=TmfWYDqEEUo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTV Overflow: "Physical Red Teaming for Offensive Cyber Teams" with Ana Aslanishvili & Shawn Abelson
Ana Aslanishvili (Red Teaming Aficionado) and Shawn Abelson (Ex-Head of Physical Red Team @ Meta, Current Consultant/Trainer for PhySec Red Teaming) - "Offensive security is an unfamiliar concept to most physical security practitioners. Yet we still rely on physical security teams to protect our hardware, network, ports, and assets. Physical security professionals are often non-technical, former law enforcement/military, and are focused on protecting people instead of property. This talk will bridge the gap between physical and cyber red teaming, covering the best approaches, common pitfalls, dangers, and benefits of testing physical security programs as part of a red team assessment. From the difficulty of “patching” physical vulnerabilities to examples of red teams gone wrong and how...
https://www.youtube.com/watch?v=FZS32kb5IXk
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Do you know this common Go vulnerability?
When auditing code it's crucial to know about common issues. In this video we explore a Go issue that I was not aware of. Learn hacking on https://www.hextree.io/ (ad) 38c3 CTF - Fajny Jagazyn Wartości Kluczy: https://2024.ctf.link/internal/challenge/fb03748d-7e94-4ca2-8998-a5e0ffcbd761/ Unintended solution: https://msanft.foo/blog/hxp-38c3-web-fajny-jagazyn/ Challenge author writeup: https://hxp.io/blog/114/hxp-38C3-CTF-Fajny-Jagazyn-Wartoci-Kluczy/ VSCode Go debugger client code: https://github.com/golang/vscode-go/blob/39786ea90f18ab98f75d091b9a04367d1b1df82c/extension/src/debugAdapter/goDebug.ts#L1557 00:00 - Intro 00:20 - Go gjson vs json behavior 01:33 - Overview CTF challenge "Fajny Jagazyn Wartości Kluczy" 04:33 - Weird server setup? 05:55 - Arbitrary file read 07:00 - /proc...
https://www.youtube.com/watch?v=wVknDjTgQoo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RADAR Contact! An Obscure Evidence of Execution Artifact
In this episode, we'll take a look at a rather obscure evidence of execution artifact associated with RADAR, the Resource Exhaustion Detection and Resolution system. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:16 - What You Need to Know 🛠 Resources The Mystery of the HeapLeakDetection Registry Key: https://harelsegev.github.io/posts/the-mystery-of-the-heapleakdetection-registry-key/ HeapLeakDetection Registry Forensics: https://github.com/MHaggis/HeapLeakDetection #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics
https://www.youtube.com/watch?v=edJa_SLVqOo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Emulating FIN6 - Active Directory Enumeration Made EASY
In this episode of the FIN6 Adversary Emulation series, we focus on Active Directory (AD) enumeration—a critical phase in FIN6's discovery techniques. Understanding how adversaries enumerate Active Directory environments will help you refine your tradecraft or improve your detection and mitigation capabilities if you are a Blue Teamer. In this video, you will learn how FIN6 performs Active Directory enumeration, and how to use native Windows commands like "net" and PowerShell's "Get-AD*" cmdlets for AD Enumeration. You will also learn how to utilize "AdFind.exe" to extract information from an Active Directory Environment. The lab environment used in this demonstration is available for free on CYBER RANGES, allowing you to follow along and practice these techniques in a safe and controlled...
https://www.youtube.com/watch?v=Iwxmscx3XXc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

A Scammer Tried to Hack Me!
🚨🚔 I was recently offered a video sponsorship opportunity which turned out to be a DocuSign scam! They said they liked my videos but really just wanted to infect me with some malware 😿 Anyway, I thought I'd make a quick educational video to raise awareness. I'll explain what raised my suspicions and how I confirmed that the scammer was trying to hack me! #MalwareAnalysis #CyberSecurity #CyberSecurityAwareness #InfoSec #ScamBaiting #CryptoCat 🦠Malware Analysis🦠 VirusTotal: https://www.virustotal.com/gui/file/8f6f207277a8881e9c2042de4dc3a7c824eaa0334f522d96d412a2dfe5f93820/detection APP.ANY.RUN Analysis: https://app.any.run/tasks/78722395-a017-4ac5-a18c-47464aae63a7 APP.ANY.RUN Safebrowsing: https://app.any.run/browses/6a13f769-5ec1-43e4-bc23-71f076e04e36 DocuSign Scams: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00...
https://www.youtube.com/watch?v=v8ZwlKAjMJA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The SECRET to Embedding Metasploit Payloads in VBA Macros
In this episode of the Offensive VBA series, we explore how to integrate PowerShell payloads and stagers into custom VBA macros for initial access. Specifically, we'll demonstrate how to repurpose and format PowerShell stagers generated by Msfvenom and PowerShell-Empire to execute a reverse shell. This video will teach you how to format and embed HTA-based PowerShell payloads inside a VBA macro. // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU 🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6 // MORE RESOURCES HACKERSPLOIT BLOG ►► https://bit.ly/3qjvSjK HACKERSPLOIT FORUM ►► https://bit.ly/39r2kcY HACKERSPLOIT ACADEMY ►►...
https://www.youtube.com/watch?v=Q1wQuHw5JKI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

RTV Overflow
RTV Overflow is a full-day virtual event packed with some of your favorite workshops from DEFCON 32! Starting at 10:00 AM ET, the event features hands-on workshops including sessions on breaching Kubernetes clusters, physical red teaming strategies, and advanced cloud exploitation techniques. Get a behind-the-scenes look at RTV's mission, learn how our CTF comes to life, and discover opportunities to contribute to the village at the upcoming DEF CON 33. With sessions led by top professionals this event is your gateway to mastering real-world red team techniques and connecting with the global offensive security community. Visit redteamvillage.io to learn more about our mission and sign up!
https://www.youtube.com/watch?v=JMTMEEqaBKg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Offensive VBA 0x4 - Reverse Shell Macro with Powercat
In this episode of the Offensive VBA series, we dive into one of the most powerful techniques for red teamers—creating a reverse shell VBA macro using Powercat. This technique enables stealthy command execution and remote access through malicious macro-enabled Office documents. In this video, you will learn how to build a reverse shell VBA Macro that leverages Powercat allowing you to stealthily execute remote commands in-memory using PowerShell. Powercat: https://github.com/besimorhino/powercat // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU 🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6 // MORE RESOURCES HACKERSPLOIT BLOG ►►...
https://www.youtube.com/watch?v=0W3Z3Br56XM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Offensive VBA 0x3 - Developing PowerShell Droppers
In this episode of the Offensive VBA series, we take VBA macros to the next level by developing PowerShell droppers designed for red team operations. Learn how to craft stealthy and effective VBA scripts that deliver and execute PowerShell payloads seamlessly. Here's what we'll cover: Writing VBA macros to execute PowerShell scripts, executing payloads directly in memory for stealth, leveraging environment variables to identify system paths dynamically, and techniques to remove traces of macro execution for stealthier operations // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU 🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6 // MORE...
https://www.youtube.com/watch?v=ot3053UxJOc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Offensive VBA 0x2 - Program & Command Execution
Welcome to the second episode of the Offensive VBA series, where we explore how to execute programs and system commands using VBA macros—essential skills for red teamers looking to leverage VBA for initial access and automation. In this video, you will learn how to use the Shell function to run external programs and commands and leverage the WScript.Shell object for enhanced control over command execution. You will also learn how to use the Shell Window Style options to ensure stealth during execution. // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU 🎥 Have an idea for a video? make your submission here: https://forms.gle/VDwwMsuudzQfT9VM6 // MORE RESOURCES HACKERSPLOIT BLOG...
https://www.youtube.com/watch?v=ogbrNZ3SCRY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Why Traditional Pentesting Is Letting You Down (and How to Fix It)
Pentesting is overdue for a refresh. Traditional pentesting methods—slow, checklist-driven, and lacking visibility—can no longer keep up with today's dynamic security landscape. The result is critical security gaps that leave organizations exposed to rapidly evolving threats. In this webinar, you'll learn why traditional pentesting methods are failing and how Pentest as a Service (PTaaS) is reshaping the future of security testing. By combining a skills-vetted global pentester community with the efficiency of the HackerOne PTaaS platform, organizations can achieve real-time results, unmatched flexibility, and deeper integration with modern DevOps workflows. Join us for insights into: Common pitfalls of traditional pentesting, such as inexperienced testers and slow reporting cycles How...
https://www.youtube.com/watch?v=db9ecB0izCA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Offensive VBA 0x1 - Your First Macro
Welcome to the first episode of the Offensive VBA series, where we equip red teamers with the skills to leverage VBA for initial access and offensive operations. This video introduces you to Visual Basic for Applications (VBA)—a powerful scripting language integrated into Microsoft Office. Here's what we'll cover: What is VBA?: An overview of how VBA works and integrates with MS Office, A walkthrough of the Integrated Development Environment (IDE) and its features, and How to create and run a basic macro. Core Concepts: - Subroutines, Functions, and their calls. - Variable declaration, data types, and scope. - User input/output with MsgBox and control statements. // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation...
https://www.youtube.com/watch?v=jGy7_NusjuQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Emulating FIN6 - Gaining Initial Access (Office Word Macro)
Welcome to the next installment in our adversary emulation series! This video focuses on emulating initial access via a spear-phishing attachment—specifically, a malicious Word document with an embedded macro, just like FIN6 might use. 🚨 Next Up: If you want to manually develop your own VBA macros for initial access, don't worry—we've got you covered in the next video, where we'll dive deeper into crafting custom macros for red team operations. 🎥 Practical Labs: This video uses the CYBER RANGES platform to simulate a realistic attack environment. Try it out and follow along! // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU The lab used in this video: https://app.cyberranges.com/scenario/624cd3877733a30007185a15 🔗...
https://www.youtube.com/watch?v=hUBRnh5dzrI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Broken Security Promises: How Human-AI Collaboration Rebuilds Developer Trust
Traditional security approaches have long frustrated developers, creating friction and eroding trust. The endless vulnerability backlogs must become a thing of the past. Discover a fresh approach that transforms security from a bottleneck to a strategic advantage, where AI-powered insights work in harmony with human-in-the-loop expertise to rewrite the rules of code security and ship more secure code faster. Learn how combining artificial intelligence with human expertise will enable developers to: - Receive actionable, context-aware security feedback that doesn't interrupt development - Reduce false positives through intelligent human-in-the-loop analysis - Benefit from contextual, just-in-time security training We'll showcase real-world examples of how this human-AI collaborative approach...
https://www.youtube.com/watch?v=OZcaX38B2F8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

USB Ethernet Adapter Malware??? Chinese RJ45-USB Full Analysis - Part 1
Reverse engineering all stages with line by line code analysis. e3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359 OP https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memory-exe-recognized-as-malware -- OALABS PATREON https://www.patreon.com/oalabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ OALABS DISCORD https://discord.gg/6h5Bh5AMDU Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs
https://www.youtube.com/watch?v=3IfJSGWIrCo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

FIN6 Adversary Emulation Plan (TTPs & Tooling)
Step into the world of adversary emulation with this in-depth video on the FIN6 Emulation Plan. Learn how to use the Center for Threat-Informed Defense (CTID) Adversary Emulation Library to craft a comprehensive emulation plan that replicates FIN6's sophisticated TTPs. This video will provide you with: An intelligence summary of FIN6, and the FIN6 emulation plan detailing TTPs from initial access to discovery, privilege escalation, and exfiltration. The Adversary Emulation Fundamentals labs used in this video and series are available for free on CYBER RANGES to practice and refine your emulation skills. // Adversary Emulation Labs New to CYBER RANGES? Register here: https://bit.ly/40dRMsb CYBER RANGES Adversary Emulation Labs (Free): https://bit.ly/4amBPEU Lab used in this video: https://app.cyberranges.com/scenario/624cb3bd7733a30007185990 🔗...
https://www.youtube.com/watch?v=qEfk44G4zFM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Developing An Adversary Emulation Plan
Creating an adversary emulation plan is a critical process for red teamers and cybersecurity professionals aiming to improve their organization's threat detection and response capabilities. In this video, we break down the entire process starting with how to select a threat actor relevant to your industry or geolocation, finding and leveraging Cyber Threat Intelligence (CTI) to gather insights on the adversary, and mapping the adversary's TTPs using the MITRE ATT&CK framework. 🔗 Video Resources & References Explore the comprehensive APT Groups and Operations Directory to find details on APT groups by region, their TTPs, and campaigns: https://apt.threattracking.com APTnotes: https://github.com/kbandla/APTnotes APT & CyberCriminal Campaign Collection: https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections //...
https://www.youtube.com/watch?v=1N49x1EWw7s
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How 3 Hackers Combined Their Skills for Big Bounties! (And how you can do it too)
Join us in this special episode as we sit down with the winners of Bugcrowd's Hacker Showdown Carnival of Chaos virtual event: sw33tLie, bsysop, and godiego! Discover their hacking methodologies, collaboration techniques, and their journey to victory. Learn how they met, their advice for forming your own team, and the coolest exploits they uncovered during the event. If you're interested in bug bounties, team hacking, or just want to meet more hacker friends, this episode is a must-watch! 00:00 Introduction and Special Guests 01:04 Meet the Hackers 02:55 Carnival of Chaos Experience 04:32 Collaboration and Team Dynamics 06:15 Roles and Strategies in Hacking 13:00 Finding the Right Collaborators 15:25 Live Hacking Events vs. Virtual Events 22:30 Coolest Findings and Bug Stories 29:52 Advice...
https://www.youtube.com/watch?v=gUuDyIE44bc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

HackerOne Live Hacking Event Recap: Edinburgh w/ Amazon and AWS
In September, some of the best security researchers in the world joined the Amazon and AWS teams in Edinburgh, Scotland, for a live-hacking event fit for a Scottish king. 👑 This collaboration with the security researcher community is vital to Amazon and AWS' commitment to comprehensive security for their users and customers. See the highlights and which security researchers were able to climb to the top of the leaderboard. For more information about HackerOne, visit https://www.hackerone.com/
https://www.youtube.com/watch?v=xIIPn4CV9eM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Introduction To Advanced Persistent Threats (APTs)
This informative video is designed to give you a comprehensive understanding of Advanced Persistent Threats (APTs). In this video, you will learn what APTs are, how they differ from traditional threat actors, and why they pose a significant challenge to organizations worldwide. This video also explores the categorization and naming of APT Groups based on nation-state affiliation, motivations, and the tactics they employ to achieve their objectives. This video also sheds light on the complexities of APT naming conventions used by major cybersecurity vendors, such as CrowdStrike and Mandiant, and the challenges in tracking these elusive groups. 🔗 Don't miss this resource: Access the "APT Groups and Operations" repository here: https://apt.threattracking.com — a comprehensive spreadsheet...
https://www.youtube.com/watch?v=CwSG5sa0Nao
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

HackerOne Customer Testimonial: Amazon and AWS
For Amazon and AWS, their bug bounty programs give their security teams unique insight into their entire digital landscape. Through their programs, the Amazon and AWS teams work with researchers from around the world to continuously test their platform and products. See how their teams regularly engage the researcher community to protect customer data, drive collaboration, and foster knowledge sharing. For more information on HackerOne products visit: https://www.hackerone.com/
https://www.youtube.com/watch?v=pNJNdrZN0YA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Be Kind, Rewind... The USN Journal
In this episode, we'll explore groundbreaking research from CyberCX on “rewinding the NTFS USN Journal.” This innovative technique reveals how to uncover the original locations of files recorded in the USN Journal, even after their corresponding NTFS FILE records have been reused by different files. 🛑 If you need a refresher on the prerequisites for this episode, watch these: Introduction to MFTECmd - NTFS MFT and Journal Forensics: https://www.youtube.com/watch?v=_qElVZJqlGY Anatomy of an NTFS FILE Record - Windows File System Forensics: https://www.youtube.com/watch?v=l4IphrAjzeY NTFS FILE Record Reuse: https://www.youtube.com/watch?v=6LpJVx7PrUI *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 05:03...
https://www.youtube.com/watch?v=GDc8TbWiQio
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

403 Bypass and Deserialization in BentoML Library (CVE-2024-2912) - "Summar-AI-ze" [Web Challenge]
🚩 Video walkthrough for the "Summar-AI-ze" (web) challenge I created and hosted on my NEW website (https://cryptocat.me)!! Players were required to bypass a 403 error by using the X-Forwarded-For HTTP header, allowing them to activate an internal feature and grant their account beta access. The "beta" feature was a word summarization tool, running BentoML (LLM) on the backend. Players could identify the library by changing the content-type, triggering an error. Some research would yield CVE-2024-2912; a python pickle deserialization vulnerability, discovered by PinkDraconian 💜 Players could use the supplied PoC to gain code execution and exfiltrate the flag using curl 😎 #CTF #Challenge #CryptoCat Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/monthly/cryptocat/summaraize Join...
https://www.youtube.com/watch?v=5NCzDZcx_Dg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Advent of Cyber Day 24: MQTT & Wireshark
Check out TryHackMe's Advent of Cyber Event: https://tryhackme.com/r/christmas?utm_source=youtube&utm_medium=social&utm_campaign= Join Katie, aka InsiderPhD, on the 24th day of TryHackMe's Advent of Cyber! Today, we're diving into the mysterious world of communication protocols, focusing on the MQTT protocol. Discover how the city of Wereville faces off against Mayor Malware's sabotage of smart lights and HVAC systems. Using Wireshark, Katie demonstrates how to analyze MQTT traffic, understand the publish-subscribe model, and reverse engineer networking protocols. With a blend of British humour and hands-on learning, Katie leads you through the process of identifying malicious commands and securing IoT devices. By the end, you'll learn how to troubleshoot smart devices, monitor network...
https://www.youtube.com/watch?v=ct6393M_Iow
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

From Report to Results: Building Resilience with Insights from the Hacker-Powered Security Report
The 8th Annual Hacker-Powered Security Report just launched. How can you interpret it to make the case for your own human-powered security program, attract more security researchers to your programs, or incentivize more impactful vulnerability reports? This webinar, featuring HackerOne customers and a leading member of our security researcher community, will answer that question. Learn More: https://www.hackerone.com/events/report-results-hacker-powered-security-report
https://www.youtube.com/watch?v=tAGF4pFSs6M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Introduction To Adversary Emulation
This video introduces you to Adversary Emulation and its role in Red Team operations. Furthermore, this video also explains the differences between Adversary Emulation and Simulation. Adversary emulation in the context of Red Teaming is the process of mimicking/emulating the tactics, techniques, and procedures (TTPs) of a threat actor/adversary to test the effectiveness and efficacy of an organization's defenses. //PLATFORMS BLOG ►► https://bit.ly/3qjvSjK FORUM ►► https://bit.ly/39r2kcY ACADEMY ►► https://bit.ly/39CuORr //SOCIAL NETWORKS TWITTER ►► https://bit.ly/3sNKXfq DISCORD ►► https://bit.ly/3hkIDsK INSTAGRAM ►► https://bit.ly/3sP1Syh LINKEDIN ►► https://bit.ly/360qwlN PATREON ►► https://bit.ly/365iDLK MERCHANDISE ►► https://bit.ly/3c2jDEn //BOOKS Privilege...
https://www.youtube.com/watch?v=CUMhiSdOSkY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Advent of Cyber Day 13: Exploring WebSocket Vulnerabilities with InsiderPhD
Check out TryHackMe's Advent of Cyber Event: https://tryhackme.com/r/christmas?utm_source=youtube&utm_medium=social&utm_campaign= Join me, in today's TryHackMe Advent of Cyber Day 13 walkthrough, where she diving into WebSockets and WebSocket message manipulation vulnerabilities. Learn about WebSocket message manipulation, common security risks such as weak authentication, message tampering. Follow along as I demonstrates how to identify and exploit WebSocket vulnerabilities in a web application. Perfect for anyone interested in web security, bug bounty hunting, and real-time communication protocols. 00:00 Introduction and Welcome 00:26 Story Setup: The Threat in Wareville 01:22 Understanding WebSockets 02:54 WebSocket Vulnerabilities 04:08 WebSocket Message Manipulation 07:33 Practical...
https://www.youtube.com/watch?v=ozgRXn44FF0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Mastering Persistence: Using an Apache2 Rootkit for Stealth and Defense Evasion
In this video, I demonstrate the process of establishing persistence and evading defenses on Linux through the use of an Apache2 rootkit. The lab used in this video can be accessed for free on the CYBER RANGES platform. The links to the platform and lab are listed below: // CYBER RANGES CYBER RANGES: https://app.cyberranges.com SQL Injection Lab: https://app.cyberranges.com/scenario/67474e64a3907f65136f1a6d //LINKS Apache2 Rootkit: https://github.com/ChristianPapathanasiou/apache-rootkit //PLATFORMS BLOG ►► https://bit.ly/3qjvSjK FORUM ►► https://bit.ly/39r2kcY ACADEMY ►► https://bit.ly/39CuORr //SOCIAL NETWORKS TWITTER ►► https://bit.ly/3sNKXfq DISCORD ►► https://bit.ly/3hkIDsK INSTAGRAM ►► https://bit.ly/3sP1Syh LINKEDIN ►► https://bit.ly/360qwlN PATREON...
https://www.youtube.com/watch?v=Ra2altDvPYI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

XSS via CSPT and DOM Clobbering - "SafeNotes 2.0" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Safe Notes 2.0" (web) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! The developer of Safe Notes learnt from their mistakes and introduced a variety of security fixes, but unfortunately introduced new vulnerabilities! Players were required to chain DOM Clobbering, client-side path traversal (CSPT) and an Open Redirect in order to achieve XSS and steal the admin's cookie. 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/2024/intigriti/web/safenotes_2 Check out Safe Notes v1 challenge and walkthrough here: https://challenge-0824.intigriti.io + https://youtu.be/yGRRGUtT9MU 🐛INTIGRITI 1337UPLIVE CTF🐞 https://ctftime.org/event/2134 https://ctf.intigriti.io https://discord.gg/intigriti-870275171938873395 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00...
https://www.youtube.com/watch?v=G-KoF8WAoUM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

NTFS FILE Record Reuse
In this continuation of "Anatomy of an NTFS FILE Record," we'll learn how NTFS manages record reuse and distinguishes between in-use and deleted files and directories. If you haven't watched the previous episode, watch it here: https://www.youtube.com/watch?v=l4IphrAjzeY *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:31 - NTFS Master File Table (MFT) artiFACTS 01:49 - Analysis #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics
https://www.youtube.com/watch?v=6LpJVx7PrUI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Basic Stack Buffer Overflow (with parameters) - "Retro2Win" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Retro2Win" (pwn) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! A classic "ret2win" challenge, the binary included a buffer overflow vulnerability, allowing players to take over the flow of execution and call a "win" function. In this case, the function expected two parameters, requiring values to be popped into the RDI/RSI registers first 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/2024/intigriti/pwn/retro2win 🐛INTIGRITI 1337UPLIVE CTF🐞 https://ctftime.org/event/2134 https://ctf.intigriti.io https://discord.gg/intigriti-870275171938873395 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00 Intro 0:13 Basic file checks 0:50...
https://www.youtube.com/watch?v=Y37KMst1XFU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

X-Forwarded-For Header Spoofing and XXE - "BioCorp" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "BioCorp" (web) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! Players arrived an a website for an energy corporation, with a hint that they were working on decoupling their backend infrastructure from the public facing website. By analysing the source code, players would find a hidden panel, restricted by IP address. By setting the X-Forwarded-For header, they could spoof the IP and gain access to a nuclear panel. Since the panel read XML data, players would test for XXE and ultimately recover the flag 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/2024/intigriti/web/biocorp 🐛INTIGRITI 1337UPLIVE CTF🐞 https://ctftime.org/event/2134 https://ctf.intigriti.io https://discord.gg/intigriti-870275171938873395 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00...
https://www.youtube.com/watch?v=hyi_JZvXOTU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

5 Things You Need to Learn From the New Hacker-Powered Security Report
As the cybersecurity landscape continues to change, understanding the perspectives of security researchers is essential for effective risk management. In this 30-minute live webinar session, we'll dive into the top five takeaways from the 8th Annual Hacker-Powered Security Report. With practical examples and actionable recommendations, you'll learn how to: - Ensure that AI deployments are secure and trustworthy - Enhance your approach to vulnerability management - Implement demonstrably valuable security measures Join this fast-paced exploration of the vital role of human expertise in the AI era. To download the full report, visit: hackerone.com/report
https://www.youtube.com/watch?v=1DdY6lV3Llc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The Impact of Collaboration

https://www.youtube.com/watch?v=n2Z-kaRr2ws
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

One Time Pad (OTP) with a Twist - "Schrödinger's Pad" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Schrödinger's Pad" (crypto) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! The challenge included a common vulnerability; reusing a one-time-pad (OTP). There was a slight twist; for each encryption, the box would be observed. If the cat is alive, some cryptographic operations would take place. If the cat is dead, some different operations occur - players need to reverse it! 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/2024/intigriti/crypto/schrodingers_pad 🐛INTIGRITI 1337UPLIVE CTF🐞 https://ctftime.org/event/2134 https://ctf.intigriti.io https://discord.gg/intigriti-870275171938873395 👷‍♂️Resources🛠 https://cryptocat.me/resources Overview: 0:00...
https://www.youtube.com/watch?v=9NrmlOBcF1c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

JWT Algorithm Confusion and SSTI (Pug) - "Cat Club" [INTIGRITI 1337UP CTF 2024]
🚩 Video walkthrough for the "Cat Club" (web) challenge I made for Intigriti's 1337UP LIVE (CTF) competition 2024! The challenge featured a server-side template injection (SSTI) vulnerability in the user welcome message. However, there is a problem; the username is sanitized on registration and then rendered from the JWT, which is signed using an RS256 private key. Players must exploit an algorithm confusion vulnerability to tamper with the JWT, changing their username to an SSTI (pug) payload. There's no command output, so to return the flag they will also need to develop a blind payload (e.g. return flag to web server logs) 😎 #1337UP #1337UPLIVE #CTF #INTIGRITI #HackWithIntigriti Check out the accompanying writeup here: https://book.cryptocat.me/blog/ctf/2024/intigriti/web/cat_club 🐛INTIGRITI...
https://www.youtube.com/watch?v=Vh9SqT9KyL8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

13Cubed XINTRA Lab Walkthrough
In this episode, we'll perform a comprehensive walkthrough of the 13Cubed challenge created for XINTRA Labs. Learn more at https://www.xintra.org/labs. 💰 For a limited time only, use the discount code "13CUBED" to get 15% off a XINTRA Labs subscription! 🙏 Special thanks to Mike Peterson from https://nullsec.us for playing the role of Threat Actor in our scenario! *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:58 - Workstation - Running MemProcFS 03:25 - Workstation - Question 1 05:14 - Workstation - Question 2 07:06 - Workstation - Question 3 07:53 - Workstation - Question 4 09:42 - Workstation - Question 5 12:42 - Workstation - Question 6 15:31 - Workstation - Question 7 17:34 - Workstation -...
https://www.youtube.com/watch?v=A7Bh7vnAooQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Review: This Is How They Tell Me the World Ends (not with a bang but with a bug)
Join me on a brand-new series as I indulge my childhood dream of creating a personal library, focusing on InfoSec books! Kicking things off, we dive into 'This Is How They Tell Me How The World Ends' by Nicole Perlroth. Despite being an ebook enthusiast, I decided it was high time to fill my custom-built bookcase with real books. We'll explore the fascinating histories and personal stories behind bug bounties, zero days, and cyber warfare, all narrated with the flair of a seasoned journalist. From cyber politics to sassy hacker quips - what did happen to that salmon anyway? To how hackers take on the global stage of politics 00:00 Introduction to the Quest for Infosec Books 00:29 Building the Dream Library 00:55 E-Readers vs. Physical Books 02:41 Criteria for Book Selection 04:44 First Book...
https://www.youtube.com/watch?v=OvUmumbiGRI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Understanding the Bugcrowd VRT: An Insider's Guide
Join us at DEF CON as we sit down with Codingo, VP of Operations at Bugcrowd, to look into the Vulnerability Rating Taxonomy (VRT). Learn what makes the VRT unique, how it compares to other vulnerability rating systems like CVSS, and why it's a key part of Bugcrowd's platform. Discover how the VRT evolves, the community's role in its development, and essential tips for hackers advocating for higher priorities on their findings. Whether you're a seasoned Bugcrowd hacker or new to the platform, this interview offers valuable insights and practical advice for improving your skills and understanding of the VRT. 00:00 Introduction to the VRT and Bugcrowd 00:33 Bugcrowd's Unique Offerings for Hackers 01:19 Understanding the VRT: An Interview with Kodinga 02:22 Differences Between VRT and CVSS 03:09...
https://www.youtube.com/watch?v=AIJK_Lw8rKw
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Google's Mobile VRP Behind the Scenes with Kristoffer Blasiak (Hextree Podcast Ep.1)
"There are not that many people that do Android research [...] There is no lack of targets. If people would actually look, there is lots to it. The scope is huge." - This is a conversation with Kristoffer Blasiak about Google's Mobile Vulnerability Rewards Program (VRP). Learn Android Hacking (ad): https://hextree.io/hextree-x-google Mobile VRP: https://bughunters.google.com/about/rules/android-friends/6618732618186752/google-mobile-vulnerability-reward-program-rules 00:00 - Introducing Kristoffer and Mobile VRP 01:38 - What happens when you submit a bug 05:07 - Android app bug bounty opportunities 08:38 - "There is no lack of targets" 13:06 - The side-loading threat model 17:00 - Bugs in Android app vs. web app 23:30 - Hextree sponsored by Google =[ ❤️ Support ]= → per Video:...
https://www.youtube.com/watch?v=SyTy1uZgx8E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Reverse Engineering LAB Setup Tutorial (updated)
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials. The full notes for this tutorial are unlocked for everyone on our Patreon including links to all of the tools mentioned https://www.patreon.com/posts/101718688 ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=adAr0KBJm4U
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Get Bigger Bounties With Better Reports
At DEFCON a few weeks ago, I sat down with Codingo, VP of operations to talk about the key elements of writing an effective bug report, especially for non-native English speakers and beginners. We also discuss the importance of clarity, accurate replication steps, and the impact of comprehensive report writing on your bug bounty success. Learn from Bugcrowd's framework and community-driven practices to enhance your cybersecurity skills and make a stronger impact with your findings. 00:00 Introduction and Apology 00:37 Sponsor Message: Bugcrowd 01:22 Live from DEF CON 01:53 The Importance of Report Writing 02:17 Key Elements of a Good Report 04:46 Challenges in Report Writing 06:11 The Triage Process 08:21 Support for Non-Native English Speakers 09:17 Common Reasons for Bug Rejection 11:09...
https://www.youtube.com/watch?v=hnU0mRl0WBI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Linux Memory Forensics Challenge
Welcome to a special Linux Memory Forensics Challenge from 13Cubed. This is an excellent opportunity to get some hands-on practice with Linux memory forensics. You'll find the questions below, as well as a link to download the memory sample needed to answer those questions. 🎉 Check out the official training courses from 13Cubed at https://training.13cubed.com! HINT 1: To get started, run the Volatility 3 banners plugin to determine the correct kernel version, and subsequently install the correct symbols and create the ISF. HINT 2: The kernel version in use on this Ubuntu 22.04 machine was 6.5.0-41. It is recommended that Ubuntu 22.04 be used for the analysis. 🛑 CONTEST IS CLOSED 🛑 All winners have been selected. We still encourage you to participate in the lab, as we believe it...
https://www.youtube.com/watch?v=IHd85h6T57E
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

My theory on how the webp 0day was discovered (BLASTPASS)
Want to learn more about hacking? Checkout our courses on https://www.hextree.io (ad) I have spent many hours looking at the webp vulnerability used in the 0day attack against iPhones. In the past videos we have seen why fuzzers have a hard time finding the issue, so I wanted to understand how this was discovered. And I think I have a good theory! Part 1: Huffman Tables https://youtu.be/lAyhKaclsPM Part 2: Fuzzing libwebp https://youtu.be/PJLWlmp8CDM Sources: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/ https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://github.com/libjxl/libjxl/blob/4b9dbde293f7f282b6952a02340300abfca2b184/lib/jxl/huffman_table.cc#L51 https://github.com/webmproject/libwebp/blob/7861947813b7ea02198f5d0b46afa5d987b797ae/src/dec/vp8l_dec.c#L86C3-L86C76 https://github.com/Tencent/mars/blob/9ab46e19ed3d4fcafe9d0de4b36547321f5ead83/mars/comm/windows/zlib/inftrees.h#L41 https://github.com/google/brunsli/blob/master/c/enc/jpeg_huffman_decode.h#L20 00:00...
https://www.youtube.com/watch?v=_ACCK0AUQ8Q
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Shimcache Execution Is Back - What You Need to Know!
In this special episode, Mike Peterson from nullsec.us joins us to discuss important new research on Shimcache/AppCompatCache. Discover how this artifact can potentially be used to prove execution in Windows 10 and later—a capability that was previously thought impossible! *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:08 - Shimcache/AppCompatCache artiFACTS 09:38 - nullsec.us Research 18:40 - Wrap-up 🛠 Resources Original research from Eric Zimmerman: https://github.com/EricZimmerman/AppCompatCacheParser/issues/6 GitHub commit for AppCompatCacheParser adding the functionality (March 2023): https://github.com/EricZimmerman/AppCompatCacheParser/commit/c995e82a58684bb15a46c34729c99a4024aaf8b3#diff-e5f34b98fc08cf3da1819cd0652cb2c28a785e4f2bab8cccfb0d7fe2cb99cff9R79 For...
https://www.youtube.com/watch?v=DsqKIVcfA90
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Learn Android Hacking! - University Nevada, Las Vegas (2024)
During DEF CON and Black Hat, Google invited me to give a talk about Android hacking to students as part of init.g at the University Nevada, Las Vegas. In this talk I share my "trick" how to get into Android hacking and reverse engineering, which can also be adapted to any other topic. Learn android hacking (ad): https://app.hextree.io/map/android Watch my Vegas Vlog: https://www.youtube.com/watch?v=bhQ6FF3fCdA Article about the init.g event: https://www.unlv.edu/announcement/academics/google-sponsors-initgvegas-student-event-unlv-during-defcon =[ ❤️ Support ]= → per Video: https://www.patreon.com/join/liveoverflow → per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join 2nd Channel: https://www.youtube.com/LiveUnderflow =[ 🐕 Social ]= → Twitter: https://twitter.com/LiveOverflow/ →...
https://www.youtube.com/watch?v=fPt6fJDjKKM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC32 - Red Team Village - Recap
Thank you to everyone who attended the village this year at DEF CON! Another huge thank you to our core team, sponsors, volunteers, goons, and DEF CON! Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=xjKxLoz0Dw4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

My Trip to Las Vegas for DEFCON & Black Hat
My second time in Las Vegas for DEF CON and Black Hat. Lots has changed since I have been here 6 years ago. This trip was quite emotional for me and I am so grateful for the experience. Hope to meet you all again. Learn hacking (ad): https://app.hextree.io/ Buy our Faultier (US): https://1bitsquared.com/collections/embedded-hardware/products/faultier Google x Hextree Android Courses: https://www.hextree.io/hextree-x-google Raspberry Pi Hacking Challenge: https://www.hextree.io/rp2350 Embedded System Village: https://embeddedvillage.org/ My previous DEF CON 26 (6 years ago) Vlog: - https://youtu.be/B8saYocsI-U - https://www.youtube.com/watch?v=RXgp4cDbiq4 =[ ❤️ Support ]= → per Video: https://www.patreon.com/join/liveoverflow → per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join 2nd...
https://www.youtube.com/watch?v=bhQ6FF3fCdA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC32 - Red Team Village x Amazon
Thank you Amazon for being a platinum sponsor! For more information about Amazon, please visit https://amazon.com. Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=ouv0tgFmo8M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

DC32 - Red Team Village x Kindo
Thank you Kindo for being a platinum sponsor! For more information, please visit https://kindo.ai. Red Team Village Website: https://redteamvillage.io Discord: https://redteamvillage.io/discord Twitter: https://redteamvillage.io/twitter
https://www.youtube.com/watch?v=-1wBcsNVqPo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Planning Red Team Operations | Scope, ROE & Reporting
Hey guys, HackerSploit here back again with another video. This video outlines the process of planning and orchestrating Red Team operations. This video also outlines various Red Team resources, guides, and templates to plan and orchestrate a successful Red Team Operation. //LINKS & RESOURCES REDTEAM.GUIDE: https://redteam.guide/ The slides and written version of this video can be accessed on the HackerSploit Forum: https://forum.hackersploit.org/t/introduction-to-the-mitre-att-ck-framework/9127 //HACKERSPLOIT PLATFORMS BLOG ►► https://bit.ly/3qjvSjK FORUM ►► https://bit.ly/39r2kcY ACADEMY ►► https://bit.ly/39CuORr //SOCIAL NETWORKS TWITTER ►► https://bit.ly/3sNKXfq INSTAGRAM ►► https://bit.ly/3sP1Syh LINKEDIN ►► https://bit.ly/360qwlN PATREON ►► https://bit.ly/365iDLK MERCHANDISE...
https://www.youtube.com/watch?v=usDt-s2sACI
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Mapping APT TTPs With MITRE ATT&CK Navigator
Hey guys, HackerSploit here back again with another video. This video will introduce you to the MITRE ATT&CK Navigator and will illustrate how it can be operationalized for planning and orchestrating Red Team operations. MITRE ATT&CK Framework: https://attack.mitre.org/ MITRE ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/ //PLATFORMS BLOG ►► https://bit.ly/3qjvSjK FORUM ►► https://bit.ly/39r2kcY ACADEMY ►► https://bit.ly/39CuORr //SOCIAL NETWORKS TWITTER ►► https://bit.ly/3sNKXfq DISCORD ►► https://bit.ly/3hkIDsK INSTAGRAM ►► https://bit.ly/3sP1Syh LINKEDIN ►► https://bit.ly/360qwlN PATREON ►► https://bit.ly/365iDLK MERCHANDISE ►► https://bit.ly/3c2jDEn //BOOKS Privilege Escalation Techniques ►► https://amzn.to/3ylCl33 Docker...
https://www.youtube.com/watch?v=hN_r3JW6xsY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Mounting Linux Disk Images in Windows
Learn how to mount Linux disk images in Windows using the Windows Subsystem for Linux (WSL). We'll tackle common issues and their fixes. ⌨️ Command used in the video: sudo mount -o ro,loop,offset=[OFFSET],noload [IMAGE] /mnt/[MOUNTPOINT] If you're mounting images containing Logical Volume Management (LVM) volumes, additional steps are required: ✅ Install LVM2 (if not already installed) sudo apt install lvm2 (Debian/Ubuntu) sudo dnf install lvm2 (Fedora) sudo yum install lvm2 (RHEL) ✅ Create a loop device from the disk image: sudo losetup -f -P testimage.dd Here, "-f" tells losetup to find the next available loop device, and "-P" forces the kernel to scan the partition table on the newly created loop device. ✅ Refresh LVM so that the new device appears: sudo pvscan --cache This...
https://www.youtube.com/watch?v=W_youhia4dU
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

New Course! Investigating Linux Devices
Check out Investigating Linux Devices, a comprehensive Linux forensics training course from 13Cubed! Starting with fundamental principles, Investigating Linux Devices rapidly progresses to encompass log analysis, file systems, persistence mechanisms, memory forensics, live response, and more! This course offers extensive hands-on practice and a capstone involving the analysis of a compromised system. Tailored for both beginners and seasoned professionals, it serves as an ideal resource for mastering Linux forensics! 🎉 Enroll today at https://training.13cubed.com! #Forensics #DigitalForensics #DFIR #LinuxForensics
https://www.youtube.com/watch?v=4sRFu_QTkXM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Zombieware
Self-replicating malware, long abandoned by its operators, continues to contribute significant volume and noise to malware feeds. We investigate this trend, which we refer to as Zombieware! Join us on Patreon for Part 2 where we reverse engineer a popular file infector and write an extractor to recover the infected files! https://www.patreon.com/posts/zombieware-part-103656376 Full Zombieware blog post can be found on our UnpacMe blog here: https://blog.unpac.me/2024/04/25/zombieware/ Ladislav Zezula's excellent talk from BSides Prague can be found here: https://www.youtube.com/watch?v=OgXvd-Wce9o ----- OALABS DISCORD https://discord.gg/oalabs OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED...
https://www.youtube.com/watch?v=NNLZmB6_aGA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Should I report this vulnerability? Will I get a bounty?
It's really exciting to find your first bug BUT it's crushing when you realise it isn't reportable or comes back as NA from a client. Here are my top tips for identifying if you've found something and double checking before getting caught up in excitement! I still get emails about IDORs being NA because you need a victims cookie and hackers who are angry at bug bounty programs or triagers.
https://www.youtube.com/watch?v=T4EhE5f7fQg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How to take notes when you suck at it
This episode of the Bug Bounty course we talk about the importance of developing a personal note taking system that supports both hacking and learning. Emphasizing the differentiation between notes taken during hacking activities and those for learning about vulnerabilities. We look at methods for organizing and accessing your notes whether you are into Notion, Obsidian or Vim or even mind maps we'll look at how to integrate your notes with tools like Burp Suite. Creating your own knowledge base you can refer to every time you hack, tailored to individual needs and preferences and refine your own note-taking strategies for successful hacking and learning. 00:00 Introduction to the Bug Bounty Course 00:14 The Importance of a Personalized Note-Taking System 00:53 Sponsor Shoutout: Bugcrowd 01:45...
https://www.youtube.com/watch?v=uXuMvUPlvd0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Finding The .webp Vulnerability in 8s (Fuzzing with AFL++)
A guide on how to do fuzzing with AFL++ in an attempt to rediscover the libwebp vulnerability CVE-2023-4863 that was used to hack iPhones. Want to learn hacking? Signup to https://hextree.io (ad) Buy my shitty font: https://shop.liveoverflow.com/ (ad) Watch webp Part 1: https://www.youtube.com/watch?v=lAyhKaclsPM Sudo Vulnerability Series: https://www.youtube.com/playlist?list=PLhixgUqwRTjy0gMuT4C3bmjeZjuNQyqdx Docker Video: https://www.youtube.com/watch?v=-YnMr1lj4Z8 OSS-Fuzz: https://github.com/google/oss-fuzz OSS-Fuzz libwebp coverage: https://storage.googleapis.com/oss-fuzz-coverage/libwebp/reports/20230901/linux/src/libwebp/src/utils/report.html AFLplusplus: https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/fuzzing_in_depth.md vanhauser's blog: https://www.srlabs.de/blog-post/advanced-fuzzing-unmasks-elusive-vulnerabilities vanhauser/thc...
https://www.youtube.com/watch?v=PJLWlmp8CDM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Introduction to YARA Part 4 - Efficient Rule Development
In this OALABS Patreon tutorial we cover the foundations of writing efficient YARA rules and provide some tips that can help speed up your YARA hunting. The full notes for this tutorial are unlocked for everyone on our Patreon https://www.patreon.com/posts/introduction-to-96638239 ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=xKeF_cPKXt0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Introduction to YARA Part 3 - Rule Use Cases
In this OALABS Patreon tutorial we cover the three main use cases for YARA rules and how they apply to both BlueTeam/SOC operations and malware analysis. Fun notes have been unlocked for everyone on our Patreon here https://www.patreon.com/posts/introduction-to-96637668 The following are links to UnpacMe specific tutorials for developing each type of rule. Identifying specific malware families (unpacked) https://support.unpac.me/howto/hunting-with-yara/#identifying-specific-malware-families-unpacked Identifying malware on disk or in network traffic (packed) https://support.unpac.me/howto/hunting-with-yara/#identifying-malware-on-disk-or-in-network-traffic-packed Hunting (malware characteristics) https://support.unpac.me/howto/hunting-with-yara/#hunting-malware-characteristics ----- OALABS...
https://www.youtube.com/watch?v=xutDqu_OiH8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Introduction to YARA Part 2 - Hunting on UnpacMe
In this OALABS Patreon tutorial we demonstrate a simple YARA hunting example using the UnpacMe free YARA scan service: https://www.unpac.me Full notes have been unlocked on our Patreon here https://www.patreon.com/posts/introduction-to-96637337 ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=Xqvlju9ED1c
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Introduction to YARA Part 1 - What is a YARA Rule
In this OALABS Patreon tutorial we cover the basics of YARA, what is it, how is it used, and how to write your first rule. Full notes have been unlocked on our Patreon here https://www.patreon.com/posts/introduction-to-96636471 ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=3BpIhbsDR_I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Approaching Large Scope Targets Without Feeling Overwhelmed
In this video, we discuss how beginners can tackle large scope targets in bug bounty hunting. These targets offer more flexibility and potential for bug discovery, making them a great starting point for new hackers. However, they can be overwhelming due to their size and diversity. We suggest focusing on one part of the larger scope, which helps you understand the target's application development process without becoming overwhelmed. We also delve into different reconnaissance techniques, including subdomain enumeration, Google Dorking, API enumeration, OSINT, and more. Lastly, we emphasize that while reconnaissance is critical for large scope targets, it is just a stepping stone to actually hacking and finding vulnerabilities. This series couldn't happen without the support of our sponsor...
https://www.youtube.com/watch?v=W4pafFxOOwc
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

New OWASP API Top 10 for Hackers
Blog article isn't done yet but I'll get it up ASAP! Today we explore the new OWASP API Top 10 in detail, the new version is much more hacker friendly and focuses on bugs we can find rather than defenders but how can we start to study these bugs and actually find them? Let's take a look at some of the changes in the new OWASP API top 10 2023, which ones I recommend for beginners just starting out with API hacking and when to look out for specific bugs There are a ton of vulnerabilities out there, like Prototype Pollution, SQL Injection, and remote code execution. And while they can be fun to exploit during CTFs but when they are lurking in our code…it's not as fun But that's where our sponsor Snyk comes in - Snyk scans your code, dependencies, containers, and configs, all in...
https://www.youtube.com/watch?v=sl1yqGhuVy4
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

OALABS Holiday Variety Show 2023
𝘔𝘦𝘳𝘳𝘺 𝘐𝘋𝘈𝘮𝘢𝘴 𝘢𝘯𝘥 𝘢 𝘏𝘢𝘱𝘱𝘺 𝘉𝘪𝘯𝘫𝘢-𝘠𝘦𝘢𝘳 Join us for our holiday special reverse engineering variety show! - Guess the prompt AI charades - Random RE banter - Suspicious liquids in bottles We've got it all! Merry Christmas everyone we will see you in 2024! ----- OALABS PATREON https://www.patreon.com/oalabs OALABS DISCORD https://discord.gg/6h5Bh5AMDU Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=XMVhX29AJbQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

A Vulnerability to Hack The World - CVE-2023-4863
Citizenlab discovered BLASTPASS, a 0day being actively exploited in the image format WebP. Known as CVE-2023-4863 and CVE-2023-41064, an issue in webp's build huffman table function can lead to a heap buffer overflow. This vulnerability is very interesting and I'm excited to share with you what I learned. Want to learn hacking? Signup to https://hextree.io (ad) Buy my shitty font: https://shop.liveoverflow.com/ (ad) WebP Fix Commit: https://chromium.googlesource.com/webm/libwebp/+/902bc9190331343b2017211debcec8d2ab87e17a Citizenlab: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ Ben Hawkes: https://blog.isosceles.com/the-webp-0day/ Software Updates Apple https://support.apple.com/en-gb/106361 Chrome https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html Firefox...
https://www.youtube.com/watch?v=lAyhKaclsPM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Tips For Analyzing Delphi Binaries in IDA (Danabot)
Reverse Engineering Delphi is a nightmare ... or it can be if you don't have the right setup! In this clip we cover some easy tips that can help make some of the analysis a bit easier. Full notes with links for tools are available here: https://research.openanalysis.net/danabot/loader/delphi/2023/12/04/danabot.html Full stream with analysis of the Danabot loader is available on Patreon here: https://www.patreon.com/posts/live-stream-vod-94510766 ----- OALABS PATREON https://www.patreon.com/oalabs OALABS DISCORD https://discord.gg/6h5Bh5AMDU Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=04RsqP_P9Ss
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

How To Recognize Macro Encrypted Strings in Malware
How to identify when a macro is used to encrypt strings in malware... inferring source from disassembly! ----- OALABS PATREON https://www.patreon.com/oalabs OALABS DISCORD https://discord.gg/6h5Bh5AMDU Twitch https://www.twitch.tv/oalabslive OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ -----
https://www.youtube.com/watch?v=fEAGYjhKzJY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Reinventing Web Security
Follow me down the rabbit hole into the wonderful world of IT security. Buy my terrible font (ad): https://shop.liveoverflow.com Learn hacking (ad): https://hextree.io Related Videos: https://www.youtube.com/watch?v=866olNIzbrk https://www.youtube.com/watch?v=lKzsNp4AveY Tweets: https://twitter.com/LiveOverflow/status/1720734431659376995 https://twitter.com/LiveOverflow/status/1720799912181284864 https://twitter.com/LiveOverflow/status/1721493232310214910 Understanding the Risks of Stolen Credentials: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46437.pdf Chapters: 00:00 - Intro 00:40 - Security Terminology 01:38 - Direct Database Access 03:40 - Introducing a Security Boundary 05:36 - Typical Web Security Vulnerabilities 07:03 - Clear-text Passwords...
https://www.youtube.com/watch?v=LxUAnZY_08o
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The Circle of Unfixable Security Issues
Not every security issues can be fixed. There exist (what I call) "unfixable" bugs, where you can always argue and shift the goal posts. The idea is to only report these kind of issues to create an endless stream of bug bounty money! Buy my terrible font (ad): https://shop.liveoverflow.com Learn hacking (ad): https://hextree.io What is a vulnerability? https://www.youtube.com/watch?v=866olNIzbrk hackerone reports: https://hackerone.com/reports/812754 https://hackerone.com/reports/6883 https://hackerone.com/reports/223337 https://hackerone.com/reports/819930 https://hackerone.com/reports/224460 https://hackerone.com/reports/160109 https://hackerone.com/reports/557154 OWASP: https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks Chapters: 00:00 - Intro 00:30 - Denial of Service...
https://www.youtube.com/watch?v=lr1KuL8OmJY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Hacker Tweets Explained
Let me explain to you what you can learn from these tweets. Did you know the name trick? Buy my terrible font (ad): https://shop.liveoverflow.com Learn hacking (ad): https://hextree.io Quote Tweet: https://twitter.com/avlidienbrunn/status/1697869590569582932 Original Tweet: https://twitter.com/Rhynorater/status/1696862832841916679 Critical Thinking Podcast: https://www.criticalthinkingpodcast.io/ XSS Origin Series: https://www.youtube.com/playlist?list=PLhixgUqwRTjyakFK7puB3fHVfXMinqMSi Chapters: 00:00 - Intro 00:37 - Tweets About Tricky XSS 01:24 - XSS Testbed Setup with php 03:45 - Exploring the XSS Context 05:24 - The window Object 06:46 - Tweet 1: Justin's XSS Explained 08:22 - Tweet 2: Mathias's Variant With Object 09:52 - Tweet 2: Mathias's Variant Creating Class 10:30 - The window.name...
https://www.youtube.com/watch?v=3zShGLEqDn8
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

401 Access Denied Ep88: The RISE of the CISO with Merike Kaeo
This week Joe Carson is joined by Merike Kaeo as they discuss the dynamic role of the CISO within an organization. They dive deeper into the role and how it interacts with different areas of the business, and what specific assets need protection and within what frameworks. An episode not to be missed! Jump-start your cybersecurity career for FREE with Cybrary! Follow us on Social! ~Cybrary Twitter ~Delinea Twitter ~Instagram ~Facebook ~YouTube
https://www.youtube.com/watch?v=FklaFGnBEyQ
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Zenbleed (CVE-2023-20593)
Let's explore the "most exciting" CPU vulnerability affecting Zen2 CPUs from AMD. Watch part 1 about fuzzing: https://www.youtube.com/watch?v=neWc0H1k2Lc buy my font (advertisement): https://shop.liveoverflow.com/ This video is sponsored by Google: https://security.googleblog.com/2023/08/downfall-and-zenbleed-googlers-helping.html Original Zenbleed Writeup: https://lock.cmpxchg8b.com/zenbleed.html Grab the code: https://github.com/google/security-research/tree/master/pocs/cpus/zenbleed cvtsi2ss: https://www.felixcloutier.com/x86/cvtsi2ss.html AMD Security Bulletin: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html RIDL Video: https://www.youtube.com/watch?v=x_R1DeZxGc0 Tavis Ormandy: https://twitter.com/taviso Chapters: 00:00 - Intro 02:27 - zenleak.asm Patterns 03:56...
https://www.youtube.com/watch?v=9EY_9KtxyPg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Intruder Alert Ep. 6 | Deconstructing Malware Attacks & Forging a Career in Cybersecurity
In this episode of Intruder Alert, Marcus Hutchins is joined by cybersecurity expert Caitlin Sarian, known for her role as the Global Lead of Cybersecurity Advocacy and Culture at TikTok and her expertise in data protection and privacy compliance. Marcus and Caitlin provide technical insight into the latest US malware attacks and share invaluable advice on breaking into the cybersecurity field. Follow us on Social!! ~Twitter ~Instagram ~FaceBook ~YouTube ~LinkedIn Jump-start your cybersecurity career for FREE with Cybrary!
https://www.youtube.com/watch?v=2aRgdmTdtK0
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

401 Access Denied: Protecting Society and the Role of CERT with Tonu
In this episode we join host Joe Carson as he discusses state cybersecurity with Tonu Tammer of the Estonian National Cybersecurity Center. Tonu goes into the day-to-day operations of defending a country and its citizens from adversaries, as well as ransomware and DDOS attacks. Come along for an in-depth discussion with a cyber defender with years of experience in this exciting new episode! Jump-start your cybersecurity career for FREE with Cybrary! Follow us on Social! ~Cybrary Twitter ~Delinea Twitter ~Instagram ~Facebook ~YouTube
https://www.youtube.com/watch?v=aYCyFDlK7vg
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Intruder Alert Ep. 5 | Community Uprising: Unravelling the Reddit Blackout
In the latest episode of Intruder Alert, Marcus Hutchins and Cybrary blue teamer, Marc Balingit, delve into the the uproar around Reddit's blackout. They unravel the intricacies of Reddit's contentious API changes, which have cornered third-party apps like Apollo, sparking a sweeping blackout protest across thousands of subreddits. Furthermore, they explore the impact of Twitch's fresh policy adjustments, which are a threat to streamers' ad revenue, and other news impacting online communities. Follow us on Social!! ~Twitter ~Instagram ~FaceBook ~YouTube ~LinkedIn Jump-start your cybersecurity career for FREE with Cybrary!
https://www.youtube.com/watch?v=8_CEqpKU8AA
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

401 Access Denied: Ep. 85 | Key Takeaways from the Verizon DBIR with Tony Goulding
Join host Joseph Carson and guest Tony Goulding as they break down the annual Verizon breach report. With over 16,000 incidents and more than 5,200 data breaches, there's a lot to look at. Tony and Joe have some great takeaways from this critical annual report and share their expert insights on what's new, what's changed, and what we're not doing so bad at (hint: MFA goes a long way!) Jump-start your cybersecurity career for FREE with Cybrary! Follow us on Social! ~Cybrary Twitter ~Delinea Twitter ~Instagram ~Facebook ~YouTube
https://www.youtube.com/watch?v=luXnfWO_U7I
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

401 Access Denied: Ep. 84 | The Best of RSAC & Cybersecurity Strategies with Bob Burns
RSAC was the place to be for cybersecurity in 2023, and Joe Carson is joined by Bob Burns to talk all about it. From the sessions that really resonated to the incredible human connections and networking, join Joe and Bob to deconstruct this year's most comprehensive conference. Were you at RSAC this year? Join us in the comments to let us know your favorite session! Jump-start your cybersecurity career for FREE with Cybrary! Follow us on Social! ~Cybrary Twitter ~Delinea Twitter ~Instagram ~Facebook ~YouTube
https://www.youtube.com/watch?v=qU40Yg7pfbo
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

The AI Revolution with Diana Kelley | 401 Access Denied Podcast Ep. 83
The AI Revolution with Diana Kelley | 401 Access Denied Podcast Ep. 83 Join Us: https://www.cybrary.it/?utm_source=youtube&utm_medium=video&utm_campaign=the-ai-revolution-with-diana-kelley Everybody's talking about it - the AI revolution is here. But given the rapid evolution in this field, it's hard to keep up with the sweeping effects this technology is causing. Luckily, Joe Carson is joined by longtime AI expert Diana Kelley to shed light on all of these changes. She addresses the many misconceptions and media misrepresentations surrounding AI, breaks down the different forms of this technology, and emphasizes the need for a better understanding of AI's capabilities and limitations. They also discuss the ethical and legal implications that will only become more potent as AI...
https://www.youtube.com/watch?v=ow9JszgoC1M
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Hacking the Government with Bryan Seely | 401 Access Denied Podcast Ep. 82
Hacking the Government with Bryan Seely | 401 Access Denied Podcast Ep. 82 Join Us: https://www.cybrary.it/?utm_source=youtube&utm_medium=video&utm_campaign=hacking-the-government-with-bryan-seely In this eye-opening episode, dive into the captivating world of cybercrime and social engineering with our host, Joe Carson, and special guest Bryan Seely! Bryan, a keynote speaker and cybersecurity expert best known for his Secret Service exposé, discusses his journey from a young computer enthusiast to a renowned public speaker. Join them as they investigate the mindset and techniques used by hackers, such as the use of aliases to deceive and manipulate their targets, as well as the importance of responsible disclosure and changing cybersecurity laws. Follow us for exclusive updates: ~https://twitter.com/cybraryIT ~https://www.instagram.com/cybrary.it/ ~https://www.facebook.com/cybraryit/ Follow...
https://www.youtube.com/watch?v=aagD2SxYUJM
Partager : LinkedIn / Twitter / Facebook / View / View (lite)

Intruder Alert Ep. 4 | Unmasking The New Global Malware Threat On Android Devices
Head to Cybrary.it to open your free account and start learning today! In this episode of Intruder Alert, join host Marcus Hutchins, world-renowned hacker, and red teamer Matt Mullins while they discuss the millions of devices recently infected with malware during production, and whether or not our devices are spying on us. For more information on how to jumpstart your career with the most cutting-edge cybersecurity training, head over to Cybrary.it to create your free account and get started on your learning journey! Make sure to subscribe so that you don't miss the latest new episodes, premiering live every two weeks, and dropping on YouTube On Demand.
https://www.youtube.com/watch?v=wc8T_RcwOkY
Partager : LinkedIn / Twitter / Facebook / View / View (lite)