Este es un proyecto que llevaba tiempo dándole vueltas con Fran y que por fin he encontrado algo de tiempo para dedicarle.

La idea es muy sencilla, básicamente es el crear una imagen Docker con ciertas herramientas sin tener que tener conocimientos de cómo crear una imagen Docker o de cómo instalar dichas herramientas.

Por ejemplo, supongamos que queremos lanzar sqlmap contra una aplicación web, y en ese momento no tenemos a mano nuestra querida Kali, y tampoco queremos buscar sqlmap e instalarla en nuestro sistema. Una forma muy conveniente y limpia sería ejecutarla desde de un contenedor Docker, y cuando terminemos nos deshacemos del contendor y listo. Nuestro sistema se queda “intacto”. Para esto, uno tendría que crear un fichero Dockerfile, añadir los comandos necesarios para instalar sqlmap, y por último construir la imagen Docker, o buscar una imagen ya creada con sqlmap y usar dicha imagen, etc.

Uno de los pasos en la fase de reconocimiento o colección de datos sobre un objetivo, es averiguar que IPs están asociadas con el mismo. Para ello, una forma muy usada es buscar los ASN asociados a éste, y a partir de ahí usar alguna herramienta a la que le podamos pasar dicha información y nos de las IPs asociadas.

Una web que ofrece datos bastante precisos es Electric Hurricane . De ahí podemos sacar la lista de ASNs, volcarla a un fichero y luego mandar dicho fichero a alguna herramienta como nmap , amass , etc.

El pasado miércoles 6 de noviembre en La Sexta emitieron el tercer documental de la tercera temporada de Enviado Especial , en el que Jalis de la Serna nos lleva desde el norte de España hasta la costa oeste de los EEUU. En éste, Jalis se adentra en la “nube”, muestra el peligro del rastro de los datos que vamos dejando consciente e inconscientemente, pasa por un centro de desintoxicación tecnológica, se adentra en Microsoft, Google, y acaba hablando con Javier Marcos y su esposa.

Como posiblemente ya sabrás kubectl es la herramienta de línea de comandos oficial para interactuar con Kubernetes . Desde ésta puedes hacer prácticamente cualquier cosa en Kubernetes siempre y cuando, obviamente, tengas permiso para ello. Además de todas las posibilidades que esta herramienta ofrece, también tienes la posibilidad de expandirla a través del sistema de plugins.

Un plugin para kubectl no es más que un fichero que cumpla las siguientes tres características:

Kubernetes es una plataforma, que ya trabajes en desarrollo, seguridad u operaciones, debes conocer porque en algún momento, no muy lejano, te tocará tratar con ella, sino lo haces ya.

Octant es una herramienta de VMWare que nos ofrece información en tiempo de real sobre un clúster de Kubernetes al que tengamos acceso. Su objetivo es que ésta sea parte del conjunto de herramientas del desarrollador, aunque evidentemente puede ser usada por cualquiera.

Como ya sabes, y si no lo sabes te lo cuento ahora, en Kubernetes , cualquier tipo de consulta o comando se lleva a cabo a través de llamadas a la API del mismo. El componente encargado de recibir y procesar dichas peticiones se llama: API Server. Este componente se encuentra en el nodo o nodos maestros del cluster.

Mi compañero y amigo Cybercaronte y yo ya hemos publicado varios artículos relacionados con Kubernetes, en los cuales si has leído, sabrás que existe una herramienta con la que podemos intereactuar con nuestro clúster desde la línea de comandos: kubectl. Aunque existen interfaces gráficas, la forma más común y usada es a través de dicha herramienta.

Ya podemos disfrutar también del material de muchas de las presentaciones de Black Hat USA 2019 :

• Every Security Team is a Software Team Now
• Detecting Deep Fakes with Mice
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Williams-Detecting-Deep-Fakes-With-Mice.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Williams-Detecting-Deep-Fakes-With-Mice-wp.pdf )
• Bypassing the Maginot Line: Remotely Exploit the Hardware Decoder on Smartphone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Gong-Bypassing-The-Maginot-Line-Remotely-Exploit-The-Hardware-Decoder-On-Smartphone.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Gong-Bypassing-The-Maginot-Line-Remotely-Exploit-The-Hardware-Decoder-On-Smartphone-wp.pdf )
• A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works-wp.pdf )
• ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf )
• Legal GNSS Spoofing and its Effects on Autonomous Vehicles
• Biometric Authentication Under Threat: Liveness Detection Hacking
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chen-Biometric-Authentication-Under-Threat-Liveness-Detection-Hacking.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chen-Biometric-Authentication-Under-Threat-Liveness-Detection-Hacking-wp.pdf )
• Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Wu-Battle-Of-Windows-Service-A-Silver-Bullet-To-Discover-File-Privilege-Escalation-Bugs-Automatically.pdf )
• SSO Wars: The Token Menace
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace-wp.pdf )
• Monsters in the Middleboxes: Building Tools for Detecting HTTPS Interception
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Valenta-Monsters-In-The-Middleboxes-Building-Tools-For-Detecting-HTTPS-Interception.pdf )
• Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
• Hacking for the Greater Good: Empowering Technologists to Strengthen Digital Society
• Dragonblood: Attacking the Dragonfly Handshake of WPA3
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vanhoef-Dragonblood-Attacking-The-Dragonfly-Handshake-Of-WPA3.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vanhoef-Dragonblood-Attacking-The-Dragonfly-Handshake-Of-WPA3-wp.pdf )
• The Most Secure Browser? Pwning Chrome from 2016 to 2019
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Feng-The-Most-Secure-Browser-Pwning-Chrome-From-2016-To-2019.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Feng-The-Most-Secure-Browser-Pwning-Chrome-From-2016-To-2019-wp.pdf )
• Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Metcalf-Attacking-And-Defending-The-Microsoft-Cloud.pdf )
• PicoDMA: DMA Attacks at Your Fingertips
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Sandin-PicoDMA-DMA-Attacks-At-Your-Fingertips.pdf )
• APIC’s Adventures in Wonderland
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Matula-APICs-Adventures-In-Wonderland.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Matula-APICs-Adventures-In-Wonderland-wp.pdf )
  • [Download Tool] ( https://www.ernw.de/download/om/blackhat/us-19-Matula-Block-APICs-Adventures-In-Wonderland-Exploits.zip )
• Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Paquet-Clouston-Behind-The-Scenes-The-Industry-Of-Social-Media-Manipulation-Driven-By-Malware.pdf )
• Attacking Electric Motors for Fun and Profit
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Jablonski-Attacking-Electric-Motors-For-Fun-And-Profit.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Jablonski-Attacking-Electric-Motors-For-Fun-And-Profit-wp.pdf )
• Sensor and Process Fingerprinting in Industrial Control Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Ochoa-Sensor-And-Process-Fingerprinting-In-ICS.pdf )
• HTTP Desync Attacks: Smashing into the Cell Next Door
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Kettle-HTTP-Desync-Attacks-Smashing-Into-The-Cell-Next-Door.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Kettle-HTTP-Desync-Attacks-Smashing-Into-The-Cell-Next-Door-wp.pdf )
  • [Download Tool] ( https://github.com/portswigger/desynchronize )
• Behind the Scenes of Intel Security and Manageability Engine
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behind-The-Scenes-Of-Intel-Security-And-Manageability-Engine.pdf )
• All the 4G Modules Could be Hacked
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shupeng-All-The-4G-Modules-Could-Be-Hacked.pdf )
• New Vulnerabilities in 5G Networks
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks-wp.pdf )
• I’m Unique, Just Like You: Human Side-Channels and Their Implications for Security and Privacy
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Wixey-Im-Unique-Just-Like-You-Human-Side-Channels-And-Their-Implications-For-Security-And-Privacy.pdf )
• It’s Not What You Know, It’s What You Do: How Data Can Shape Security Engagement
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Sedova-Know-How-Data-Can-Shape-Security-Engagement.pdf )
• Cyber Insurance 101 for CISO’s
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Smith-Cyber-Insurance-101-For-CISOs.pdf )
• The Path Less Traveled: Abusing Kubernetes Defaults
• Selling 0-Days to Governments and Offensive Security Companies
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf )
• Selling 0-Days to Governments and Offensive Security Companies
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf )
• Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf )
• Integration of Cyber Insurance Into A Risk Management Program
• Come Join the CAFSA - Continuous Automated Firmware Security Analysis
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Mulliner-Come-Join-The-CAFSA-Continuous-Automated-Firmware-Security-Analysis.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Mulliner-Come-Join-The-CAFSA-Continuous-Automated-Firmware-Security-Analysis-wp.pdf )
• Worm Charming: Harvesting Malware Lures for Fun and Profit
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Amini-Worm-Charming-Harvesting-Malware-Lures-For-Fun-And-Profit.pdf )
• MITRE ATT&CK: The Play at Home Edition
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Nickels-MITRE-ATTACK-The-Play-At-Home-Edition.pdf )
• Look, No Hands! – The Remote, Interaction-less Attack Surface of the iPhone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Silvanovich-Look-No-Hands-The-Remote-Interactionless-Attack-Surface-Of-The-iPhone.pdf )
• Chip.Fail - Glitching the Silicon of the Connected World
• Lessons From Two Years of Crypto Audits
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Aumasson-Lessons-From-Two-Years-Of-Crypto-Audits.pdf )
• Responding to a Cyber Attack with Missiles
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Hypponen-Responding-To-A-Cyber-Attack-With-Missiles.pdf )
• Finding a Needle in an Encrypted Haystack: Leveraging Cryptographic Abilities to Detect the Most Prevalent Attacks on Active Directory
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Simakov-Finding-A-Needle-In-An-Encrypted-Haystack-Leveraging-Cryptographic-Abilities-To-Detect-The-Most-Prevalent-Attacks-On-Active-Directory.pdf )
• Controlled Chaos: The Inevitable Marriage of DevOps & Security
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shortridge-Controlled-Chaos-The-Inevitable-Marriage-Of-DevOps-And-Security.pdf )
• Arm IDA and Cross Check: Reversing the Boeing 787's Core Network
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Santamarta-Arm-IDA-And-Cross-Check-Reversing-The-787-Core-Network.pdf )
• The Cyber Shell Game – War, Information Warfare, and the Darkening Web
• He Said, She Said – Poisoned RDP Offense and Defense
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense-wp.pdf )
• How Do Cyber Insurers View The World?
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Prevost-How-Insurers-View-The-World.pdf )
• Internet-Scale Analysis of AWS Cognito Security
• Messaging Layer Security: Towards a New Era of Secure Group Messaging
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Robert-Messaging-Layer-Security-Towards-A-New-Era-Of-Secure-Group-Messaging.pdf )
• Hacking Your Non-Compete
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Stone-Hacking-Your-Non-Compete.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Stone-Hacking-Your-Non-Compete-wp.pdf )
• Hunting for Bugs, Catching Dragons
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Joly-Hunting-For-Bugs-Catching-Dragons.pdf )
• Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Landers-Flying-A-False-Flag-Advanced-C2-Trust-Conflicts-And-Domain-Takeover.pdf )
• Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Metzman-Going-Beyond-Coverage-Guided-Fuzzing-With-Structured-Fuzzing.pdf )
• Transparency in the Software Supply Chain: Making SBOM a Reality
• Deconstructing the Phishing Campaigns that Target Gmail Users
• Cybersecurity Risk Assessment for Safety-Critical Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vessels-Cybersecurity-Risk-Assessment-For-Safety-Critical-Systems.pdf )
• PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Song-PeriScope-An-Effective-Probing-and-Fuzzing-Framework-For-The-Hardware-OS-Boundary.pdf )
• Defense Against Rapidly Morphing DDOS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Tyagi-Defense-Against-Rapidly-Morphing-DDOS.pdf )
• Reverse Engineering WhatsApp Encryption for Chat Manipulation and More
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse-Engineering-WhatsApp-Encryption-For-Chat-Manipulation-And-More.pdf )
• Detecting Malicious Files with YARA Rules as They Traverse the Network
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Bernal-Detecting-Malicious-Files-With-YARA-Rules-As-They-Traverse-The-Network.pdf )
• MINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-OFlynn-MINimum-Failure-Stealing-Bitcoins-With-EMFI.pdf )
  • [Download Tool] (github.com/newaetech/phywhisperer-usb)
• Mobile Interconnect Threats: How Next-Gen Products May be Already Outdated
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Teissier-Mobile-Interconnect-Threats-How-Next-Gen-Products-May-Be-Already-Outdated.pdf )
• On Trust: Stories from the Front Lines
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Farshchi-On-Trust-Stories-From-The-Front-Lines.pdf )
• WebAuthn 101 - Demystifying WebAuthn
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Brand-WebAuthn-101-Demystifying-WebAuthn.pdf )
• Attack Surface as a Service
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Westelius-Attack-Surface-As-A-Service.pdf )
• Woke Hiring Won’t Save Us: An Actionable Approach to Diversity Hiring and Retention
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Lynch-Woke-Hhiring-Wont-Save-Us-An-Actionable-Approach-To-Diversity-Hiring-And-Retention.pdf )
• GDPArrrrr: Using Privacy Laws to Steal Identities
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pavur-GDPArrrrr-Using-Privacy-Laws-To-Steal-Identities.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pavur-GDPArrrrr-Using-Privacy-Laws-To-Steal-Identities-wp.pdf )
• The Future of Securing Intelligent Electronic Devices Using the IEC 62351-7 Standard for Monitoring
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Carcano-The-Future-Of-Securing-IED-Using-The-IEC62351-7-Standard-For-Monitoring.pdf )
• Testing Your Organization's Social Media Awareness
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Wilkin-Testing-Your-Organizations-Social-Media-Awareness.pdf )
• Death to the IOC: What's Next in Threat Intelligence
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Soman-Death-To-The-IOC-Whats-Next-In-Threat-Intelligence.pdf )
• Planning a Bug Bounty: The Nuts and Bolts from Concept to Launch
• Playing Offense and Defense with Deepfakes
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Price-Playing-Offense-And-Defense-With-Deepfakes.pdf )
• All Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Zheng-All-Your-Apple-Are-Belong-To-Us-Unique-Identification-And-Cross-Device-Tracking-Of-Apple-Devices.pdf )
• The Enemy Within: Modern Supply Chain Attacks
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Doerr-The-Enemy-Within-Modern-Supply-Chain-Attacks.pdf )
• Information Security in the Public Interest
• Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Matrosov-Breaking-Through-Another-Side-Bypassing-Firmware-Security-Boundaries-From-Embedded-Controller.pdf )
• Project Zero: Five Years of 'Make 0Day Hard'
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hawkes-Project-Zero-Five-Years-Of-Make-0day-Hard.pdf )
• Rough and Ready: Frameworks to Measure Persistent Engagement and Deterrence
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Healey-Rough-and-Ready-Frameworks-To-Measure-Persistent-Engagment-and-Deterrence.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Healey-Rough-and-Ready-Frameworks-to-Measure-Persistent-Engagement-and-Deterrence-wp.pdf )
• 100 Seconds of Solitude: Defeating Cisco Trust Anchor With FPGA Bitstream Shenanigans
• Denial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hauke-Denial-Of-Service-With-A-Fistful-Of-Packets-Exploiting-Algorithmic-Complexity-Vulnerabilities.pdf )
• Women in Security: Building a Female InfoSec Community in Korea, Japan, and Taiwan
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Nakajima-Women-In-Security-Building-A-Female-InfoSec-Community-In-Korea-Japan-And-Taiwan.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Nakajima-Women-In-Security-Building-A-Female-InfoSec-Community-In-Korea-Japan-And-Taiwan-wp.pdf )
• Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs-wp.pdf )
• Operational Templates for State-Level Attack and Collective Defense of Countries
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Conti-Operational-Templates-for-State-Level-Attack-and-Collective-Defense-of-Countries.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Conti-Operational-Templates-for-State-Level-Attack-and-Collective-Defense-of-Countries-wp.pdf )
• Process Injection Techniques - Gotta Catch Them All
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf )
  • [Download Tool] ( https://github.com/SafeBreach-Labs/pinjectra )
• Bounty Operations: Best Practices and Common Pitfalls to Avoid in the First 6-12 Months
• DevSecOps : What, Why and How
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Shrivastava-DevSecOps-What-Why-And-How.pdf )
• Breaking Encrypted Databases: Generic Attacks on Range Queries
• Finding Our Path: How We're Trying to Improve Active Directory Security
• API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Maddux-API-Induced-SSRF-How-Apple-Pay-Scattered-Vulnerabilities-Across-The-Web.pdf )
• Exploiting Qualcomm WLAN and Modem Over The Air
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pi-Exploiting-Qualcomm-WLAN-And-Modem-Over-The-Air.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pi-Exploiting-Qualcomm-WLAN-And-Modem-Over-The-Air-wp.pdf )
• Practical Approach to Automate the Discovery and Eradication of Open-Source Software Vulnerabilities at Scale
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Almubayed-Practical-Approach-To-Automate-The-Discovery-And-Eradication-Of-Open-Source-Software-Vulnerabilities-At-Scale.pdf )
• Managing for Success: Maintaining a Healthy Bug Bounty Program Long Term
• Ghidra - Journey from Classified NSA Tool to Open Source
• Firmware Cartography: Charting the Course for Modern Server Compromise
• 0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Cai-0-Days-And-Mitigations-Roadways-To-Exploit-And-Secure-Connected-BMW-Cars.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Cai-0-Days-And-Mitigations-Roadways-To-Exploit-And-Secure-Connected-BMW-Cars-wp.pdf )
• Infighting Among Russian Security Services in the Cyber Sphere
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Zenz-Infighting-Among-Russian-Security-Services-in-the-Cyber-Sphere.pdf )
• Behind the scenes of iOS and Mac Security
• Zombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Snezhkov-Zombie-Ant-Farming-Practical-Tips-For-Playing-Hide-And-Seek-With-Linux-EDRs.pdf )
• Predictive Vulnerability Scoring System
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Roytman-Jacobs-Predictive-Vulnerability-Scoring-System.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Roytman-Predictive-Vulnerability-Scoring-System-wp.pdf )
• Towards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Huang-Towards-Discovering-Remote-Code-Execution-Vulnerabilities-In-Apple-FaceTime.pdf )
• Backdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Berta-Backdooring-Hardware-Devices-By-Injecting-Malicious-Payloads-On-Microcontrollers.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Berta-Backdooring-Hardware-Devices-By-Injecting-Malicious-Payloads-On-Microcontrollers-wp.pdf )
• Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Stone-Securing-The-System-A-Deep-Dive-Into-Reversing-Android-Preinstalled-Apps.pdf )
• Preventing Authentication Bypass: A Tale of Two Researchers
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jaiswal-Preventing-Authentication-Bypass-A-Tale-Of-Two-Researchers.pdf )
• Automation Techniques in C++ Reverse Engineering
• Inside the Apple T2
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Davidov-Inside-The-Apple-T2.pdf )
• Making Big Things Better the Dead Cow Way
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Menn-Making-Big-Things-Better-The-Dead-Cow-Way-wp.pdf )
• Critical Zero Days Remotely Compromise the Most Popular Real-Time OS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS-wp.pdf )
• Fantastic Red-Team Attacks and How to Find Them
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Smith-Fantastic-Red-Team-Attacks-And-How-To-Find-Them.pdf )
• The Discovery of a Government Malware and an Unexpected Spy Scandal
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Franceschi-Bicchierai-The-Discovery-Of-A-Government-Malware-And-An-Unexpected-Spy-Scandal.pdf )
• Attacking iPhone XS Max
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Wang-Attacking-IPhone-XS-Max.pdf )
• Securing Apps in the Open-By-Default Cloud
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Howes-Securing-Apps-In-The-Open-By-Default-Cloud.pdf )
• Adventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
• HostSplit: Exploitable Antipatterns in Unicode Normalization
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization-wp.pdf )
• Hacking Ten Million Useful Idiots: Online Propaganda as a Socio-Technical Security Project
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Perlman-Hacking-Ten-Million-Useful-Idiots-Online-Propaganda-As-A-Socio-Technical-Security-Project.pdf )
• Everybody be Cool, This is a Robbery!
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybody-Be-Cool-This-Is-A-Robbery.pdf )
• A Compendium of Container Escapes
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes.pdf )
• The Future of ATO
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Martin-The-Future-Of-ATO.pdf )
• Exploring the New World : Remote Exploitation of SQLite and Curl
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Qian-Exploring-The-New-World-Remote-Exploitation-Of-SQLite-And-Curl.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Qian-Exploring-The-New-World-Remote-Exploitation-Of-SQLite-And-Curl-wp.pdf )
• How to Detect that Your Domains are Being Abused for Phishing by Using DNS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hoelzel-How-To-Detect-That-Your-Domains-Are-Being-Abused-For-Phishing-By-Using-DNS.pdf )
• Debug for Bug: Crack and Hack Apple Core by Itself - Fun and Profit to Debug and Fuzz Apple Kernel by lldb Script
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Lilang-Debug-For-Bug-Crack-And-Hack-Apple-Core-By-Itself-Fun-And-Profit-To-Debug-And-Fuzz-Apple-Kernel-By-LLDB-Script.pdf )
• Shifting Knowledge Left: Keeping up with Modern Application Security
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Stanislav-Shifting-Knowledge-Left-Keeping-Up-With-Modern-Application-Security.pdf )
• Paging All Windows Geeks – Finding Evil in Windows 10 Compressed Memory
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Sardar-Paging-All-Windows-Geeks-Finding-Evil-In-Windows-10-Compressed-Memory.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Sardar-Paging-All-Windows-Geeks-Finding-Evil-In-Windows-10-Compressed-Memory-wp.pdf )
• Breaking Samsung’s ARM TrustZone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Peterlin-Breaking-Samsungs-ARM-TrustZone.pdf )
• Command Injection in F5 iRules
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jerkeby-Command-Injection-In-Irules-Loadbalancer-Scripts.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jerkeby-Command-Injection-In-Irules-Loadbalancer-Scripts-wp.pdf )
• Moving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites
  • [Download Presentation Slides] ( https://i.blackhat.com/USA-19/Thursday/us-19-Ray-Moving-From-Hacking-IoT-Gadgets-To-Breaking-Into-One-Of-Europes-Highest-Hotel-Suites.pdf )
• Lessons and Lulz: The 5th Annual Black Hat USA NOC Report

Ya hay disponible bastante material de las presentaciones de DEF CON 27 :

• Anish-Athalye-Strong-Isolation.pdf
  • Anish Athalye - Strong Isolation - Demo 1 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 2 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 3 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 4 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 5 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 6 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 7 of 7.mp4
• Bernhard-Mueller-The-Ether-Wars.pdf
  • Bernhard-Mueller-demo_01_destructible.mp4
  • Bernhard-Mueller-demo_02_ethernaut.mp4
  • Bernhard-Mueller-demo_03_graph.mp4
  • Bernhard-Mueller-demo_04_scrooge.mp4
• Bill-Graydon-Restricted-Keys.pdf
  • Graydon - Restricted Keys - HPC keyway adapter.mp4
  • Graydon - Restricted Keys - SC1 cut.mp4
  • Graydon - Restricted Keys - m3 slider cut.mp4
  • Graydon - Restricted Keys - mul-t-lock drill press.mp4
  • Graydon - Restricted Keys - standard profile cut.mp4
• Christopher-Wade-Tag-side-attacks-against-NFC.pdf
  • Christopher Wade - Demo 1.mp4
  • Christopher Wade - Demo 2.mp4
  • Christopher Wade - Demo 3.mp4
  • Christopher Wade - Demo 4.mp4
• Damien-Cauquil-Defeating-Bluetooth-Low-Energy-5-PRNG-for-fun-and-jamming.PDF
  • Damien Cauquil - 1.simulating_csa2_attack.mp4
  • Damien Cauquil - 1.simulating_csa2_attack_1.mp4
  • Damien Cauquil - 2.sniffing_csa2.mp4
  • Damien Cauquil - 2.sniffing_csa2_1.mp4
  • Damien Cauquil - 3.jamming_csa2.mp4
  • Damien Cauquil - 3.jamming_csa2_1.mp4
• DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips.pdf
  • DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips-1080.mp4
  • DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips-Demo.mp4
• Dirk-jan-Mollema-Im-in-your-cloud-pwning-your-azure-environment.pdf
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - demo1.mp4
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - mfademo.mp4
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - notepad.mp4
• Douglas-McKee-HVACking-Understanding-the-Delta-Between-Security-and-Reality.pdf
  • Douglas McKee - HVACKing Demo 2.mp4
  • Douglas McKee - HVACKing Demo 3.mp4
  • Douglas McKee HVACKing Demo 1.mp4
• Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin.pdf
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo1-iPad-5sec.mp4
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo2-hook-control.mp4
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo3-automation.mp4
• Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding.pdf
  • Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding-armv8.mp4
  • Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding-english.mp4
  • hash.mp4
  • slash.mp4
  • tick.mp4
• Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoiP-Configuration-Interfaces.pdf
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-1.mp4
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-2.mp4
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-3.mp4
• Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-All.pdf
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-All-Demo-Extras.zip
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllAtomBombing.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllGhostWriting.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllSetWindowsLongPtr.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllStackBomber.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllnmapMap.mp4
• Jack-Baker-Hacking-Web-Assembly-Games.pdf
  • Jack-Baker-Hacking-Web-Assembly-Games-Demo-1.mp4
  • Jack-Baker-Hacking-Web-Assembly-Games-Demo-2.mp4
• Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil.pdf
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-1.mp4
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-2.mp4
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-3.mp4
• Jeff-Dileo-Evil-eBPF-In-Depth.pdf
  • Jeff-Dileo-Evil-eBPF-In-Depth-DEMO-call.mp4
  • Jeff-Dileo-Evil-eBPF-In-Depth-DEMO-reduce.mp4
• Jens-Mueller-Re-Whats-up-Johnny-Covert-Content-Attacks-on-Email-End-to-End-Encryption.pdf
  • Jens Mueller-demo-decryption-oracle.ogv
  • Jens Mueller-demo-signing-oracle.ogv
• Jmaxxz-Your-Car-is-My-Car.pdf
  • OpenRemoteStart-master
    • images/
    • src/
    • LICENSE
    • README.md
    • project.properties
  • Jmaxxz - 0 - BenchCarTour.mp4
  • Jmaxxz - 1 - StartingBenchCarRf.mp4
  • Jmaxxz - 10 - StartImprezaWithoutTransponder.mp4
  • Jmaxxz - 11 -StartMiniWIthoutKey.mp4
  • Jmaxxz - 2 - CloneExistingRemote_ShortEdit - UPDATED V2.mp4
  • Jmaxxz - 2 -CloneExistingRemote.mp4
  • Jmaxxz - 3 - StartCar.mp4
  • Jmaxxz - 4 - DriveOff - UPDATED V2.mp4
  • Jmaxxz - 4 - DriveOff.mp4
  • Jmaxxz - 5 - DisableWheelLockAndDrive.mp4
  • Jmaxxz - 6 - StartCarAfterStop.mp4
  • Jmaxxz - 9 - SqliStartCar.mp4
• Joshua-Maddux-API-Induced-SSRF.pdf
  • Joshua Maddux - API-Induced SSRF - Demo 1 appr-wrapper.mp4
  • Joshua Maddux - API-Induced SSRF - Demo 2 webkitorg.mp4
  • Joshua Maddux - API-Induced SSRF - Demo 3 twilio.mp4
• Leon-Jacobs-Meticulously-Modern-Mobile-Manipulations.pdf
  • Leon Jacobs - 1. http-file-browser.mp4
  • Leon Jacobs - 2. heap-ios-tiktok.mp4
  • Leon Jacobs - 3. reflection-jar-socket.mp4
  • Leon Jacobs - 4. ios-flex-plugin.mp4
  • Leon Jacobs - 5. android-stetho.mp4
  • Leon Jacobs - 6. jenkins-ci.mov.mp4
• Maksim-Shudrak-Zero-Bugs-Found-Hold-My-Beer-AFL-How-to-Improve-Coverage-guided-Fuzzing-and-Find-New-Zero-days-in-Tough-Targets.pdf
  • afl_main_screen_fast.mkv
  • manul_main.mkv
  • zeek_1.mkv
• Nikhil-Mittal-RACE-Minimal-Rights-and-ACE-for-Active-Directory-Dominance.pdf
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo2-ModifyServicePermissions.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo3-JEAToDC.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo4-DumpDCHash.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo5-CompromiseForestRoot.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance- Demo1-PSRemotingToDC.mp4
• Orange-Tsai-and-Meh-Chang-Infiltrating-Corporate-Intranet-Like-NSA-Pre-auth-RCE-on-Leading-SSL-VPNs.pdf
  • Orange-Tsai-and-Meh-Chang-Infiltrating-Corporate-Intranet-Like-NSA-Pre-auth-RCE-on-Leading-SSL-VPNs-Demo-Video.zip
  • Orange-Tsai-and-Meh Chang-Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs-demo_fortigate.mp4
  • Orange-Tsai-and-Meh Chang-Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs-demo_pulsesecure_v1.mp4
• Pedro-Cabrera-SDR-Against-Smart-TVs-URL-and-Channel-Injection-Attacks.pdf
  • 1_video.mp4
  • 2_video.mp4
  • PedroCabrera - SDR Against Smart TVs_video10-B+M.mp4
  • PedroCabrera - SDR Against Smart TVs_video3-NotFinal.mp4
  • PedroCabrera - SDR Against Smart TVs_video4.mp4
  • PedroCabrera - SDR Against Smart TVs_video5_inject_URL.mp4
  • PedroCabrera - SDR Against Smart TVs_video6-IISS-SDR.mp4
  • PedroCabrera - SDR Against Smart TVs_video7-IISS-DNS.mp4
  • PedroCabrera - SDR Against Smart TVs_video8-KL.mp4
  • PedroCabrera - SDR Against Smart TVs_video9-Mi.mp4
• Sheila-A-Berta-Backdooring-hardware-devices-by-injecting-malicious-payloads-on-Microcontrollers.pdf
  • CARSECU_demo.mp4
  • EUSART_demo.mp4
  • ROP_demo.mp4
• Xiling-Gong-Peter-Pi-Exploiting-Qualcomm-WLAN-and-Modem-Over-The-Air.pdf
  • demo - xiling gong, peter pi - exploiting qualcomm wlan and modem over the air.mp4
  • demo - xiling gong, peter pi - exploiting qualcomm wlan and modem over the air_1.mp4
• Yaron-Zinar-and-Marina-Simakov-Relaying-Credentials-Has-Never-Been-Easier-How-to-Easily-Bypass-the-Latest-NTLM-Relay-Mitigations.pdf
  • Zinar Simakov - epa_bypass_final.mp4
  • Zinar Simakov - session_key_final.mp4
• albinowax-HTTP-Desync-Attacks.pdf
  • albinowax-HTTP-Desync-Attacks-whitepaper.pdf
  • albinowax-HTTP-Desync-Attacks-demo.mp4
• albinowax-HTTP-Desync-Attacks-tool
  • build
    • classes/
    • libs/
    • resources/
    • tmp/
  • out
    • artifacts/
    • production/
  • resources
    • CL-TE.py
    • TE-CL.py
  • src
    • burp/
  • build.gradle
  • readme.md
  • sqlite-jdbc-3.23.1.jar
  • turbo-intruder-all.jar
• finalphoenix-Rise-of-the-Hypebots.pdf
  • finalphoenix-Rise-of-the-Hypebots-Complicated Bot.mp4
  • finalphoenix-Rise-of-the-Hypebots-botsThatBot.mp4
  • finalphoenix-Rise-of-the-Hypebots-fancy-monitor.mp4
  • finalphoenix-Rise-of-the-Hypebots-puppeteerBot.mp4
  • finalphoenix-Rise-of-the-Hypebots-simple-monitor.mp4
• Alexandre-Borges-dotNET-Malware-Threats.pdf
• Alon-Weinberg-Please-inject-me-a-x64-code-injection.pdf
  • Alon-Weinberg-Please-inject-me-a-x64-code-injection-Demo.mp4
• Alvaro-Munoz-Oleksandr-Mirosh-SSOWars-The-Token-Menace.pdf
  • Alvaro-Munoz-Oleksandr-Mirosh-SSOWars-The-Token-Menace-Demo-Videos.zip
• Amit-Waisel-and-Hila-Cohen-malproxy.pdf
  • Amit-Waisel-and-Hila-Cohen-malproxy-demo.mp4
• Andreas-Baumhof-Are-Quantum-Computers-Really-A-Threat-To-Cryptography.pdf
• Andy-Grant-Unpacking-pkgs.pdf
  • Andy-Grant-Unpacking-pkgs.mp4
• Ariel-Adversariel-Herbert-Voss-Dont-Red-Team-AI-like-a-Chump.pdf
• Ben-Morris-More-Keys-Than-A-Piano-Finding-Secrets-In-Publicly-Exposed-Ebs-Volumes.pdf
• Ben-Sadeghipour-Owning-the-clout-through-SSRF-and-PDF-generators.pdf
• Bill-Swearingen-HAKC-The-Police.pdf
• Brad-Dixon-Cheating-in-eSports-How-to-cheat-at-virtual-cycling-using-USB-hacks.compressed.pdf
• Brad-Dixon-Cheating-in-eSports-How-to-cheat-at-virtual-cycling-using-USB-hacks.pdf
• Brent-Stone-Reverse-Enginerring-17-Cars.pdf
  • Brent-Stone-Reverse-Enginerring-17-Cars-Video-Demo.mp4
• Brizendine-Stroschein-The-JOP-ROCKET-DEMO-1.mp4
• Brizendine-Stroschein-The-JOP-ROCKET.pdf
  • Brizendine-Stroschein-The-JOP-ROCKET-DEMO.mp4
• Campbell-Murray-GSM-We-can-hear-everyone-now.pdf
• Christopher-Roberts-Firmware-Slap.pdf
  • Christopher-Roberts-DEMO-1.mp4
  • Christopher-Roberts-DEMO-2.mp4
  • Christopher-Roberts-Firmware-Slap-DEMO-1.wmv
  • Christopher-Roberts-Firmware-Slap-DEMO-2.wmv
  • Christopher-Roberts-Firmware-Slap-DEMO-3.wmv
• Dan-Regalado-Defcon27AliDan.pdf
  • Dan-Regalado-ARM-Syscalls.mp4
• Daniel-Romero-and-Mario-Rivas-Why-you-should-fear-your-mundane-office.pdf
• Elliott-Thompson-Mi-Casa-Su-Casa.pdf
  • Elliott-Thompson-Mi-Casa-Su-Casa-Video-Demonstration.mp4
• Eyal-Itkin-Say-Cheese-How-I-Ransomwared-Your-DSLR-Camera.pdf
  • Eyal-Itkin-Say-Cheese-How-I-Ransomwared-Your-DSLR-Camera-Demo.mp4
• Gregory-Pickett-Breaking-The-Back-End-It-Is-Not-Always-A-Bug.-Sometimes-It-Is-Just-Bad-Design.pdf
  • Gregory-Pickett-Breaking-The-Back-End-It-Is-Not-Always-A-Bug.-Sometimes-It-Is-Just-Bad-Design-Demo.mp4
• Jacob-Baines-Help-Me-Vulnerabilities.-Youre-My-Only-Hope.pdf
• Jesse-Michael-Get-off-the-kernel-if-you-cant-drive.pdf
• Joe-Grand-Badge.pdf
  • Joe-Grand-The-Badge.pdf
• Joseph-Cox-How-You-Can-Buy-ATT-T-Mobile-and-Sprint-Real-Time-Location-Data-on-the-Black-Market.pdf
• Joseph-Menn-Change-the-World-cDc-Style.pdf
• Junyu-Zhou-and-Ce-Qin-and-Jianing-Wang-Web2Own-Attacking-Desktop-Apps-From-Web-Securitys-Perspective.pdf
• Katherine-Pratt-Hacking-Your-Thoughts-Batman-Forever-meets-Black-Mirror.pdf
  • Katherine-Pratt-Hacking-Your-Thoughts-Batman-Forever-meets-Black-Mirror.pptx
• Kyle-Gwinnup-Next-Generation-Process-Emulation-with-Binee.pdf
  • Kyle-Gwinnup-Next-Generation-Process-Emulation-with-Binee-Demo.mp4
• Masarah-Paquet-Clouston-Olivier-Bilodeau-The-Industry-of-Social-Media-Manipulation-Driven-by-Malware.pdf
  • Masarah-Paquet-Clouston-Olivier-Bilodeau-The-Industry-of-Social-Media-Manipulation-support-video-luminati-sdk-demo.mp4
• Matt-Wixey-Sound-Effects-Exploring-Acoustic-Cyber-Weapons.pdf
• Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht.pdf
  • Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht-WINDOWS-DEMO.mp4
• Michael-Stepankin-Apache-Solr-Injection.pdf
• Nicolas-Oberli-Poking-the-S-in-SD-cards.PDF
  • Nicolas-Oberli-Poking-the-S-in-SD-cards-DEMO.mkv
  • Nicolas-Oberli-Poking-the-S-in-SD-cards-DEMO.mp4
• Nina-Kollars-Confessions-of-a-Nespresso-Money-Mule.pdf
• Omer-Gull-SELECT-code-execution-FROM-USING-SQLite.pdf
  • Omer-Gull-SELECT-code-execution-FROM-USING-SQLite-Demo.mp4
  • Omer-Yair-Exploiting-Windows-Exploit-Mitigation-for-ROP-Exploits-Demo.mp4
  • Omer-Yair-Exploiting-Windows-Exploit-Mitigation-for-ROP-Exploits.pdf
• Panel-DC101-The-Panel.pdf
• Patrick-Wardle-Harnessing-Weapons-of-Mac-Destruction.pdf
• Phar-No-Mas-How-One-Side-Channel-Flaw-Opens-Atm-Pharmacies-and-Government-Secrets-Up-to-Attack.pdf
• Philippe-Laulheret-Introduction-to-Hardware-Hacking-Extended-Version.pdf
  • Philippe-Laulheret-Introduction-to-Hardware-Hacking-Demo-Video.mp4
• Roger-Dingledine-TOR-Censorship-Arms-Race.pdf
• Travis-Palmer-First-try-DNS-Cache-Poisoning-with-IPv4-and-IPv6-Fragmentation.pdf
• Truman-Kain-Surveillance-Detection-Scout.pdf
  • Truman-Kain-Surveillance-Detection-Scout-Demo.mp4
• Wenxiang-Qian-Yuxiang-Li-Huiyu-Wu-Breaking-Google-Home-Exploit-It-with-SQLite-Magellan.pdf
• WillC-Phreaking-Elevators.pdf
• Workshop-Anthony-Rose-Introduction-to-AMSI-Bypasses-and-Sandbox-Evasion.pdf
• Xiaohuihui-All-The-4G-Modules-Could-Be-Hacked.pdf
• Zhang-Xiangqian-Liu-Huiming-Your-secret-files-are-mine.pdf
• d4krm4tter-Mike-Spicer-I-Know-What-You-Did-Last-Summer.pdf
  • d4krm4tter-Mike-Spicer-I-Know-What-You-Did-Last-Summer-Demo.mp4
• droogie-go-null-yourself.pdf
• grichter-Reverse-Engineering-4G-Hotspots-For-Fun-Bugs-Net-Financial-Loss.pdf
  • grichter-Reverse-Engineering-4G-Hotspots-For-Fun-Bugs-Net-Financial-Loss-MF910-CSRF-Demo.mp4
• jiska-fabian-vacuum-cleaning-security.pdf
• smea-Adventures-in-smart-buttplug-penetration-testing.pdf

Basado en el libro de Docker: SecDevOps , Fran Ramírez , Alberto Berdugo y un servidor , hemos tenido la oportunidad de grabar un webinar en colaboración con The Security Sentinel .

En dicho webinar, prácticamente hemos cubierto todo el contenido del libro, pero en vez de la introducción a Docker Swarm, la hemos sustituido con una amplia introducción a Kubernetes y hemos ampliado la parte de SecDevOps. Además cada apartado teórico está repleto de ejemplos para que el alumno pueda poner en práctica lo aprendido.

En Cyberhades hemos estado usando Flickr como repositorio de imágenes desde el 2008. Incluso en los años 2015 y 2016 pagamos por una cuenta profesional, que honestamente no recuerdo la differencia entre la cuenta pro y la gratuita free, cuyo coste era de $24.95 al año. A partir del año 2017 volvimos a usar la cuenta free, porque no le estábamos sacando ningún beneficio a la cuenta de pago. Nuestra experiencia con Flickr siempre ha sido muy positiva, nunca hemos tenido problemas con el servicio, pero el año pasado Flickr fue adquirida por SmugMug , y recientemente anunciaron que las cuentas gratuitas de Flickr estarían limitadas a un máximo de 1000 imágenes, y el resto serían borradas, a menos que pagues por una cuenta pro, $50 al año, o $6 al mes. En nuestro caso, tenemos en Flickr 3.997 imágenes, con lo cual si Flickr nos borra 2.997 imágenes, tendría un gran impacto en el blog. La cuenta pro de Flickr provee de otros beneficios más allá del número ilimitado de fotos, y si eres fotógrafo lo mismo te interesa, pero en nuestro caso, quitando el CDN , no nos aporta ningún valor extra que beneficie el blog.