Como ya sabes, y si no lo sabes te lo cuento ahora, en Kubernetes , cualquier tipo de consulta o comando se lleva a cabo a través de llamadas a la API del mismo. El componente encargado de recibir y procesar dichas peticiones se llama: API Server. Este componente se encuentra en el nodo o nodos maestros del cluster.

Mi compañero y amigo Cybercaronte y yo ya hemos publicado varios artículos relacionados con Kubernetes, en los cuales si has leído, sabrás que existe una herramienta con la que podemos intereactuar con nuestro clúster desde la línea de comandos: kubectl. Aunque existen interfaces gráficas, la forma más común y usada es a través de dicha herramienta.

Ya podemos disfrutar también del material de muchas de las presentaciones de Black Hat USA 2019 :

• Every Security Team is a Software Team Now
• Detecting Deep Fakes with Mice
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Williams-Detecting-Deep-Fakes-With-Mice.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Williams-Detecting-Deep-Fakes-With-Mice-wp.pdf )
• Bypassing the Maginot Line: Remotely Exploit the Hardware Decoder on Smartphone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Gong-Bypassing-The-Maginot-Line-Remotely-Exploit-The-Hardware-Decoder-On-Smartphone.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Gong-Bypassing-The-Maginot-Line-Remotely-Exploit-The-Hardware-Decoder-On-Smartphone-wp.pdf )
• A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works-wp.pdf )
• ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf )
• Legal GNSS Spoofing and its Effects on Autonomous Vehicles
• Biometric Authentication Under Threat: Liveness Detection Hacking
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chen-Biometric-Authentication-Under-Threat-Liveness-Detection-Hacking.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chen-Biometric-Authentication-Under-Threat-Liveness-Detection-Hacking-wp.pdf )
• Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Wu-Battle-Of-Windows-Service-A-Silver-Bullet-To-Discover-File-Privilege-Escalation-Bugs-Automatically.pdf )
• SSO Wars: The Token Menace
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace-wp.pdf )
• Monsters in the Middleboxes: Building Tools for Detecting HTTPS Interception
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Valenta-Monsters-In-The-Middleboxes-Building-Tools-For-Detecting-HTTPS-Interception.pdf )
• Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
• Hacking for the Greater Good: Empowering Technologists to Strengthen Digital Society
• Dragonblood: Attacking the Dragonfly Handshake of WPA3
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vanhoef-Dragonblood-Attacking-The-Dragonfly-Handshake-Of-WPA3.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vanhoef-Dragonblood-Attacking-The-Dragonfly-Handshake-Of-WPA3-wp.pdf )
• The Most Secure Browser? Pwning Chrome from 2016 to 2019
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Feng-The-Most-Secure-Browser-Pwning-Chrome-From-2016-To-2019.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Feng-The-Most-Secure-Browser-Pwning-Chrome-From-2016-To-2019-wp.pdf )
• Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Metcalf-Attacking-And-Defending-The-Microsoft-Cloud.pdf )
• PicoDMA: DMA Attacks at Your Fingertips
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Sandin-PicoDMA-DMA-Attacks-At-Your-Fingertips.pdf )
• APIC’s Adventures in Wonderland
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Matula-APICs-Adventures-In-Wonderland.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Matula-APICs-Adventures-In-Wonderland-wp.pdf )
  • [Download Tool] ( https://www.ernw.de/download/om/blackhat/us-19-Matula-Block-APICs-Adventures-In-Wonderland-Exploits.zip )
• Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Paquet-Clouston-Behind-The-Scenes-The-Industry-Of-Social-Media-Manipulation-Driven-By-Malware.pdf )
• Attacking Electric Motors for Fun and Profit
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Jablonski-Attacking-Electric-Motors-For-Fun-And-Profit.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Jablonski-Attacking-Electric-Motors-For-Fun-And-Profit-wp.pdf )
• Sensor and Process Fingerprinting in Industrial Control Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Ochoa-Sensor-And-Process-Fingerprinting-In-ICS.pdf )
• HTTP Desync Attacks: Smashing into the Cell Next Door
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Kettle-HTTP-Desync-Attacks-Smashing-Into-The-Cell-Next-Door.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Kettle-HTTP-Desync-Attacks-Smashing-Into-The-Cell-Next-Door-wp.pdf )
  • [Download Tool] ( https://github.com/portswigger/desynchronize )
• Behind the Scenes of Intel Security and Manageability Engine
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behind-The-Scenes-Of-Intel-Security-And-Manageability-Engine.pdf )
• All the 4G Modules Could be Hacked
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shupeng-All-The-4G-Modules-Could-Be-Hacked.pdf )
• New Vulnerabilities in 5G Networks
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks-wp.pdf )
• I’m Unique, Just Like You: Human Side-Channels and Their Implications for Security and Privacy
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Wixey-Im-Unique-Just-Like-You-Human-Side-Channels-And-Their-Implications-For-Security-And-Privacy.pdf )
• It’s Not What You Know, It’s What You Do: How Data Can Shape Security Engagement
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Sedova-Know-How-Data-Can-Shape-Security-Engagement.pdf )
• Cyber Insurance 101 for CISO’s
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Smith-Cyber-Insurance-101-For-CISOs.pdf )
• The Path Less Traveled: Abusing Kubernetes Defaults
• Selling 0-Days to Governments and Offensive Security Companies
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf )
• Selling 0-Days to Governments and Offensive Security Companies
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf )
• Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf )
• Integration of Cyber Insurance Into A Risk Management Program
• Come Join the CAFSA - Continuous Automated Firmware Security Analysis
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Mulliner-Come-Join-The-CAFSA-Continuous-Automated-Firmware-Security-Analysis.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Mulliner-Come-Join-The-CAFSA-Continuous-Automated-Firmware-Security-Analysis-wp.pdf )
• Worm Charming: Harvesting Malware Lures for Fun and Profit
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Amini-Worm-Charming-Harvesting-Malware-Lures-For-Fun-And-Profit.pdf )
• MITRE ATT&CK: The Play at Home Edition
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Nickels-MITRE-ATTACK-The-Play-At-Home-Edition.pdf )
• Look, No Hands! – The Remote, Interaction-less Attack Surface of the iPhone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Silvanovich-Look-No-Hands-The-Remote-Interactionless-Attack-Surface-Of-The-iPhone.pdf )
• Chip.Fail - Glitching the Silicon of the Connected World
• Lessons From Two Years of Crypto Audits
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Aumasson-Lessons-From-Two-Years-Of-Crypto-Audits.pdf )
• Responding to a Cyber Attack with Missiles
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Hypponen-Responding-To-A-Cyber-Attack-With-Missiles.pdf )
• Finding a Needle in an Encrypted Haystack: Leveraging Cryptographic Abilities to Detect the Most Prevalent Attacks on Active Directory
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Simakov-Finding-A-Needle-In-An-Encrypted-Haystack-Leveraging-Cryptographic-Abilities-To-Detect-The-Most-Prevalent-Attacks-On-Active-Directory.pdf )
• Controlled Chaos: The Inevitable Marriage of DevOps & Security
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shortridge-Controlled-Chaos-The-Inevitable-Marriage-Of-DevOps-And-Security.pdf )
• Arm IDA and Cross Check: Reversing the Boeing 787's Core Network
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Santamarta-Arm-IDA-And-Cross-Check-Reversing-The-787-Core-Network.pdf )
• The Cyber Shell Game – War, Information Warfare, and the Darkening Web
• He Said, She Said – Poisoned RDP Offense and Defense
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense-wp.pdf )
• How Do Cyber Insurers View The World?
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Prevost-How-Insurers-View-The-World.pdf )
• Internet-Scale Analysis of AWS Cognito Security
• Messaging Layer Security: Towards a New Era of Secure Group Messaging
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Robert-Messaging-Layer-Security-Towards-A-New-Era-Of-Secure-Group-Messaging.pdf )
• Hacking Your Non-Compete
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Stone-Hacking-Your-Non-Compete.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Stone-Hacking-Your-Non-Compete-wp.pdf )
• Hunting for Bugs, Catching Dragons
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Joly-Hunting-For-Bugs-Catching-Dragons.pdf )
• Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Landers-Flying-A-False-Flag-Advanced-C2-Trust-Conflicts-And-Domain-Takeover.pdf )
• Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Metzman-Going-Beyond-Coverage-Guided-Fuzzing-With-Structured-Fuzzing.pdf )
• Transparency in the Software Supply Chain: Making SBOM a Reality
• Deconstructing the Phishing Campaigns that Target Gmail Users
• Cybersecurity Risk Assessment for Safety-Critical Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vessels-Cybersecurity-Risk-Assessment-For-Safety-Critical-Systems.pdf )
• PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Song-PeriScope-An-Effective-Probing-and-Fuzzing-Framework-For-The-Hardware-OS-Boundary.pdf )
• Defense Against Rapidly Morphing DDOS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Tyagi-Defense-Against-Rapidly-Morphing-DDOS.pdf )
• Reverse Engineering WhatsApp Encryption for Chat Manipulation and More
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse-Engineering-WhatsApp-Encryption-For-Chat-Manipulation-And-More.pdf )
• Detecting Malicious Files with YARA Rules as They Traverse the Network
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Bernal-Detecting-Malicious-Files-With-YARA-Rules-As-They-Traverse-The-Network.pdf )
• MINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-OFlynn-MINimum-Failure-Stealing-Bitcoins-With-EMFI.pdf )
  • [Download Tool] (github.com/newaetech/phywhisperer-usb)
• Mobile Interconnect Threats: How Next-Gen Products May be Already Outdated
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Teissier-Mobile-Interconnect-Threats-How-Next-Gen-Products-May-Be-Already-Outdated.pdf )
• On Trust: Stories from the Front Lines
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Farshchi-On-Trust-Stories-From-The-Front-Lines.pdf )
• WebAuthn 101 - Demystifying WebAuthn
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Brand-WebAuthn-101-Demystifying-WebAuthn.pdf )
• Attack Surface as a Service
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Westelius-Attack-Surface-As-A-Service.pdf )
• Woke Hiring Won’t Save Us: An Actionable Approach to Diversity Hiring and Retention
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Lynch-Woke-Hhiring-Wont-Save-Us-An-Actionable-Approach-To-Diversity-Hiring-And-Retention.pdf )
• GDPArrrrr: Using Privacy Laws to Steal Identities
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pavur-GDPArrrrr-Using-Privacy-Laws-To-Steal-Identities.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pavur-GDPArrrrr-Using-Privacy-Laws-To-Steal-Identities-wp.pdf )
• The Future of Securing Intelligent Electronic Devices Using the IEC 62351-7 Standard for Monitoring
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Carcano-The-Future-Of-Securing-IED-Using-The-IEC62351-7-Standard-For-Monitoring.pdf )
• Testing Your Organization's Social Media Awareness
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Wilkin-Testing-Your-Organizations-Social-Media-Awareness.pdf )
• Death to the IOC: What's Next in Threat Intelligence
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Soman-Death-To-The-IOC-Whats-Next-In-Threat-Intelligence.pdf )
• Planning a Bug Bounty: The Nuts and Bolts from Concept to Launch
• Playing Offense and Defense with Deepfakes
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Price-Playing-Offense-And-Defense-With-Deepfakes.pdf )
• All Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Zheng-All-Your-Apple-Are-Belong-To-Us-Unique-Identification-And-Cross-Device-Tracking-Of-Apple-Devices.pdf )
• The Enemy Within: Modern Supply Chain Attacks
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Doerr-The-Enemy-Within-Modern-Supply-Chain-Attacks.pdf )
• Information Security in the Public Interest
• Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Matrosov-Breaking-Through-Another-Side-Bypassing-Firmware-Security-Boundaries-From-Embedded-Controller.pdf )
• Project Zero: Five Years of 'Make 0Day Hard'
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hawkes-Project-Zero-Five-Years-Of-Make-0day-Hard.pdf )
• Rough and Ready: Frameworks to Measure Persistent Engagement and Deterrence
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Healey-Rough-and-Ready-Frameworks-To-Measure-Persistent-Engagment-and-Deterrence.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Healey-Rough-and-Ready-Frameworks-to-Measure-Persistent-Engagement-and-Deterrence-wp.pdf )
• 100 Seconds of Solitude: Defeating Cisco Trust Anchor With FPGA Bitstream Shenanigans
• Denial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hauke-Denial-Of-Service-With-A-Fistful-Of-Packets-Exploiting-Algorithmic-Complexity-Vulnerabilities.pdf )
• Women in Security: Building a Female InfoSec Community in Korea, Japan, and Taiwan
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Nakajima-Women-In-Security-Building-A-Female-InfoSec-Community-In-Korea-Japan-And-Taiwan.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Nakajima-Women-In-Security-Building-A-Female-InfoSec-Community-In-Korea-Japan-And-Taiwan-wp.pdf )
• Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs-wp.pdf )
• Operational Templates for State-Level Attack and Collective Defense of Countries
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Conti-Operational-Templates-for-State-Level-Attack-and-Collective-Defense-of-Countries.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Conti-Operational-Templates-for-State-Level-Attack-and-Collective-Defense-of-Countries-wp.pdf )
• Process Injection Techniques - Gotta Catch Them All
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf )
  • [Download Tool] ( https://github.com/SafeBreach-Labs/pinjectra )
• Bounty Operations: Best Practices and Common Pitfalls to Avoid in the First 6-12 Months
• DevSecOps : What, Why and How
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Shrivastava-DevSecOps-What-Why-And-How.pdf )
• Breaking Encrypted Databases: Generic Attacks on Range Queries
• Finding Our Path: How We're Trying to Improve Active Directory Security
• API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Maddux-API-Induced-SSRF-How-Apple-Pay-Scattered-Vulnerabilities-Across-The-Web.pdf )
• Exploiting Qualcomm WLAN and Modem Over The Air
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pi-Exploiting-Qualcomm-WLAN-And-Modem-Over-The-Air.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pi-Exploiting-Qualcomm-WLAN-And-Modem-Over-The-Air-wp.pdf )
• Practical Approach to Automate the Discovery and Eradication of Open-Source Software Vulnerabilities at Scale
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Almubayed-Practical-Approach-To-Automate-The-Discovery-And-Eradication-Of-Open-Source-Software-Vulnerabilities-At-Scale.pdf )
• Managing for Success: Maintaining a Healthy Bug Bounty Program Long Term
• Ghidra - Journey from Classified NSA Tool to Open Source
• Firmware Cartography: Charting the Course for Modern Server Compromise
• 0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Cai-0-Days-And-Mitigations-Roadways-To-Exploit-And-Secure-Connected-BMW-Cars.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Cai-0-Days-And-Mitigations-Roadways-To-Exploit-And-Secure-Connected-BMW-Cars-wp.pdf )
• Infighting Among Russian Security Services in the Cyber Sphere
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Zenz-Infighting-Among-Russian-Security-Services-in-the-Cyber-Sphere.pdf )
• Behind the scenes of iOS and Mac Security
• Zombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Snezhkov-Zombie-Ant-Farming-Practical-Tips-For-Playing-Hide-And-Seek-With-Linux-EDRs.pdf )
• Predictive Vulnerability Scoring System
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Roytman-Jacobs-Predictive-Vulnerability-Scoring-System.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Roytman-Predictive-Vulnerability-Scoring-System-wp.pdf )
• Towards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Huang-Towards-Discovering-Remote-Code-Execution-Vulnerabilities-In-Apple-FaceTime.pdf )
• Backdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Berta-Backdooring-Hardware-Devices-By-Injecting-Malicious-Payloads-On-Microcontrollers.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Berta-Backdooring-Hardware-Devices-By-Injecting-Malicious-Payloads-On-Microcontrollers-wp.pdf )
• Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Stone-Securing-The-System-A-Deep-Dive-Into-Reversing-Android-Preinstalled-Apps.pdf )
• Preventing Authentication Bypass: A Tale of Two Researchers
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jaiswal-Preventing-Authentication-Bypass-A-Tale-Of-Two-Researchers.pdf )
• Automation Techniques in C++ Reverse Engineering
• Inside the Apple T2
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Davidov-Inside-The-Apple-T2.pdf )
• Making Big Things Better the Dead Cow Way
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Menn-Making-Big-Things-Better-The-Dead-Cow-Way-wp.pdf )
• Critical Zero Days Remotely Compromise the Most Popular Real-Time OS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS-wp.pdf )
• Fantastic Red-Team Attacks and How to Find Them
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Smith-Fantastic-Red-Team-Attacks-And-How-To-Find-Them.pdf )
• The Discovery of a Government Malware and an Unexpected Spy Scandal
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Franceschi-Bicchierai-The-Discovery-Of-A-Government-Malware-And-An-Unexpected-Spy-Scandal.pdf )
• Attacking iPhone XS Max
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Wang-Attacking-IPhone-XS-Max.pdf )
• Securing Apps in the Open-By-Default Cloud
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Howes-Securing-Apps-In-The-Open-By-Default-Cloud.pdf )
• Adventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
• HostSplit: Exploitable Antipatterns in Unicode Normalization
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization-wp.pdf )
• Hacking Ten Million Useful Idiots: Online Propaganda as a Socio-Technical Security Project
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Perlman-Hacking-Ten-Million-Useful-Idiots-Online-Propaganda-As-A-Socio-Technical-Security-Project.pdf )
• Everybody be Cool, This is a Robbery!
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybody-Be-Cool-This-Is-A-Robbery.pdf )
• A Compendium of Container Escapes
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes.pdf )
• The Future of ATO
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Martin-The-Future-Of-ATO.pdf )
• Exploring the New World : Remote Exploitation of SQLite and Curl
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Qian-Exploring-The-New-World-Remote-Exploitation-Of-SQLite-And-Curl.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Qian-Exploring-The-New-World-Remote-Exploitation-Of-SQLite-And-Curl-wp.pdf )
• How to Detect that Your Domains are Being Abused for Phishing by Using DNS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hoelzel-How-To-Detect-That-Your-Domains-Are-Being-Abused-For-Phishing-By-Using-DNS.pdf )
• Debug for Bug: Crack and Hack Apple Core by Itself - Fun and Profit to Debug and Fuzz Apple Kernel by lldb Script
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Lilang-Debug-For-Bug-Crack-And-Hack-Apple-Core-By-Itself-Fun-And-Profit-To-Debug-And-Fuzz-Apple-Kernel-By-LLDB-Script.pdf )
• Shifting Knowledge Left: Keeping up with Modern Application Security
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Stanislav-Shifting-Knowledge-Left-Keeping-Up-With-Modern-Application-Security.pdf )
• Paging All Windows Geeks – Finding Evil in Windows 10 Compressed Memory
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Sardar-Paging-All-Windows-Geeks-Finding-Evil-In-Windows-10-Compressed-Memory.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Sardar-Paging-All-Windows-Geeks-Finding-Evil-In-Windows-10-Compressed-Memory-wp.pdf )
• Breaking Samsung’s ARM TrustZone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Peterlin-Breaking-Samsungs-ARM-TrustZone.pdf )
• Command Injection in F5 iRules
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jerkeby-Command-Injection-In-Irules-Loadbalancer-Scripts.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jerkeby-Command-Injection-In-Irules-Loadbalancer-Scripts-wp.pdf )
• Moving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites
  • [Download Presentation Slides] ( https://i.blackhat.com/USA-19/Thursday/us-19-Ray-Moving-From-Hacking-IoT-Gadgets-To-Breaking-Into-One-Of-Europes-Highest-Hotel-Suites.pdf )
• Lessons and Lulz: The 5th Annual Black Hat USA NOC Report

Ya hay disponible bastante material de las presentaciones de DEF CON 27 :

• Anish-Athalye-Strong-Isolation.pdf
  • Anish Athalye - Strong Isolation - Demo 1 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 2 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 3 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 4 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 5 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 6 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 7 of 7.mp4
• Bernhard-Mueller-The-Ether-Wars.pdf
  • Bernhard-Mueller-demo_01_destructible.mp4
  • Bernhard-Mueller-demo_02_ethernaut.mp4
  • Bernhard-Mueller-demo_03_graph.mp4
  • Bernhard-Mueller-demo_04_scrooge.mp4
• Bill-Graydon-Restricted-Keys.pdf
  • Graydon - Restricted Keys - HPC keyway adapter.mp4
  • Graydon - Restricted Keys - SC1 cut.mp4
  • Graydon - Restricted Keys - m3 slider cut.mp4
  • Graydon - Restricted Keys - mul-t-lock drill press.mp4
  • Graydon - Restricted Keys - standard profile cut.mp4
• Christopher-Wade-Tag-side-attacks-against-NFC.pdf
  • Christopher Wade - Demo 1.mp4
  • Christopher Wade - Demo 2.mp4
  • Christopher Wade - Demo 3.mp4
  • Christopher Wade - Demo 4.mp4
• Damien-Cauquil-Defeating-Bluetooth-Low-Energy-5-PRNG-for-fun-and-jamming.PDF
  • Damien Cauquil - 1.simulating_csa2_attack.mp4
  • Damien Cauquil - 1.simulating_csa2_attack_1.mp4
  • Damien Cauquil - 2.sniffing_csa2.mp4
  • Damien Cauquil - 2.sniffing_csa2_1.mp4
  • Damien Cauquil - 3.jamming_csa2.mp4
  • Damien Cauquil - 3.jamming_csa2_1.mp4
• DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips.pdf
  • DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips-1080.mp4
  • DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips-Demo.mp4
• Dirk-jan-Mollema-Im-in-your-cloud-pwning-your-azure-environment.pdf
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - demo1.mp4
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - mfademo.mp4
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - notepad.mp4
• Douglas-McKee-HVACking-Understanding-the-Delta-Between-Security-and-Reality.pdf
  • Douglas McKee - HVACKing Demo 2.mp4
  • Douglas McKee - HVACKing Demo 3.mp4
  • Douglas McKee HVACKing Demo 1.mp4
• Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin.pdf
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo1-iPad-5sec.mp4
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo2-hook-control.mp4
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo3-automation.mp4
• Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding.pdf
  • Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding-armv8.mp4
  • Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding-english.mp4
  • hash.mp4
  • slash.mp4
  • tick.mp4
• Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoiP-Configuration-Interfaces.pdf
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-1.mp4
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-2.mp4
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-3.mp4
• Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-All.pdf
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-All-Demo-Extras.zip
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllAtomBombing.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllGhostWriting.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllSetWindowsLongPtr.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllStackBomber.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllnmapMap.mp4
• Jack-Baker-Hacking-Web-Assembly-Games.pdf
  • Jack-Baker-Hacking-Web-Assembly-Games-Demo-1.mp4
  • Jack-Baker-Hacking-Web-Assembly-Games-Demo-2.mp4
• Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil.pdf
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-1.mp4
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-2.mp4
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-3.mp4
• Jeff-Dileo-Evil-eBPF-In-Depth.pdf
  • Jeff-Dileo-Evil-eBPF-In-Depth-DEMO-call.mp4
  • Jeff-Dileo-Evil-eBPF-In-Depth-DEMO-reduce.mp4
• Jens-Mueller-Re-Whats-up-Johnny-Covert-Content-Attacks-on-Email-End-to-End-Encryption.pdf
  • Jens Mueller-demo-decryption-oracle.ogv
  • Jens Mueller-demo-signing-oracle.ogv
• Jmaxxz-Your-Car-is-My-Car.pdf
  • OpenRemoteStart-master
    • images/
    • src/
    • LICENSE
    • README.md
    • project.properties
  • Jmaxxz - 0 - BenchCarTour.mp4
  • Jmaxxz - 1 - StartingBenchCarRf.mp4
  • Jmaxxz - 10 - StartImprezaWithoutTransponder.mp4
  • Jmaxxz - 11 -StartMiniWIthoutKey.mp4
  • Jmaxxz - 2 - CloneExistingRemote_ShortEdit - UPDATED V2.mp4
  • Jmaxxz - 2 -CloneExistingRemote.mp4
  • Jmaxxz - 3 - StartCar.mp4
  • Jmaxxz - 4 - DriveOff - UPDATED V2.mp4
  • Jmaxxz - 4 - DriveOff.mp4
  • Jmaxxz - 5 - DisableWheelLockAndDrive.mp4
  • Jmaxxz - 6 - StartCarAfterStop.mp4
  • Jmaxxz - 9 - SqliStartCar.mp4
• Joshua-Maddux-API-Induced-SSRF.pdf
  • Joshua Maddux - API-Induced SSRF - Demo 1 appr-wrapper.mp4
  • Joshua Maddux - API-Induced SSRF - Demo 2 webkitorg.mp4
  • Joshua Maddux - API-Induced SSRF - Demo 3 twilio.mp4
• Leon-Jacobs-Meticulously-Modern-Mobile-Manipulations.pdf
  • Leon Jacobs - 1. http-file-browser.mp4
  • Leon Jacobs - 2. heap-ios-tiktok.mp4
  • Leon Jacobs - 3. reflection-jar-socket.mp4
  • Leon Jacobs - 4. ios-flex-plugin.mp4
  • Leon Jacobs - 5. android-stetho.mp4
  • Leon Jacobs - 6. jenkins-ci.mov.mp4
• Maksim-Shudrak-Zero-Bugs-Found-Hold-My-Beer-AFL-How-to-Improve-Coverage-guided-Fuzzing-and-Find-New-Zero-days-in-Tough-Targets.pdf
  • afl_main_screen_fast.mkv
  • manul_main.mkv
  • zeek_1.mkv
• Nikhil-Mittal-RACE-Minimal-Rights-and-ACE-for-Active-Directory-Dominance.pdf
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo2-ModifyServicePermissions.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo3-JEAToDC.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo4-DumpDCHash.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo5-CompromiseForestRoot.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance- Demo1-PSRemotingToDC.mp4
• Orange-Tsai-and-Meh-Chang-Infiltrating-Corporate-Intranet-Like-NSA-Pre-auth-RCE-on-Leading-SSL-VPNs.pdf
  • Orange-Tsai-and-Meh-Chang-Infiltrating-Corporate-Intranet-Like-NSA-Pre-auth-RCE-on-Leading-SSL-VPNs-Demo-Video.zip
  • Orange-Tsai-and-Meh Chang-Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs-demo_fortigate.mp4
  • Orange-Tsai-and-Meh Chang-Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs-demo_pulsesecure_v1.mp4
• Pedro-Cabrera-SDR-Against-Smart-TVs-URL-and-Channel-Injection-Attacks.pdf
  • 1_video.mp4
  • 2_video.mp4
  • PedroCabrera - SDR Against Smart TVs_video10-B+M.mp4
  • PedroCabrera - SDR Against Smart TVs_video3-NotFinal.mp4
  • PedroCabrera - SDR Against Smart TVs_video4.mp4
  • PedroCabrera - SDR Against Smart TVs_video5_inject_URL.mp4
  • PedroCabrera - SDR Against Smart TVs_video6-IISS-SDR.mp4
  • PedroCabrera - SDR Against Smart TVs_video7-IISS-DNS.mp4
  • PedroCabrera - SDR Against Smart TVs_video8-KL.mp4
  • PedroCabrera - SDR Against Smart TVs_video9-Mi.mp4
• Sheila-A-Berta-Backdooring-hardware-devices-by-injecting-malicious-payloads-on-Microcontrollers.pdf
  • CARSECU_demo.mp4
  • EUSART_demo.mp4
  • ROP_demo.mp4
• Xiling-Gong-Peter-Pi-Exploiting-Qualcomm-WLAN-and-Modem-Over-The-Air.pdf
  • demo - xiling gong, peter pi - exploiting qualcomm wlan and modem over the air.mp4
  • demo - xiling gong, peter pi - exploiting qualcomm wlan and modem over the air_1.mp4
• Yaron-Zinar-and-Marina-Simakov-Relaying-Credentials-Has-Never-Been-Easier-How-to-Easily-Bypass-the-Latest-NTLM-Relay-Mitigations.pdf
  • Zinar Simakov - epa_bypass_final.mp4
  • Zinar Simakov - session_key_final.mp4
• albinowax-HTTP-Desync-Attacks.pdf
  • albinowax-HTTP-Desync-Attacks-whitepaper.pdf
  • albinowax-HTTP-Desync-Attacks-demo.mp4
• albinowax-HTTP-Desync-Attacks-tool
  • build
    • classes/
    • libs/
    • resources/
    • tmp/
  • out
    • artifacts/
    • production/
  • resources
    • CL-TE.py
    • TE-CL.py
  • src
    • burp/
  • build.gradle
  • readme.md
  • sqlite-jdbc-3.23.1.jar
  • turbo-intruder-all.jar
• finalphoenix-Rise-of-the-Hypebots.pdf
  • finalphoenix-Rise-of-the-Hypebots-Complicated Bot.mp4
  • finalphoenix-Rise-of-the-Hypebots-botsThatBot.mp4
  • finalphoenix-Rise-of-the-Hypebots-fancy-monitor.mp4
  • finalphoenix-Rise-of-the-Hypebots-puppeteerBot.mp4
  • finalphoenix-Rise-of-the-Hypebots-simple-monitor.mp4
• Alexandre-Borges-dotNET-Malware-Threats.pdf
• Alon-Weinberg-Please-inject-me-a-x64-code-injection.pdf
  • Alon-Weinberg-Please-inject-me-a-x64-code-injection-Demo.mp4
• Alvaro-Munoz-Oleksandr-Mirosh-SSOWars-The-Token-Menace.pdf
  • Alvaro-Munoz-Oleksandr-Mirosh-SSOWars-The-Token-Menace-Demo-Videos.zip
• Amit-Waisel-and-Hila-Cohen-malproxy.pdf
  • Amit-Waisel-and-Hila-Cohen-malproxy-demo.mp4
• Andreas-Baumhof-Are-Quantum-Computers-Really-A-Threat-To-Cryptography.pdf
• Andy-Grant-Unpacking-pkgs.pdf
  • Andy-Grant-Unpacking-pkgs.mp4
• Ariel-Adversariel-Herbert-Voss-Dont-Red-Team-AI-like-a-Chump.pdf
• Ben-Morris-More-Keys-Than-A-Piano-Finding-Secrets-In-Publicly-Exposed-Ebs-Volumes.pdf
• Ben-Sadeghipour-Owning-the-clout-through-SSRF-and-PDF-generators.pdf
• Bill-Swearingen-HAKC-The-Police.pdf
• Brad-Dixon-Cheating-in-eSports-How-to-cheat-at-virtual-cycling-using-USB-hacks.compressed.pdf
• Brad-Dixon-Cheating-in-eSports-How-to-cheat-at-virtual-cycling-using-USB-hacks.pdf
• Brent-Stone-Reverse-Enginerring-17-Cars.pdf
  • Brent-Stone-Reverse-Enginerring-17-Cars-Video-Demo.mp4
• Brizendine-Stroschein-The-JOP-ROCKET-DEMO-1.mp4
• Brizendine-Stroschein-The-JOP-ROCKET.pdf
  • Brizendine-Stroschein-The-JOP-ROCKET-DEMO.mp4
• Campbell-Murray-GSM-We-can-hear-everyone-now.pdf
• Christopher-Roberts-Firmware-Slap.pdf
  • Christopher-Roberts-DEMO-1.mp4
  • Christopher-Roberts-DEMO-2.mp4
  • Christopher-Roberts-Firmware-Slap-DEMO-1.wmv
  • Christopher-Roberts-Firmware-Slap-DEMO-2.wmv
  • Christopher-Roberts-Firmware-Slap-DEMO-3.wmv
• Dan-Regalado-Defcon27AliDan.pdf
  • Dan-Regalado-ARM-Syscalls.mp4
• Daniel-Romero-and-Mario-Rivas-Why-you-should-fear-your-mundane-office.pdf
• Elliott-Thompson-Mi-Casa-Su-Casa.pdf
  • Elliott-Thompson-Mi-Casa-Su-Casa-Video-Demonstration.mp4
• Eyal-Itkin-Say-Cheese-How-I-Ransomwared-Your-DSLR-Camera.pdf
  • Eyal-Itkin-Say-Cheese-How-I-Ransomwared-Your-DSLR-Camera-Demo.mp4
• Gregory-Pickett-Breaking-The-Back-End-It-Is-Not-Always-A-Bug.-Sometimes-It-Is-Just-Bad-Design.pdf
  • Gregory-Pickett-Breaking-The-Back-End-It-Is-Not-Always-A-Bug.-Sometimes-It-Is-Just-Bad-Design-Demo.mp4
• Jacob-Baines-Help-Me-Vulnerabilities.-Youre-My-Only-Hope.pdf
• Jesse-Michael-Get-off-the-kernel-if-you-cant-drive.pdf
• Joe-Grand-Badge.pdf
  • Joe-Grand-The-Badge.pdf
• Joseph-Cox-How-You-Can-Buy-ATT-T-Mobile-and-Sprint-Real-Time-Location-Data-on-the-Black-Market.pdf
• Joseph-Menn-Change-the-World-cDc-Style.pdf
• Junyu-Zhou-and-Ce-Qin-and-Jianing-Wang-Web2Own-Attacking-Desktop-Apps-From-Web-Securitys-Perspective.pdf
• Katherine-Pratt-Hacking-Your-Thoughts-Batman-Forever-meets-Black-Mirror.pdf
  • Katherine-Pratt-Hacking-Your-Thoughts-Batman-Forever-meets-Black-Mirror.pptx
• Kyle-Gwinnup-Next-Generation-Process-Emulation-with-Binee.pdf
  • Kyle-Gwinnup-Next-Generation-Process-Emulation-with-Binee-Demo.mp4
• Masarah-Paquet-Clouston-Olivier-Bilodeau-The-Industry-of-Social-Media-Manipulation-Driven-by-Malware.pdf
  • Masarah-Paquet-Clouston-Olivier-Bilodeau-The-Industry-of-Social-Media-Manipulation-support-video-luminati-sdk-demo.mp4
• Matt-Wixey-Sound-Effects-Exploring-Acoustic-Cyber-Weapons.pdf
• Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht.pdf
  • Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht-WINDOWS-DEMO.mp4
• Michael-Stepankin-Apache-Solr-Injection.pdf
• Nicolas-Oberli-Poking-the-S-in-SD-cards.PDF
  • Nicolas-Oberli-Poking-the-S-in-SD-cards-DEMO.mkv
  • Nicolas-Oberli-Poking-the-S-in-SD-cards-DEMO.mp4
• Nina-Kollars-Confessions-of-a-Nespresso-Money-Mule.pdf
• Omer-Gull-SELECT-code-execution-FROM-USING-SQLite.pdf
  • Omer-Gull-SELECT-code-execution-FROM-USING-SQLite-Demo.mp4
  • Omer-Yair-Exploiting-Windows-Exploit-Mitigation-for-ROP-Exploits-Demo.mp4
  • Omer-Yair-Exploiting-Windows-Exploit-Mitigation-for-ROP-Exploits.pdf
• Panel-DC101-The-Panel.pdf
• Patrick-Wardle-Harnessing-Weapons-of-Mac-Destruction.pdf
• Phar-No-Mas-How-One-Side-Channel-Flaw-Opens-Atm-Pharmacies-and-Government-Secrets-Up-to-Attack.pdf
• Philippe-Laulheret-Introduction-to-Hardware-Hacking-Extended-Version.pdf
  • Philippe-Laulheret-Introduction-to-Hardware-Hacking-Demo-Video.mp4
• Roger-Dingledine-TOR-Censorship-Arms-Race.pdf
• Travis-Palmer-First-try-DNS-Cache-Poisoning-with-IPv4-and-IPv6-Fragmentation.pdf
• Truman-Kain-Surveillance-Detection-Scout.pdf
  • Truman-Kain-Surveillance-Detection-Scout-Demo.mp4
• Wenxiang-Qian-Yuxiang-Li-Huiyu-Wu-Breaking-Google-Home-Exploit-It-with-SQLite-Magellan.pdf
• WillC-Phreaking-Elevators.pdf
• Workshop-Anthony-Rose-Introduction-to-AMSI-Bypasses-and-Sandbox-Evasion.pdf
• Xiaohuihui-All-The-4G-Modules-Could-Be-Hacked.pdf
• Zhang-Xiangqian-Liu-Huiming-Your-secret-files-are-mine.pdf
• d4krm4tter-Mike-Spicer-I-Know-What-You-Did-Last-Summer.pdf
  • d4krm4tter-Mike-Spicer-I-Know-What-You-Did-Last-Summer-Demo.mp4
• droogie-go-null-yourself.pdf
• grichter-Reverse-Engineering-4G-Hotspots-For-Fun-Bugs-Net-Financial-Loss.pdf
  • grichter-Reverse-Engineering-4G-Hotspots-For-Fun-Bugs-Net-Financial-Loss-MF910-CSRF-Demo.mp4
• jiska-fabian-vacuum-cleaning-security.pdf
• smea-Adventures-in-smart-buttplug-penetration-testing.pdf

Basado en el libro de Docker: SecDevOps , Fran Ramírez , Alberto Berdugo y un servidor , hemos tenido la oportunidad de grabar un webinar en colaboración con The Security Sentinel .

En dicho webinar, prácticamente hemos cubierto todo el contenido del libro, pero en vez de la introducción a Docker Swarm, la hemos sustituido con una amplia introducción a Kubernetes y hemos ampliado la parte de SecDevOps. Además cada apartado teórico está repleto de ejemplos para que el alumno pueda poner en práctica lo aprendido.

En Cyberhades hemos estado usando Flickr como repositorio de imágenes desde el 2008. Incluso en los años 2015 y 2016 pagamos por una cuenta profesional, que honestamente no recuerdo la differencia entre la cuenta pro y la gratuita free, cuyo coste era de $24.95 al año. A partir del año 2017 volvimos a usar la cuenta free, porque no le estábamos sacando ningún beneficio a la cuenta de pago. Nuestra experiencia con Flickr siempre ha sido muy positiva, nunca hemos tenido problemas con el servicio, pero el año pasado Flickr fue adquirida por SmugMug , y recientemente anunciaron que las cuentas gratuitas de Flickr estarían limitadas a un máximo de 1000 imágenes, y el resto serían borradas, a menos que pagues por una cuenta pro, $50 al año, o $6 al mes. En nuestro caso, tenemos en Flickr 3.997 imágenes, con lo cual si Flickr nos borra 2.997 imágenes, tendría un gran impacto en el blog. La cuenta pro de Flickr provee de otros beneficios más allá del número ilimitado de fotos, y si eres fotógrafo lo mismo te interesa, pero en nuestro caso, quitando el CDN , no nos aporta ningún valor extra que beneficie el blog.

Ya están disponibles los vídeos de Black Hat 2018 :

• Black Hat USA 2018 Keynote: Parisa Tabriz
• [How can Communities Move Forward After Incidents of Sexual Harassment or Assault?]( https://www.youtube.com/watch?v=vH28IUgJCH8&index=3&t=0s& list=PLH15HpR5qRsVAXGmSVfjWrGtGLJjIJuGe)
• [Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native Library]( https://www.youtube.com/watch?v=s0Tqi7fuOSU&inde x=4&t=0s&list=PLH15HpR5qRsVAXGmSVfjWrGtGLJjIJuGe)
• [Fire & Ice: Making and Breaking macOS Firewalls]( https://www.youtube.com/watch?v=_xsnedUp4ko&index=5&t=0s&list=PLH15HpR5qRsVAXGmSVfjWrGtGLJj IJuGe)
• [Practical Web Cache Poisoning: Redefining ‘Unexploitable’]( https://www.youtube.com/watch?v=j2RrmNxJZ5c&index=6&t=0s&list=PLH15HpR5qRsVAXGmSV fjWrGtGLJjIJuGe)
• [An Attacker Looks at Docker: Approaching Multi-Container Applications]( https://www.youtube.com/watch?v=HTM3ZrSvp6c&index=7&t=0s&list=PLH15Hp R5qRsVAXGmSVfjWrGtGLJjIJuGe)
• [SirenJack: Cracking a ‘Secure’ Emergency Warning Siren System]( https://www.youtube.com/watch?v=49KoUmiJuts&index=8&t=0s&list=PLH15HpR5qRsVAX GmSVfjWrGtGLJjIJuGe)
• Are You Trading Stocks Securely? Exposing Security Flaws in Trading Technologies
• GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUs
• Finding Xori: Malware Analysis Triage with Automated Disassembly
• Miasm: Reverse Engineering Framework
• Over-the-Air: How we Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars
• DeepLocker - Concealing Targeted Attacks with AI Locksmithing
• It’s a PHP Unserialization Vulnerability Jim, but Not as We Know It
• Day Zero: A Road Map to #BHUSA 2018
• Lessons and Lulz: The 4th Annual Black Hat USA NOC Report
• Return of Bleichenbacher’s Oracle Threat (ROBOT)
• An Attacker Looks at Docker: Approaching Multi-Container Applications
• Follow the White Rabbit: Simplifying Fuzz Testing Using FuzzExMachina
• The Finest Penetration Testing Framework for Software-Defined Networks
• Understanding and Exploiting Implanted Medical Devices
• Mainframe [z/OS] Reverse Engineering and Exploit Development
• Lowering the Bar: Deep Learning for Side Channel Analysis
• Hardening Hyper-V through Offensive Security Research
• SirenJack: Cracking a ‘Secure’ Emergency Warning Siren System
• Practical Web Cache Poisoning: Redefining ‘Unexploitable’
• IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies
• SDL the Wont Break the Bank
• For the Love of Money: Finding and Exploiting Vulnerabilities in Mobile Point of Sales Systems
• Last Call for SATCOM Security
• Exploitation of a Modern Smartphone Baseband
• Automated Discovery of Deserialization Gadget Chains
• Legal Liability for IOT Cybersecurity Vulnerabilities
• Another Flip in the Row
• How can Someone with Autism Specifically Enhance the Cyber Security Workforce?
• Catch me, Yes we can! - Pwning Social Engineers
• Automating Exploit Generation for Arbitrary Types of Kernel Vulnerabilities
• Windows Offender: Reverse Engineering Windows Defender’s Antivirus Emulator
• Protecting the Protector, Hardening Machine Learning Defenses Against Adversarial Attacks
• Playback: A TLS 1.3 Story
• An Inside Story of Mitigating Speculative Execution Side Channel Vulnerabilities
• TLBleed: When Protecting Your CPU Caches is Not Enough
• None of My Pixel is Your Business: Active Watermarking Cancellation Against Video Streaming Service
• So I became a Domain Controller
• WebAssembly: A New World of Native Exploits on the Browser
• Outsmarting the Smart City
• Are You Trading Stocks Securely? Exposing Security Flaws in Trading Technologies
• AI & ML in Cyber Security - Why Algorithms are Dangerous
• Stealth Mango and the Prevalence of Mobile Surveillanceware
• Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels
• A Deep Dive into macOS MDM (and How it can be Compromised)
• Pestilential Protocol: How Unsecure HL7 Messages Threaten Patient Lives
• GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUs
• Decompiler Internals: Microcode
• Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform Capabilities
• Windows Notification Facility: Peeling the Onion of the Most Undocumented Kernel Attack Surface Yet
• Kernel Mode Threats and Practical Defenses
• New Norms and Policies in Cyber-Diplomacy
• Snooping on Cellular Gateways and Their Critical Role in ICS
• Your Voice is My Passport
• Reconstruct the World from Vanished Shadow: Recovering Deleted VSS Snapshots
• Identity Theft: Attacks on SSO Systems
• The Science of Hiring and Retaining Female Cybersecurity Engineers
• Black Box is Dead. Long Live Black Box!
• Fire & Ice: Making and Breaking macOS Firewalls
• Demystifying PTSD in the Cybersecurity Environment
• The Problems and Promise of WebAssembly
• Real Eyes, Realize, Real Lies: Beating Deception Technologies
• ARTist - An Instrumentation Framework for Reversing and Analyzing Android Apps and the Middleware
• Money-rity Report: Using Intelligence to Predict the Next Payment Card Fraud Victims
• Lessons from Virginia - A Comparative Forensic Analysis of WinVote Voting Machines
• Stop that Release, There’s a Vulnerability!
• Pwnie Awards
• Beating the Blockchain by Mapping Out Decentralized Namecoin and Emercoin Infrastructure
• Applied Self-Driving Car Security
• Is the Mafia Taking Over Cybercrime?
• AFL’s Blindspot and How to Resist AFL Fuzzing for Arbitrary ELF Binaries
• Back to the Future: A Radical Insecure Design of KVM on ARM
• I, for One, Welcome Our New Power Analysis Overlords
• How can Communities Move Forward After Incidents of Sexual Harassment or Assault?
• The Air-Gap Jumpers
• Attacks on the Curl-P Hash Function Leading to Signature Forgeries in the IOTA Signature Scheme
• InfoSec Philosophies for the Corrupt Economy
• ZEROing Trust: Do Zero Trust Approaches Deliver Real Security?
• Breaking the IIoT: Hacking industrial Control Gateways
• Holding on for Tonight: Addiction in InfoSec
• Dissecting Non-Malicious Artifacts: One IP at a Time
• How I Learned to Stop Worrying and Love the SBOM
• Why so Spurious? Achieving Local Privilege Escalation on Operating Systems
• Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!
• A Brief History of Mitigation: The Path to EL1 in iOS 11
• Squeezing a Key through a Carry Bit
• Behind the Speculative Curtain: The True Story of Fighting Meltdown and Spectre
• LTE Network Automation Under Threat
• Every ROSE has its Thorn: The Dark Art of Remote Online Social Engineering
• From Workstation to Domain Admin: Why Secure Administration isn’t Secure and How to Fix it
• Don’t @ Me: Hunting Twitter Bots at Scale
• Subverting Sysmon: Application of a Formalized Security Product Evasion Methodology
• WireGuard: Next Generation Secure Network Tunnel
• The Unbearable Lightness of BMC’s
• Meltdown: Basics, Details, Consequences
• Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community
• Threat Modeling in 2018: Attacks, Impacts and Other Updates
• Deep Dive into an ICS Firewall, Looking for the Fire Hole
• Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
• No Royal Road … Notes on Dangerous Game
• Reversing a Japanese Wireless SD Card - From Zero to Code Execution
• Compression Oracle Attacks on VPN Networks
• Remotely Attacking System Firmware
• There will be Glitches: Extracting and Analyzing Automotive Firmware Efficiently
• Legal Landmines: How Law and Policy are Rapidly Shaping Information Security
• Blockchain Autopsies - Analyzing Ethereum Smart Contract Deaths
• Deep Neural Networks for Hackers: Methods, Applications, and Open Source Tools
• How TRITON Disrupted Safety Systems & Changed the Threat Landscape of Industrial Control Systems
• A Dive in to Hyper-V Architecture & Vulnerabilities
• KeenLab iOS Jailbreak Internals: Userland Read-Only Memory can be Dangerous
• From Bot to Robot: How Abilities and Law Change with Physicality
• Attacking Client-Side JIT Compilers
• Stress and Hacking: Understanding Cognitive Stress in Tactical Cyber Ops
• Finding Xori: Malware Analysis Triage with Automated Disassembly
• Edge Side Include Injection: Abusing Caching Servers into SSRF and Transparent Session Hijacking
• Qualitative Look at Autonomous Peer Communication’s Impact on Organizational Phishing Detection
• Measuring the Speed of the Red Queen’s Race; Adaption and Evasion in Malware
• Detecting Credential Compromise in AWS
• Keynote: Optimistic Dissatisfaction with the Status Quo

Aquí os dejo los vídeos que se han publicado de DEF CON 26 ). Ya tenéis entretenimiento para el fin de semana que se avecina.

Recuerda que también tienes el material disponible.

• Rob Joyce - NSA Talks Cybersecurity
• Eyal Itkin, Yaniv Balmas - What the Fax?!
• Josh Mitchell - Ridealong Adventures: Critical Issues with Police Body Cameras
• Svea, Suggy, Till - Inside the Fake Science Factory
• Ladar Levison, hon1nbo - Booby Trapping Boxes
• 0x200b - Detecting Blue Team Research Through Targeted Ads
• [Si, Agent X - Wagging the Tail:Covert Passive Surveillance]( https://www.youtube.com/watch?v=tYFOXeItRFM&list=PL9fPq3eQfaaD0cf5c7wkzMoj2kifz GO4U&index=8&t=0s)
• Alexei Bulazel - Reverse Engineering Windows Defenders Emulator
• Alfonso Alguacil and Murillo Moya - Playback a TLS 1 point 3 story
• Bui and Rao - Last mile authentication problem Exploiting the missing link
• Champion and Law - Building the Hacker Tracker
• Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86
• Christopher Domas - The Ring 0 Facade Awakening the Processors Inner Demons
• Damien virtualabs Cauquil - You had better secure your BLE devices
• Douglas McKee - 80 to 0 in Under 5 Seconds
• Daniel Crowley and Panel - Outsmarting the Smart City
• delta zero and Azeem Aqil - Your Voice is My Passport
• Daniel Zolnikov - A Politicians Successful Efforts to Fight Surveillance
• Dr Holtmanns and Singh - 4G Who is Paying Your Cellular Phone Bill Video
• Dr Rasthofer and Panel - Worrisome Security Issues in Tracker Apps
• Dr Matthews and Panel - A DEF CON Guide to Adversarial Testing of Software
• Elinor Mills and Panel - The L0pht Testimony 20 Years Later and Other Things
• Foster and Ayrey - Dealing with Residual Certificates for Pre-owned Domains
• Franklin and Franklin - Defending the 2018 Midterm Elections from Foreign Adversaries
• Gabriel Ryan - Bypassing Port Security In 2018 Defeating MacSEC and 802 1x 2010
• George Tarnovsky - You Can Run but You Cant Hide Reverse Engineering Using X-Ray
• Greenstadt and Dr Caliskan - De-anonymizing Programmers from Source Code
• Guang Gong - Pwning theToughest Target, the Largest Bug Bounty in the History of ASR
• HuiYu and Qian - Breaking Smart Speakers We are Listening to You
• Ian Haken - Automated Discovery of Deserialization Gadget Chains
• Izycki and Colli - Digital Leviathan A Comprehensive List of Nation State Big Brothers
• Jeanette Manfra - Securing our Nations Election Infrastructure
• Joe Rozner - Synfuzz Building a Grammar Based Retargetable Test Generation Framework
• Johnson and Stavrou - Vulnerable Out of the Box - Evaluation of Android Carrier Devices
• Josep Pi Rodriguez - WingOS: How to Own Millions of Devices .
• Kim and Choi - Your Watch Can Watch You! Pitfalls in the Samsung Gear Smartwatch
• Knight and Speers - Designing and Applying Extensible RF Fuzzing Tools
• Krotofil , Wetzels - Thru the Eyes of the Attacker Designing Embedded Systems for ICS
• Lane Broadbent - Trouble in the Tubes How Internet Routing Security Breaks Down
• ldionmarcil - Edge Side Include Injection Abusing Caching Servers into SSRF
• Levinson and Borges - Ill See Your Missile and Raise You A MIRV
• Maggie Mayhem - Sex Work After SESTA FOSTA
• Maksim Shudrak - Fuzzing Malware For Fun and Profit
• Martin Vigo - Compromising Online Accounts by Cracking Voicemail Systems
• Matt King - Micro Renovator Bringing Processor Firmware up to Code
• Galloway, Yunusov - For the Love of Money Finding and Exploiting Vulns in mPOS Systems
• Zhenxuan Bai and Panel - Replay Attacks on Ethereum Smart Contracts
• Zheng and Panel - Your Peripheral Has Planted Malware An Exploit of NXP SOCs
• Zheng and Bai - Fasten your seatbelts We are escaping iOS 11 Sandbox
• zerosum0x0 - Demystifying MS17 010 Reverse Engineering the ETERNAL Exploits
• zenofex - Dissecting the Teddy Ruxpin Reverse Engineering the Smart Bear
• Zeng and Panel - Lora Smart Water Meter Security Analysis
• Zach and Alex - Infecting The Embedded Supply Chain
• Yu Wang - Attacking the macOS Kernel Graphics Driver
• yawnbox - Privacy Infrastructure Challenges and Opportunities
• Xiao and Panel - Hacking the Brain Customize Evil Protocol to Pwn an SDN Con
• William Martin - SMBetray Backdooring and Breaking Signatures
• William Martin - One Click to OWA
• West and Campbell - barcOwned Popping Shells with Your Cereal Box
• Wesley McGrew - An Attacker Looks at Docker Approaching Multi Container Applications
• Vincent Tan - Hacking BLE Bicycle Locks for Fun and a Small Profit
• Truman Kain - Dragnet Your Social Engineering Sidekick
• Thiago Alves - Hacking PLCs and Causing Havoc on Critical Infrastructures
• The Tarquin - Weaponizing Unicode Homographs Beyond IDNs
• The Dark Tangent and Panel - DEF CON GROUPS
• The Dark Tangent - Welcome To DEF CON & Badge Maker Talk
• The Dark Tangent - DEF CON 26 Closing Ceremonies
• Steven Danneman - Your Banks Digital Side Door
• smea - Jailbreaking the 3DS Through 7 Years of Hardening
• Slava Makkaveev - Man In The Disk
• singe - Practical and Improved Wifi MitM with Mana
• Shkatov and Michael - UEFI Exploitation for the Masses
• Sheng Hao Ma - Playing Malware Injection with Exploit Thoughts
• sghctoma - All Your Math are Belong to Us
• Sean Metcalf - Exploiting Active Directory Administrator Insecurities
• Seamus Burke - A Journey Into Hexagon Dissecting a Qualcomm Baseband
• Sanat Sharma - House of Roman a Leakless Heap Fengshui to Achieve RCE on PIE Binaries
• Ruo Ando - Asura PCAP File Analyzer for Anomaly Packets Detection
• Rowan Phipps - ThinSIM based Attacks on Mobile Money Systems
• Rousseau and Seymour - Finding Xori Malware Analysis Triage with Automated Disassembly
• Romailler and Amiet - Reaping and Breaking Keys at Scale When Crypto Meets Big Data
• Rob Joyce - Building Absurd Christmas Light Shows
• Riedesel and Hakimian - Tineola Taking a Bite Out of Enterprise Blockchain
• Ricky HeadlessZeke Lawshae - Who Controls the Controllers Hacking Crestron
• Richard Thieme - The Road to Resilience How Real Hacking Redeems a Damnable Profession
• Patrick Wardle - The Mouse is Mightier than the Sword
• Patrick Wardle - Fire and Ice Making and Breaking macOS Firewalls
• Paternotte and van Ommeren - It WISNt Me Attacking Industrial Wireless Mesh Networks
• Panel - DC 101 Panel
• Ossmann and Spill - Revolting Radios
• Orange Tsai - Breaking Parser Logic Take Your Path Normalization Off and Pop 0Days Out
• Nirenberg and Buchwald - Reverse Engineering Hacking Documentary Series
• Nick Cano - Relocation Bonus Attacking the Windows Loader
• Nevermoe - One Step Ahead of Cheaters Instrumenting Android Emulators
• Morgan Indrora Gangwere - (Ab)using Binaries from Embedded Devices for Fun and Profit
• Alexandre Borges - Ring 0 Ring 2 Rootkits Bypassing Defenses
• Berta and De Los Santos - Rock appround the Clock Tracking Malware Developers
• David Melendez Cano - Avoiding CounterDrone Systems with NanoDrones
• Eric Sesterhenn - In Soviet Russia Smartcard Hacks You
• Bai and Zheng - Analyzing and Attacking Apple Kernel Drivers

Desde la página de IronGeek podéis ver los vídeos de todas (casi) las presentaciones de DerbyCon 8.0 . Aquí tenéis la lista de los mismos:

• Opening
• How to influence security technology in kiwi underpants Benjamin Delpy
• Panel Discussion - At a Glance: Information Security Ed Skoudis, John Strand, Lesley Carhart. Moderated by: Dave Kennedy
• Red Teaming gaps and musings Samuel Sayen
• A Process is No One: Hunting for Token Manipulation Jared Atkinson, Robby Winchester
• Fuzz your smartphone from 4G base station side Tso-Jen Liu
• Clippy for the Dark Web: Looks Like You’re Trying to Buy Some Dank Kush, Can I Help You With That? Emma Zaballos
• Synfuzz: Building a Grammar Based Re-targetable Test Generation Framework Joe Rozner
• Escoteric Hashcat Attacks Evilmog
• RFID Luggage Tags, IATA vs Real Life Daniel Lagos
• #LOL They Placed Their DMZ in the Cloud: Easy Pwnage or Disruptive Protection Carl Alexander
• Maintaining post-exploitation opsec in a world with EDR Michael Roberts, Martin Roberts
• Hey! I found a vulnerability - now what? Lisa Bradley, CRob
• Foxtrot C2: A Journey of Payload Delivery Dimitry Snezhkov
• Ridesharks Kaleb Brown
• IRS, HR, Microsoft and your Grandma: What they all have in common Christopher Hadnagy, Cat Murdock
• #LOLBins - Nothing to LOL about! Oddvar Moe
• Everything Else I Learned About Security I Learned From Hip-Hop Paul Asadoorian
• Hackers, Hugs, & Drugs: Mental Health in Infosec Amanda Berlin
• Android App Penetration Testing 101 Joff Thyer, Derek Banks
• Draw a Bigger Circle: InfoSec Evolves Cheryl Biswas
• I Can Be Apple, and So Can You Josh Pitts
• From Workstation to Domain Admin: Why Secure Administration Isn’t Secure and How to Fix It Sean Metcalf
• MS17-010? zerosum0x0
• The Unintended Risks of Trusting Active Directory Lee Christensen, Will Schroeder, Matt Nelson
• Lessons Learned by the WordPress Security Team Aaron D. Campbell
• IronPython… omfg Marcello Salvati
• Invoke-EmpireHound - Merging BloodHound & Empire for Enhanced Red Team Workflow Walter Legowski
• When Macs Come Under ATT&CK Richie Cyrus
• Abusing IoT Medical Devices For Your Precious Health Records Saurabh Harit, Nick Delewski
• Detecting WMI exploitation Michael Gough
• Gryffindor | Pure JavaScript, Covert Exploitation Matthew Toussain
• Instant Response: Making IR faster than you thought possible! Mick Douglas, Josh Johnson
• The History of the Future of Cyber-Education Winn Schwartau
• State of Win32k Security: Revisiting Insecure design Vishal Chauhan
• Offensive Browser Extension Development Michael Weber
• Protect Your Payloads: Modern Keying Techniques Leo Loobeek
• Jump Into IOT Hacking with the Damn Vulnerable Habit Helper Device Nancy Snoke, Phoenix Snoke
• Tales From the Bug Mine - Highlights from the Android VRP Brian Claire Young
• Decision Analysis Applications in Threat Analysis Frameworks Emily Shawgo
• Threat Intel On The Fly Tazz
• Make Me Your Dark Web Personal Shopper! Emma Zaballos
• Driving Away Social Anxiety Joey Maresca
• Off-grid coms and power Justin Herman
• CTFs: Leveling Up Through Competition Alex Flores
• Extending Burp to Find Struts and XXE Vulnerabilities Chris Elgee
• Introduction to x86 Assembly DazzleCatDuo
• Pacu: Attack and Post-Exploitation in AWS Spencer Gietzen
• An Inconvenient Truth: Evading the Ransomware Protection in Windows 10 Soya Aoyama
• Brutal Blogging - Go for the Jugular Kate Brew
• RID Hijacking: Maintaining Access on Windows Machines Sebastian Castro
• Your Training Data is Bad and You Should Feel Bad Ryan J. O’Grady
• So many pentesting tools from a $4 Arduino Kevin Bong, Michael Vieau
• Building an Empire with (Iron)Python Jim Shaver
• SAEDY: Subversion and Espionage Directed Against You Judy Towers
• OSX/Pirrit - Reverse engineering mac OSX malware and the legal department of the company who makes it Amit Serper, Niv Yona, Yuval Chuddy
• How to test Network Investigative Techniques(NITs) used by the FBI Dr. Matthew Miller
• Cloud Computing Therapy Session Cara Marie, Andy Cooper
• Silent Compromise: Social Engineering Fortune 500 Businesses Joe Gray
• Going on a Printer Safari - Hunting Zebra Printers James Edge
• Hardware Slashing, Smashing, and Reconstructing for Root access Deral Heiland
• App-o-Lockalypse now! Oddvar Moe
• Web App 101: Getting the lay of the land Mike Saunders
• Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation) Daniel Bohannon
• WE ARE THE ARTILLERY: Using Google Fu To Take Down The Grids Chris Sistrunk, Krypt3ia, SynAckPwn
• Just Let Yourself In David Boyd
• A “Crash” Course in Exploiting Buffer Overflows (Live Demos!) Parker Garrison
• Living in a Secure Container, Down by the River Jack Mannino
• VBA Stomping - Advanced Malware Techniques Carrie Roberts, Kirk Sayre, Harold Ogden
• Media hacks: an Infosec guide to dealing with journalists Sean Gallagher, Steve Ragan, Paul Wagenseil
• Deploying Deceptive Systems: Luring Attackers from the Shadows Kevin Gennuso
• The Money-Laundering Cannon: Real cash; Real Criminals; and Real Layoffs Arian Evans
• Perfect Storm: Taking the Helm of Kubernetes Ian Coldwater
• How to put on a Con for Fun and (Non) Profit Benny Karnes, John Moore, Rick Hayes, Matt Perry, Bill Gardner, Justin Rogosky, Mike Fry, Steve Truax
• Web app testing classroom in a box - the good, the bad and the ugly Lee Neely, Chelle Clements, James McMurry
• Metasploit Town Hall 0x4 Brent Cook, Aaron Soto, Adam Cammack, Cody Pierce
• Community Based Career Development or How to Get More than a T-Shirt When Participating as part of the Community Kathleen Smith, Magen Wu, Cindy Jones, Kathryn Seymour, Kirsten Renner
• Disaster Strikes: A Hacker’s Cook book Jose Quinones, Carlos Perez
• Ninja Looting Like a Pirate Infojanitor
• Hacking Mobile Applications with Frida David Coursey
• Victor or Victim? Strategies for Avoiding an InfoSec Cold War Jason Lang, Stuart McIntosh
• Ubiquitous Shells Jon Gorenflo
• 99 Reasons Your Perimeter Is Leaking - Evolution of C&C John Askew
• Ship Hacking: a Primer for Today’s Pirate Brian Satira, Brian Olson
• Code Execution with JDK Scripting Tools & Nashorn Javascript Engine Brett Hawkins
• PHONOPTICON - leveraging low-rent mobile ad services to achieve state-actor level mass surveillance on a shoestring budget Mark Milhouse
• Patching: Show me where it hurts Cheryl Biswas
• Advanced Deception Technology Through Behavioral Biometrics Curt Barnard, Dawud Gordon
• We are all on the spectrum: What my 10-year-old taught me about leading teams Carla A Raisler
• No Place Like Home: Real Estate OSINT and OPSec Fails John Bullinger
• The Layer2 Nightmare Chris Mallz
• Attacking Azure Environments with PowerShell Karl Fosaaen
• Blue Blood Injection: Transitioning Red to Purple Lsly Ayyy
• Mirai, Satori, OMG, and Owari - IoT Botnets Oh My Peter Arzamendi
• Comparing apples to Apple Adam Mathis
• How online dating made me better at threat modeling Isaiah Sarju
• Threat Hunting with a Raspberry Pi Jamie Murdock
• M&A Defense and Integration - All that Glitters is not Gold Sara Leal, Jason Morrow
• Social Engineering At Work - How to use positive influence to gain management buy-in for anything April Wright
• Ham Radio 4 Hackers Eric Watkins, Devin Noel
• Getting Control of Your Vendors Before They Take You Down Dan Browder
• Cyber Intelligence: There Are No Rules, and No Certainties Coleman Kane
• Getting Started in CCDC Russell Nielsen
• Changing Our Mindset From Technical To Psychological Defenses Andrew Kalat
• Red Mirror: Bringing Telemetry to Red Teaming Zach Grace
• Two-Factor, Too Furious: Evading (and Protecting) Evolving MFA Schemes Austin Baker, Doug Bienstock
• IoT: Not Even Your Bed Is Safe Darby Mullen
• Fingerprinting Encrypted Channels for Detection John Althouse
• On the Nose: Bypassing Huawei’s Fingerprint authentication by exploiting the TrustZone Nick Stephens
• Bypassing Port-Security In 2018: Defeating MacSEC and 802.1x-2010 Gabriel Ryan
• Goodbye Obfuscation, Hello Invisi-Shell: Hiding Your Powershell Script in Plain Sight Omer Yair
• Cloud Forensics: Putting The Bits Back Together Brandon Sherman
• Killsuit: The Equation Group’s Swiss Army knife for persistence, evasion, and data exfil Francisco Donoso
• The MS Office Magic Show Stan Hegt, Pieter Ceelen
• Living off the land: enterprise post-exploitation Adam Reiser
• Hillbilly Storytime: Pentest Fails Adam Compton
• Bug Hunting in RouterOS Jacob Baines
• Breaking Into Your Building: A Hackers Guide to Unauthorized Access Tim Roberts, Brent White
• The making of an iOS 11 jailbreak: Kiddie to kernel hacker in 14 sleepless nights. Bryce “soen” Bearchell
• Who Watches the Watcher? Detecting Hypervisor Introspection from Unprivileged Guests Tomasz Tuzel
• Pwning in the Sandbox: OSX Macro Exploitation & Beyond Adam Gold, Danny Chrastil
• IOCs Today, Intelligence-Led Security Tomorrow Katie Kusjanovic, Matthew Shelton
• Closing Ceremonies

Ahora que ya tenemos nuestro ESP32 listo para el combate, es hora de instalarlo. Lo primero que debemos hacer es usar un servidor MQTT con algún tipo de autentificación. Hasta ahora todas las pruebas que hemos hecho han sido usando el servidor de pruebas de io.eclipse.org sin ningún tipo de autentificación. Esto significa, que si alguien averigua los canales que usas, podría abrir y cerrar las puertas de tu garaje. No bueno!

En esta segunda entrada de esta serie, veremos como conectar un par de interruptores magnéticos, uno para cada puerta, los cuales nos permitirán saber si las puertas están cerradas o no.

En este caso, estoy usando este interruptor: https://www.adafruit.com/product/375 .

El interruptor tiene dos cables, uno va a tierra (GND) y el otro a uno de los GPIO de nuestro micro controlador. En este caso uso los GPIOs 25 y 26 para las puertas izquierda y derecha respectivamente.