0.23 hackthebay-2025 2025-04-28 2025-04-28 1 00:05 https://cfp.pacifichackers.com https://cfp.pacifichackers.com/media/hackthebay-2025/img/LogoBanner-10_koWzePv.png America/Los_Angeles MAIN TRACK Lightning Talk 2025-04-28T09:15:00-07:00 09:15 00:15 WELCOME CEREMONY hackthebay-2025-35-welcome-ceremony OPENING CEREMONY en WELCOME CEREMONY false https://cfp.pacifichackers.com/hackthebay-2025/talk/BCDYXL/ https://cfp.pacifichackers.com/hackthebay-2025/talk/BCDYXL/feedback/ MAIN TRACK Keynote 2025-04-28T09:30:00-07:00 09:30 00:30 OPENING KEYNOTE hackthebay-2025-36-keynote KEYNOTE Malcolm HarkinsEoin Wickens en OPENING KEYNOTE false https://cfp.pacifichackers.com/hackthebay-2025/talk/ZADCW7/ https://cfp.pacifichackers.com/hackthebay-2025/talk/ZADCW7/feedback/ MAIN TRACK Talk 2025-04-28T10:00:00-07:00 10:00 00:45 Not all Red Team engagements are spearphish > mimikatz > profit. If nothing else, this talk proves that some jobs still involve crawling around car parks at night and hiding in bushes with a high gain antenna to gain your objective. Traditionally, cyber incidents and Red Team operations focus on compromising Windows devices as an initial infection vector but for modern cloud native companies, this approach simply doesn’t work. In this talk, we will explore how we compromised an Electric Vehicle to infiltrate a corporate Smartphone, leveraging legitimate applications and protocols to move laterally and achieve full compromise of the environment. We will demonstrate the chaining of low code (and in some cases ancient techniques), abstract attack vectors targeting atypical devices and platforms and the abuse of protocols and inbuilt applications to conduct a full scale breach of the environment. hackthebay-2025-10-from-pocket-to-pwn-how-we-hacked-a-multinational-corporation-for-200-with-just-what-s-in-our-pockets-and-theirs- TALK /media/hackthebay-2025/submissions/XEVY8W/pocketpwn_ZwEZEm8.jpg Tim ShippLisa Landau en When Red Teaming a multinational technology company with an extensive security budget we had to think outside the box in order to leverage new attack pathways to gain a foothold in their environment where typical Red Teaming methodologies simply weren’t viable. Using readily available hardware and almost no code, we were able to abuse both application protocols and inbuilt applications to gain persistent access via a chained attack across multiple devices to gain system level access to a customer environment. This talk will focus on a modified real world scenario which included: Denial of BlueTooth service (conceptual due to legal implications) Wireless BadUSB Modified Metasploit for Android Abuse of Android Debugging Tool (ADB) to gain persistent reverse shell over Mobile Service (not USB) Abuse of ADB for real time screen recording and interaction Network enumeration via ADB Using ADB as a pivot for further compromise of the environment Exfiltration of VPN configuration and subsequent abuse of MFA Undetectable data exfiltration via mobile service This talk highlights how devastating attacks are still easily possible with a very low price entry point and virtually undetectable by most Security Tools. This talk will feature a live demo (if the demo gods deem it so) and aim to encourage aspiring penetration testers to think outside of the (Windows) box when approaching their objectives. false https://cfp.pacifichackers.com/hackthebay-2025/talk/XEVY8W/ https://cfp.pacifichackers.com/hackthebay-2025/talk/XEVY8W/feedback/ MAIN TRACK Talk 2025-04-28T10:45:00-07:00 10:45 00:45 Unveil how attackers exploit overlooked vulnerabilities with one of the creators of Pegasus. This talk dives into real-world attack chains, runtime analysis, and adversarial intelligence, arming you with advanced techniques to expose and mitigate threats in cloud-native and distributed systems. This presentation explores Adversarial Intelligence - an approach that views application security from an attacker’s perspective. Drawing from vulnerability research experience at the NSO Group and building Pegasus, the speaker will highlight how overlooked low and medium vulnerabilities can be combined to execute successful attacks. By examining attack chains and application runtime behavior, attendees will see how gaps often missed by traditional methods are exposed. Attendees will learn about effective tools and techniques for detecting and mitigating these threats, especially in cloud-native and distributed systems. Designed for security practitioners and academics, this session provides a deeper understanding of defending against sophisticated attackers by adopting their mindset. hackthebay-2025-28-adversarial-intelligence-redefining-application-security-through-the-eyes-of-an-attacker TALK Aviv Mussinger en false https://cfp.pacifichackers.com/hackthebay-2025/talk/VHU3FS/ https://cfp.pacifichackers.com/hackthebay-2025/talk/VHU3FS/feedback/ MAIN TRACK Talk 2025-04-28T11:30:00-07:00 11:30 00:45 As scanning and reconnaissance grows more diverse - from public platforms like Shodan and Censys to hidden probing by botnets and bulletproof hosting services—security teams need better ways to understand who is on the other side of their network connections. This talk will show how network fingerprinting has developed over time, starting with tools like p0f and moving up to more advanced methods like JA4, JA4+, and MuonFP. We’ll discuss how these modern fingerprints can help analysts recognize the tools and infrastructure used by attackers—whether they are fast scanners, basic banner grabbers, or connections routed through VPNs and jump servers. You’ll learn how to use these fingerprints to strengthen your defenses, protect critical infrastructure, and reduce your visibility to public scanners. We will also explain how to fit fingerprinting into security team workflows, noting both what it can and cannot do. Attendees will leave with a practical understanding of modern fingerprinting techniques and a few examples they can apply in their daily work. hackthebay-2025-18-netsec-is-dead-modern-network-fingerprinting-for-real-world-defense TALK Vlad Iliushin en Network reconnaissance is often overshadowed by other threats, like phishing, yet it remains a critical first step in the kill chain. Because edge infrastructure is typically exposed around the clock, adversaries have a 24/7 opportunity to gather information and use it for initial exploitation. In this talk, we’ll trace the evolution of network fingerprinting, starting with traditional methods like p0f, which relied on passive TCP/IP signature analysis, and advancing to modern suits (JA4, JA4+, MuonFP). By walking through each generation of fingerprinting, I’ll show how visibility has expanded along with the trade-offs and limitations inherent in these methods. I’ll present real-world scenarios that highlight how to spot fast scanners indexing massive numbers of hosts, how to detect covert traffic routed via jump boxes and VPNs, and how to block lower-level banner-grabbers. We’ll also discuss how these fingerprints can be integrated into SOC workflows, from building prioritized alerts to automating responses in firewalls and IDS. Finally, we’ll wrap up with a practical checklist of tools, including Arkime and eBPF-based detection, as well as firewall rule approaches to immediately strengthen defenses. Attendees will leave with the knowledge and resources to apply modern fingerprinting for continuous monitoring, streamlined threat hunting, and reduced exposure to both mass and targeted network scans. false https://cfp.pacifichackers.com/hackthebay-2025/talk/RJBHD8/ https://cfp.pacifichackers.com/hackthebay-2025/talk/RJBHD8/feedback/ MAIN TRACK Talk 2025-04-28T12:15:00-07:00 12:15 00:45 In today's rapidly evolving threat landscape, organizations struggle not with a lack of security tools, but with effectively managing the complex web of knowledge required for robust security operations. This talk introduces SNARF (Security Knowledge Automation and Response Framework), an innovative approach to organizing, connecting, and maintaining security knowledge across the entire security lifecycle. We'll explore why traditional documentation methods fail security teams, how disconnected knowledge silos create dangerous blind spots, and why security is never a "set it and forget it" proposition. Learn how integrating threats, detections, testing procedures, response protocols, and automation into a unified, version-controlled ecosystem dramatically improves security posture while reducing analyst burnout. Discover practical strategies for implementing a living security knowledge repository that evolves with your organization and the threat landscape, turning your security documentation from a liability into a strategic asset. hackthebay-2025-27-beyond-detection-building-a-living-security-knowledge-ecosystem-with-snarf TALK John Owen en false https://cfp.pacifichackers.com/hackthebay-2025/talk/3ZM9CY/ https://cfp.pacifichackers.com/hackthebay-2025/talk/3ZM9CY/feedback/ MAIN TRACK Keynote 2025-04-28T13:00:00-07:00 13:00 00:30 KEYNOTE hackthebay-2025-37-keynote KEYNOTE Jake Williams (aka MalwareJake) en KEYNOTE false https://cfp.pacifichackers.com/hackthebay-2025/talk/QNZ3XY/ https://cfp.pacifichackers.com/hackthebay-2025/talk/QNZ3XY/feedback/ MAIN TRACK Lightning Talk 2025-04-28T13:30:00-07:00 13:30 00:30 Security is tasked with understanding all threat vectors and uses a wide range of tooling to do so (endpoint, identities, and networks). But different tools performing different functions create silos and in between those disjointed siloes lie risks. Risks that can be mitigated by a single view across all assets across all systems. This session seeks to explore a unification of assets to minimize attack exposure. hackthebay-2025-34-breaking-down-silos-unify-assets-minimize-attack-exposure TALK Lucas Zaichkowsky en false https://cfp.pacifichackers.com/hackthebay-2025/talk/HVWUVF/ https://cfp.pacifichackers.com/hackthebay-2025/talk/HVWUVF/feedback/ MAIN TRACK Talk 2025-04-28T14:00:00-07:00 14:00 00:45 Secure static code analysis with AI and patterns. hackthebay-2025-30-sast-ai TALK /media/hackthebay-2025/submissions/SC9GX8/Screenshot_2025-03-31_at_4.51.26PM.jpeg_p2BW4oo.png Bogdan Barchuk en Will discuss deeply what is SAST is. (Static Application Security Testing) and how using AI and pattern matching find source code vulnerabilities. false https://cfp.pacifichackers.com/hackthebay-2025/talk/SC9GX8/ https://cfp.pacifichackers.com/hackthebay-2025/talk/SC9GX8/feedback/ MAIN TRACK Talk 2025-04-28T14:45:00-07:00 14:45 00:45 This talk will cover key exploitation techniques for RESTful, SOAP, GraphQL, and gRPC APIs, based on the OWASP API Security Top 10. It will include practical demonstrations of vulnerabilities like injection flaws, broken authentication, and data exposure using tools like Burp Suite and custom scripts. The session will also highlight the Open-Sec framework for structured API penetration testing. hackthebay-2025-22-exploitation-techniques-in-apis-restful-soap-graphql-and-grpc- TALK /media/hackthebay-2025/submissions/LYFTBR/APi-hck_s2TFvY9.png Toshiro Nagata Bolivar en This talk will explore key attack and exploitation techniques for RESTful, SOAP, GraphQL, and gRPC APIs, based on the OWASP API Security Top 10 framework. We'll cover practical methods to identify and exploit vulnerabilities such as injection flaws, broken authentication, and data exposure. The focus will be on real-world attack scenarios using tools like Burp Suite and custom scripts. We'll dive into specific vulnerabilities for each API type: manipulating RESTful tokens, exploiting GraphQL query injection, compromising gRPC protobuf-based requests, and executing XML external entity (XXE) attacks on SOAP. The session will provide step-by-step demonstrations of these techniques, highlighting how to chain them for maximum impact. Finally, we'll discuss the Open-Sec framework and how to apply it to API penetration testing. This structured approach—covering reconnaissance, scanning, testing, and analysis—will help identify and exploit complex vulnerabilities, offering actionable insights to improve API security. false https://cfp.pacifichackers.com/hackthebay-2025/talk/LYFTBR/ https://cfp.pacifichackers.com/hackthebay-2025/talk/LYFTBR/feedback/ MAIN TRACK Lightning Talk 2025-04-28T15:30:00-07:00 15:30 00:30 This presentation introduces LogLMs, transformer-based foundation models specifically pre-trained on log sequences. LogLMs understand the 'language' of logs, enabling it to identify anomalies and deviations from normal behavior across diverse protocols and usage patterns. Unlike rules-based systems, LogLMs adapt to changing environments through active learning and federated fine-tuning. This approach provides holistic security, including anomaly detection, threat hunting, real-time alerts, compliance, and forensics. We will see how a LogLM, deployed as TEMPO, detects novel attacks, and empowers forensic analysis. hackthebay-2025-45-rules-writers-and-threat-hunters-in-the-age-of-ai TALK Eric Zietlow en To Be Determined false https://cfp.pacifichackers.com/hackthebay-2025/talk/9NBABQ/ https://cfp.pacifichackers.com/hackthebay-2025/talk/9NBABQ/feedback/ MAIN TRACK Talk 2025-04-28T16:00:00-07:00 16:00 00:45 Static analysis is crucial but limited in detecting vulnerabilities tied to dynamic data and runtime behavior. This session introduces symbolic execution to extend SAST’s capabilities, showcasing how symbolic execution improves vulnerability detection through symbolic execution, illustrated with real-world examples and demonstrations. hackthebay-2025-12-beyond-sast-advancing-vulnerability-detection-with-symbolic-execution TALK Ulrich LangJason Kramer en Static Application Security Testing (SAST) is a vital tool for securing software, but its limitations, such as difficulty handling complex inputs, runtime behaviors, and dynamic data, can lead to missed vulnerabilities and false positives. This session explores these challenges and introduces symbolic execution, enhanced with artificial intelligence, as a game-changing solution. Symbolic execution goes beyond traditional static analysis by simulating all possible execution paths of a program, abstracting inputs symbolically to uncover hidden vulnerabilities like race conditions, memory safety violations, and edge case errors. We’ll also discuss the limitations of symbolic execution, such as path explosion, and strategies to mitigate them. false https://cfp.pacifichackers.com/hackthebay-2025/talk/J9FZJB/ https://cfp.pacifichackers.com/hackthebay-2025/talk/J9FZJB/feedback/ MAIN TRACK Lightning Talk 2025-04-28T16:45:00-07:00 16:45 00:30 Security within games is a popular yet somehow underserved topic. Video games offer various challenges for curious engineers to explore, including reverse engineering, anti-cheat systems, modding, DRM, etc. This talk aims to make these topics and discussions accessible to all levels of technical experience, both within and outside the gaming industry. We'll also examine the game we specifically created for the GameHacking.GG CTF was held at DEFCON32 last year. You can download and play the game we will be discussing from the website before attending this talk at: gamehacking.gg. Julian is leading the Game Hacking Village at DEFCON 33 this year and is looking for interested volunteers! hackthebay-2025-33-gamehacking-101 TALK /media/hackthebay-2025/submissions/VVD73L/Screenshot_2025-04-01_173941_jiLYKsu.png Julian Dunning en false https://cfp.pacifichackers.com/hackthebay-2025/talk/VVD73L/ https://cfp.pacifichackers.com/hackthebay-2025/talk/VVD73L/feedback/ MAIN TRACK Keynote 2025-04-28T17:15:00-07:00 17:15 00:30 CLOSING KEYNOTE hackthebay-2025-42-keynote KEYNOTE Sunil Gottumukkala en CLOSING KEYNOTE false https://cfp.pacifichackers.com/hackthebay-2025/talk/QLZMKV/ https://cfp.pacifichackers.com/hackthebay-2025/talk/QLZMKV/feedback/ MAIN TRACK Lightning Talk 2025-04-28T17:45:00-07:00 17:45 00:20 CLOSING CEREMONY hackthebay-2025-38-closing-ceremony CLOSING CEREMONY en CLOSING CEREMONY false https://cfp.pacifichackers.com/hackthebay-2025/talk/M78KTL/ https://cfp.pacifichackers.com/hackthebay-2025/talk/M78KTL/feedback/ TRACK 2 Workshop 2025-04-28T10:00:00-07:00 10:00 02:00 Attacking AI is a one of a kind session releasing case studies, tactics, and methodology from Arcanum’s AI assessments in 2024 and 2025. hackthebay-2025-19-attacking-ai WORKSHOP /media/hackthebay-2025/submissions/SH8SWT/Talk_Attacking_AI_1_WMefnA6.png Jason Haddix en While most AI assessment material focuses on academic AI red team content, “Attacking AI” is focused on the task of assessing AI enabled systems. Join Jason as he discusses his seven point methodology to assessing these systems and releases Arcanum’s prompt injection taxonomy and other resources for aspiring testers. false https://cfp.pacifichackers.com/hackthebay-2025/talk/SH8SWT/ https://cfp.pacifichackers.com/hackthebay-2025/talk/SH8SWT/feedback/ TRACK 2 Talk 2025-04-28T12:00:00-07:00 12:00 00:45 Practical demonstration of how the attackers can use misconfigurations across major cloud platforms, including AWS, Azure, GCP and OCI. Attendees will gain invaluable insights into the multifaceted challenges posed by misconfigurations within these cloud environments. Leveraging the power of graph-mode visualization, we will dissect and map potential attack paths arising from misconfigurations, providing a visual narrative of the complex relationships at play using open-source tools through the neo4j/memgraph database to explain some possible attacks. The heart of the discussion will revolve around practical mitigation approaches tailored to each cloud platform, ensuring a holistic defense strategy using open-source tools and free tools to help organizations increase their security posture. Real-world examples and case studies will illustrate the impact of misconfigurations and how a proactive approach, guided by graph-mode visualization, can significantly enhance security. By the end of the presentation, participants will be well-equipped to navigate the nuanced landscape of misconfigurations in AWS, Azure, GCP and OCI. This knowledge will empower cloud security professionals to implement effective mitigation strategies, fortifying their cloud environments against evolving cyber threats across diverse platforms. Attendees will gain invaluable insights into the multifaceted challenges posed by misconfigurations within these cloud environments. Leveraging the power of graph-mode visualization, we will dissect and map potential attack paths arising from misconfigurations, providing a visual narrative of the complex relationships at play. hackthebay-2025-2-vulnerability-exploitation-in-the-cloud-a-cross-platform-graph-based-attack TALK Filipi Pires en During this talk I intended to cover this: - Welcome - - What is HVT - - Difference between Attack Vector and Attack Path - - What is Chock Point - AWS IAM - - AWS Attacks ( Explanation and Demo) - - Attack Methods - CreatePolicyVersion - Attaching Attack - Conclusions false https://cfp.pacifichackers.com/hackthebay-2025/talk/WAUNKX/ https://cfp.pacifichackers.com/hackthebay-2025/talk/WAUNKX/feedback/ TRACK 2 Lightning Talk 2025-04-28T12:45:00-07:00 12:45 00:30 In this session, we will explore the different layers of security that can be applied or verified to enhance your security posture toward Kubernetes and containers. We will cover everything from the supply chain to production. hackthebay-2025-43-layered-security-for-kubernetes TALK Brian Six en Security for Kubernetes false https://cfp.pacifichackers.com/hackthebay-2025/talk/BGTZW8/ https://cfp.pacifichackers.com/hackthebay-2025/talk/BGTZW8/feedback/ TRACK 2 Workshop 2025-04-28T13:15:00-07:00 13:15 02:00 Come bring both your blue team and red team hats to interactively participate in attack scenarios. Vote with your colleagues on the best approach the security team should take when presented with a potential security incident, and what the threat actor should do when encountering response activity. Join your peers as you test your incident response and attack strategies in a gamified lively discourse. hackthebay-2025-44-tabletop-war-gaming WORKSHOP Mike LombardiErik Barzdukas en Tabletop War Gaming brought to you by Google - Mandiant false https://cfp.pacifichackers.com/hackthebay-2025/talk/RXUVVC/ https://cfp.pacifichackers.com/hackthebay-2025/talk/RXUVVC/feedback/ TRACK 2 Lightning Talk 2025-04-28T15:15:00-07:00 15:15 00:30 In the fast-paced world of cybersecurity, bringing context to new vulnerabilities quickly is more important than ever. As a Threat Researcher at Datadog, I've been involved in developing an approach to deploying honeypots using CI/CD pipelines. This method allows us to rapidly set up honeypots in real-world environments, tailored specifically to the technologies our customers use. hackthebay-2025-4-devops-and-threat-research-walk-into-a-bar- TALK Andy GironArthi Nagarajan en In my presentation, I'll discuss how we've integrated CI/CD pipelines to automate the deployment of both low and high-interaction honeypots. By tailoring these honeypots to mirror our customers' technology stacks, we've been able to gather more relevant threat data. I'll explain how we've used HASH (https://github.com/DataDog/HASH) to quickly deploy low-interaction honeypots and delve into how container technology allows us to deploy high-interaction honeypots capable of running any technology stack. Additionally, I'll highlight how the data we collect enhances our understanding of threats and enriches our customers' logs with valuable security insights. Our approach stands out because it combines DevOps methodologies with cybersecurity practices to create a dynamic and responsive honeypot deployment system. By integrating CI/CD pipelines, we're able to respond rapidly to emerging threats, deploying honeypots in real-time as new vulnerabilities surface. We customize these honeypots to reflect our customers' actual environments, making the data we collect more relevant. This integration also streamlines the entire process from deployment to data analysis, reducing manual effort and minimizing potential errors. I'll share recent case studies to illustrate the effectiveness of our approach. For example, I'll talk about how we quickly deployed honeypots to capture exploit attempts on a newly discovered Confluence vulnerabilities, Docker API exploitation, Log4J, and Redis exploitation. I'll also discuss how our high-interaction honeypots allowed us to monitor attackers' behavior after they gained initial access. Additionally, I'll highlight instances where the intelligence we gathered significantly improved our customers' ability to detect and respond to threats. These real-world examples will demonstrate the impact of our methods. true https://cfp.pacifichackers.com/hackthebay-2025/talk/LXBZF8/ https://cfp.pacifichackers.com/hackthebay-2025/talk/LXBZF8/feedback/ TRACK 2 Workshop 2025-04-28T15:45:00-07:00 15:45 02:00 Critical infrastructure like water treatment plants and air traffic control towers are under constant attack by hostile nations, and securing them is a national priority. This workshop covers industrial automation systems, network security monitoring, and incident response. Participants will perform many hands-on projects configuring systems, attacking them, and defending them. hackthebay-2025-5-securing-critical-infrastructure WORKSHOP Sam Bowne en The workshop is structured as a CTF competition. There will be demonstrations of the techniques, and help on the challenges will be available. We will use Modbus and DNP networks, as well as normal IP-based networks. Software used includes OpenPLC, FactoryIO, Splunk, Velociraptor, and Zeek. Participants need a laptop capable of running virtual machines, or a few dollars to rent cloud servers. All class materials are freely available on the Web and may be easily used in other classes. false https://cfp.pacifichackers.com/hackthebay-2025/talk/UYWEQQ/ https://cfp.pacifichackers.com/hackthebay-2025/talk/UYWEQQ/feedback/ SOLDERING VILLAGE Village 2025-04-28T10:00:00-07:00 10:00 07:00 Do you want to learn how to solder? Are you afraid of thinking you are going to burn yourself? Don't be scared, we've got your back. Famous and renowned badge Maker Abhinav (Panda) Pandagale will teach you the basics of soldering. You are going to have a chance to solder a badge. hackthebay-2025-47-soldering-village WORKSHOP Abhinav Pandagale en false https://cfp.pacifichackers.com/hackthebay-2025/talk/JZAJRB/ https://cfp.pacifichackers.com/hackthebay-2025/talk/JZAJRB/feedback/