DerpCon
DerpCon
  • Видео 23
  • Просмотров 34 465
Entrepreneurial Adventures: Starting Your Own Company - Bryson Bort
DERPCON 2020 Tales from the Trenches
So you’re not crazy, you just want to start your own company. Which kinda takes a level of crazy to pull it off. We’ll talk through what it takes to be an entrepreneur, different kinds of companies (service, product, non-profit), the market, back-office administration, pricing and economics, and my experiences starting three companies.
Просмотров: 339

Видео

Going Phishin' with GoPhish - Patrick Laverty
Просмотров 8 тыс.4 года назад
DERPCON 2020 Red Team Want to learn how to put together a phishing campaign? Great, let's do it. We will use the free and open-source tool GoPhish to launch campaigns. We'll show how to install, set up GoPhish, create each of the necessary pieces and launch. We'll also talk about pretexts and how "mean" should we be, and mix in some stories of phishing successes and failures.
Hypothesis-driven MacOS Threat Hunting - Plug
Просмотров 5004 года назад
DERPCON 2020 Blue Team MacOS is a popular operating system deployed across many organizations. Few commercial tools exist that provide proper event visibility in MacOS. Often, these tools are expensive and some lack important monitoring features. However, open-source offers a great selection of tools that can be deployed to kick start a MacOS Threat Hunting Program. In this talk, we will simpli...
The Truth About Passwords, Privacy & Breaches - Serge Borso
Просмотров 2064 года назад
DERPCON 2020 Tales from the Trenches The purpose of this session is to take a close look at user security on the web, explore common mistakes people make as it pertains to their privacy/ online security and learn about what adversaries are doing with compromised data. I'll talk about choices we all make which impact our own security, then discuss how breaches occur and what happens after a data...
Ham Hacks: Breaking into the World of Software Defined Radio - Kelly Albrink
Просмотров 5 тыс.4 года назад
DERPCON 2020 Red Team RF Signals are basically magic. They unlock our cars, power our phones, and transmit our memes. You’re probably familiar with Wifi and Bluetooth, but what happens when you encounter a more obscure radio protocol? If you’re a hacker who has always been too afraid of RF protocols to try getting into SDRs, or you have a HackRF collecting dust in your closet, this talk will sh...
Assumed Breach: The Better Pen Test - Tim Medin
Просмотров 5234 года назад
DERPCON 2020 Red Team Security teams should not operate under the assumption that a breach will happen, but when. The fresh twist on penetration testing puts an attacker (good guy/gal) on your systems running under the context of an authorized user. The goal is to simulate a compromised system or a rogue trusted insider. The goals of the test should be focused on the business risk and how insec...
Resource Smart Malware Detection with YARA & osquery - Julian Wayte
Просмотров 7774 года назад
DERPCON 2020 Blue Team Traditional filehash malware detection is relatively easy to circumvent as threat actors easily morph code to create "new" variants, rendering old IOC's useless. YARA, uses a different approach. Its rules match to small segments of code within the malware, making traditional morphing techniques ineffective. The challenge can be knowing which files to scan with YARA, as sc...
Dear Diary: Today I met my first APT - Brian Warehime
Просмотров 1464 года назад
DERPCON 2020 Blue Team Building out a threat intelligence program can be quite the task, and once built there are many logistical concerns that come into play. Things like "I hate JIRA, I'm never using that" comes up quite a bit, or "We can't possibly use Google and spreadsheets to track all this". Managing your requirements and research shouldn't be a pain point and definitely shouldn't preven...
.NET Roulette: Exploiting Insecure Deserialization in Telerik UI - Caleb Gross
Просмотров 17 тыс.4 года назад
DERPCON 2020 Red Team So you're pentesting a .NET application, and you notice the server is deserializing user input-great! You know this is bad in theory, but have no idea how to actually get a shell in time for the engagement. This talk will bring you up to speed on how .NET deserialization works and how to get shells on real applications. In this presentation, we'll dig into the internals of...
Reducing The Breach Detection Gap - Markus Hubbard
Просмотров 884 года назад
DERPCON 2020 Blue Team Methodologies on identifying signs of compromise incorporating e-mail schema, DNS, expanding web structures, robots.txt, honeyports, honeysql, honeypot accounts, honeypot workstations, canary documents, file modification alerts, etc.
Building Secure Systems using Security Chaos Engineering and Immunity - Yury Niño Roa
Просмотров 1324 года назад
Building Secure Systems using Security Chaos Engineering and Immunity - Yury Niño Roa
.NET & Python: Let's get weird with it - Marcello Salvati
Просмотров 3464 года назад
.NET & Python: Let's get weird with it - Marcello Salvati
Adversary Emulation - Jorge Orchilles
Просмотров 2684 года назад
Adversary Emulation - Jorge Orchilles
The Economics of Red Teaming: Makin’ a profit while droppin 0-day - David Wolpoff
Просмотров 1104 года назад
The Economics of Red Teaming: Makin’ a profit while droppin 0-day - David Wolpoff
A Day in the Life of a Pen Tester: What Pen Testing Really Looks Like - Chris Elgee
Просмотров 2254 года назад
A Day in the Life of a Pen Tester: What Pen Testing Really Looks Like - Chris Elgee
The Pentester Blueprint: A Guide to Becoming a Pentester - Phillip Wylie
Просмотров 2904 года назад
The Pentester Blueprint: A Guide to Becoming a Pentester - Phillip Wylie
The Offensive Defender | Cyberspace Trapping - Matt Toussain
Просмотров 1274 года назад
The Offensive Defender | Cyberspace Trapping - Matt Toussain
Anatomy of a Gopher - Binary Analysis of Go Binaries - Alex Useche
Просмотров 2564 года назад
Anatomy of a Gopher - Binary Analysis of Go Binaries - Alex Useche
Supply Chainsaw - Matt "scriptjunkie" Weeks
Просмотров 1154 года назад
DERPCON 2020 Red Team Supply chain attacks are a gold standard of exploitation. Malicious software coming through the same channels as legitimate software is not in your threat model since it is nearly impossible to defend against. But supply chain attacks are often assumed to be expensive, time-consuming, and personally risky; exclusively the domain of intelligence services or well-funded crim...
Where the real security work gets done and how to measure it - Dan DeCloss
Просмотров 574 года назад
DERPCON 2020 Tales from the Trenches Whether you're on a red team or a blue team; whether you have a deep technical skillset or are just getting started; whether you consult with key stakeholders or slog through the trenches; we all play an important role in getting the actual cybersecurity work done. As a person who has worn many hats throughout his career, this talk will highlight what we all...
Demystifying Capture The Flags (CTFs) - Barrett Darrnell
Просмотров 1834 года назад
DERPCON 2020 Tales from the Trenches Capture the Flag (CTF) competitions range in style and difficulty but each and every CTF offers a wealth of knowledge for any participant. In the talk: Demystifying CTFs, Barrett Darnell will provide an overview of CTF formats, the skills they require and the experience they develop, and conclude with a plethora of CTF resources for those wanting to particip...
Passive (Aggressive) DNS - Donald "Mac" McCarthy
Просмотров 944 года назад
DERPCON 2020 Blue Team This presentation focuses on using passiveDNS to augment existing tools and create new ones to increase SOC visibility and performance. Leveraging DNSTwist with passive DNS can help teams illuminate some TTPs of attackers using lookalike domains. Combining passiveDNS with a bit of python can reveal infrastructure which may have gone online without a proper security review...
A Hacker's Viewpoint: Planning The Attack - Kristina Krasnolobova & Robert George
Просмотров 1084 года назад
DERPCON 2020 Blue Team A lot of work has gone into breaking out the stages of an attack. Unfortunately, many security teams focus on the detection of infiltration, data loss, or response after an attack. This focus skips over a more proactive approach to preventing the attack during the planning stages. There is a plethora of information publicly available about a company and its employees that...

Комментарии

  • @Tridenux
    @Tridenux 23 дня назад

    how to make one

  • @bigbrotherstream1466
    @bigbrotherstream1466 2 года назад

    will this exploit be handy on uploading web shell too or not?thanks in advance

  • @Cygnus0lor
    @Cygnus0lor 2 года назад

    Beautiful talk and exploit. Thanks.

  • @seif9923
    @seif9923 2 года назад

    great video tbh, your channel is grossly underrated.

  • @huyvuquang2041
    @huyvuquang2041 3 года назад

    Thank you for a great vid

    • @vietbuiang5873
      @vietbuiang5873 3 года назад

      Bro hướng dẫn mình được k?

    • @huyvuquang2041
      @huyvuquang2041 3 года назад

      Ý là bro muốn reproduce case này hay sao?

    • @vietbuiang5873
      @vietbuiang5873 3 года назад

      @@huyvuquang2041 Được vậy thì tốt quá bro, mình đang học về cái này mà k biết hỏi ai ^^

    • @huyvuquang2041
      @huyvuquang2041 3 года назад

      @@vietbuiang5873 Tui cũng chưa bh reproduce case này, chỉ là hiểu thôi. Nếu ông cần thì tui và ông cùng làm thử cái này học luôn :))

    • @vietbuiang5873
      @vietbuiang5873 3 года назад

      @@huyvuquang2041 Tại tôi có bài tập về phần này ý, nên t cũng mới tìm hiểu thui :)) muốn bro chỉ giáo

  • @hamzaa2011
    @hamzaa2011 3 года назад

    AV block all aspx file any one have any bypass

  • @sob3ygrime
    @sob3ygrime 3 года назад

    Great start thanks Phillip

  • @sobeyyy
    @sobeyyy 3 года назад

    Great Video Thank you!

  • @PigSirotan
    @PigSirotan 3 года назад

    How about the PublicKeyToken? How do you generate it in the payload? Please advice, thank you~

  • @mikemaxwell906
    @mikemaxwell906 3 года назад

    43:16 What is the ".sig" file? I see no documentation of the .SIG format for use by osquery. I went through the Yara documentations and all files are end with ".yar". If ".sig" is file that imports Yara files, how is that done? It not explained very well. I love talk, very good info, just glosses over SIG without explaining HOW to create a ".sig" or show an example of one.

  • @m1geo
    @m1geo 3 года назад

    As a UK ham radio operator, I'm 101% sure that my licence does not permit me to man-in-the-middle cellular networks! 🤣🤣 Awesome talk, though! 73, de George M1GEO.

    • @daveys
      @daveys 2 года назад

      Agree

  • @williamaustin8374
    @williamaustin8374 3 года назад

    *When someone wants the latest hack, only use **erim.best/btsw-guidev30lW* They are the real deal when it comes to this! ଏସ୍ତଙ୍କସ୍ତଙ୍କହା ସମସ୍ତଙ୍କ ପାଇଁ ଉପଯୁକ୍ତ

  • @pamelaherrera7421
    @pamelaherrera7421 4 года назад

    I ran campaign, email sent, was opened and clicked. Landing page opened. Username and password was entered and clicked submit, but its still keeps asking to enter a password and does nothing.. Please help!

  • @xarmanli
    @xarmanli 4 года назад

    The following kb explains how to prevent the vulnerability www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization this video shows how to apply the recommended security settings - ruclips.net/video/J18zDKtiBFE/видео.html

  • @thetamage
    @thetamage 4 года назад

    I'm a dotnet developer using the Telerik ASP.Net AJAX controls. This is the best resource demonstrating this dangerous problem. Thank you for producing this!

  • @KonstantinSDR
    @KonstantinSDR 4 года назад

    Perfectly

  • @nworker
    @nworker 4 года назад

    Awesome presentation laying out the foundation of amateur radio and quickly pivots to the current state of the art in digital radio. Kelly you have done a great job of distilling down the fun of chasing radio signals and what they reveal in their singing vibrations.

  • @bharatshetty9560
    @bharatshetty9560 4 года назад

    Awesome presentation Kelly! This by far was one of the best presentations I have come across in a long time, I liked the intro which most people would have ignored, but it really matters to a newbie to understand better, thereafter as you scaled up in a gradual manner touching all the relevant topics in a incremental way, before coming to the main subject was really very well done. I am sure for those who are new to SDRs will find this presentation more than useful. I hope you will come up with many such interesting presentations on others topics too, Cheers and good luck. Well done 👏👏👏👏👏

  • @Tibbon
    @Tibbon 4 года назад

    This is one of the best radio talks I've found for newbies. So many talks just throw out a ton of jargon and expect that you know how to set the IQ on your AM while doing your QC, etc... This is amazing for showing the how and the why!

  • @AkaBigWurm77
    @AkaBigWurm77 4 года назад

    FYI A Pi can also transmit, not ideal but very possible