Speakers

• 

  Google VRP BugHunting

  Martin Straka

  Martin will cover the Google VRP programs, some interesting facts and new things added this year to our VRP programs and also the best bugs Google received from our researchers community in the last year.

  Register
• 

  Hacking the 0day Market

  Andrea

  The 0day vulnerability market developed over the years in a way that is unsafe, chaotic and rather inefficient. Bad business practices, lack of professionalism and low levels of trust are still spread in this market even today and can seriously hamper the ability of law enforcement and intelligence agencies to acquire and maintain strategic cyber capabilities in order to fight organized crime, terrorism and hostile geopolitical actors. Having a deep understanding of these issues and of their solutions, Crowdfense is “hacking the 0day market” in order to improve it for all the parties involved (researchers, customers, brokers, integrators and end users), by introducing new quality standards and best practices related to products, services and to the sustainability of the underlying business processes. This session will share how Crowdfense is doing this, why, what are the results, some statistics about the 0day market and what could be the next steps.

  Register
• 

  Exploiting Server-Side Applications

  Nimisha Dugalya

  The workshop is hands-on white-box testing of a php-based application. Most of the server-side web applications are made up of Php, this workshop will introduce the attendees to some common vulnerabilities in php applications. This session will be a ctf based session where the related challenges will be hosted and the participants who are well ahead of the basic topics can solve them while others catch up. Topics that will be covered in this session are - common php coding mistakes, code reviewing for loopholes, server-side request forgery, deserialization vulnerability. After the session participants will have a clear understanding of how to analyze a web application for php bugs.

  Register
• 

  Fuzzing softwares for Bugs

  Amol Naik

  This workshop focuses on the fuzzing softwares for bugs which will cover various techniques, tools & analysis techniques starting from file fuzzers till browser fuzzing.

  Register
• 

  Kubernetes - Overview and Exploitation

  Shikhar Joshi

  What to expect in the session: Overview of Docker (demo): - Creating a docker image user dockerfile - Uploading the docker image to docker hub - Creating a container from the image - Getting a shell within the container - Linux namespace Overview of kubernetes architecture (theory/demo if time persists) - API Server - etcd - Controller - Scheduler - Kubelet - Nodes Creation of kubernetes resources (demo) - pods - namespaces - replication controllers/sets - services - roles Exploiting kubernetes cluster (demo) - Understanding authentication and authorisation in kubernetes cluster - Understanding kubernetes secrets - Exploiting the cluster via misconfigured RBAC - Exploiting the cluster via exposed resources

  Register
• 

  Decoding Multiple Vulnerabilities on Pulse Secure VPN?

  Dhamotharan

  Pre-authentication arbitrary file read vulnerability (CVE-2019-11510) that revealed sensitive information like VPN client credentials, private SSH keys, and session cookies. They showed how this information was used to compromise a client session and gain access to a VPN network, then demonstrated additional post-authentication exploits that resulted in complete takeover of the VPN server. In order to exploit the issue, an attacker can send a malicious HTTP request containing directory traversal sequences along with a crafted Uniform Resource Identifier (URI) and access any file on the device.

  Register
• 

  Crypto for Bounty Hunters

  Shrutirupa Banerjiee

  Bug bounty is one of the common platform for security researchers to learn and earn more. There are researchers out there who sometimes miss certain domains and cryptography is one such domain which should never be forgotten. The session will talk about the basics of cryptography that a bug bounty hunter has to focus on to find cryptography related flaws. The audience will learn about how a simple cryptography flaw, once ignored, can be manipulated into a vulnerability. The audience will also get to know some common cryptography based exploits to achieve bounties. Meanwhile, the audience will also learn about different vulnerabilities and their exploitations with the help of some exercises that will be provided to them along with the explanation of each vulnerability. Some of the vulnerabilities which will be covered are: JWT misconfigurations openssl based flaws Oracle Padding cbc-ecb mode weak ssl ciphers Heartbleed and many more... The targeted audience is someone who has some basic knowledge in web application security along with having some enthusiasm to learn something different.

  Register
• 

  Mobexler: AIO Mobile Pentest VM

  Narendra

  Ever wished to have a virtual machine with tools for security testing of Android as well as iOS applications. Well, Mobexler is a mobile pentest VM that includes a wide variety of tools to help in Android and iOS pentesting. It includes tools for both static and dynamic analysis of applications, allowing pentesters to use a single virtual machine setup and perform pentest of Android and iOS applications, both. Based on elementary OS, Mobexler provides an awesome UI experience and allows for intuitive usage of tools just like you would on a host install. External devices like iPhone/iPad/Android devices can also be connected via USB or over TCP and can be used to perform security testing on applications. more details http://mobexler.com/

  Register