Speakers at Security Fest 2023

These were the speakers at Security Fest 2023.
Thanks for helping us make this conference awesome!

Keynote

Alethe Denis will be presenting at Security Fest 2023!

Architecting for security: the old ways

It's incredibly easy to put systems online. Between EC2, Digital Ocean, Rackspace, Oracle, IBM, GCP, Hetzner and various others, anybody can spin up a free virtual machine. There's stuff like lambda and heroku which is are disembodied python...

Eduard Agavriloae

The C2 tool no one talks about: AWS SSM - Run Command

Let's take a deep dive into how AWS Systems Manager (SSM) - Run Command can be used offensively and how stealthy we can be.

Fredrik "STÖK" Alexandersson

How to: Hack the company, before someone else does it for you.

It doesn't matter if you are a Pentester, Bughunter, Defender, Sysadmin or just plain curious. If you aren't trying to breach the company's systems, someone else on the internet is going to try and do it for you (without approval). In this...

Hasain Alshakarti

When the Red Team Goes Passwordless

Modern IT environments offer passwordless authentication to improve security and improves user experience. Certificate and key-based authentication does not only makes the user's life easier, it also gives the offensive side an excellent opportunity to...

Ignacio Navarro

SQLi to Root Access: Exploiting a ISP infrastructure

What if we play with the ISP? In this talk I am going to tell you how one day, something that started as a simple SQL injection, going through LFI, RCE, ended up in a pwn of an internet provider in my country that affected more than 25 cities, being...

Jonas Vestberg

Tales from the %TEMP%

The C:\Windows\Temp directory may seem like a safe place to store temporary data, but it has a few quirks that not all developers are aware of. For code running with high privileges, like Windows services, it becomes an attack surface. For attackers it...

Or Yair

Aikido: Turning EDRs to malicious wipers using 0-day exploits

Wipers are becoming the go-to tool for nation-state cyber warfare in the last decade since the Shamoon attack. Wipers have been used by Russia, Iran, North Korea, and other APTs to support offensive acts. One of the most famous recent attacks was...

Pontus Hanssen

How to f*ck up at OAuth2 while following BCPs

Best current practices (BCPs) for implementing OAuth2 and OIDC have undergone many changes over the years. In this presentation we highlight the risks of staying with the ancient (roughly 2019-2021) “current” best practices. The current (circa...

Rohan Aggarwal

Bypassing Anti-Cheats & Hacking Competitive Games

With the increasing popularity of games having a competitive element, cheats have become a common method for hackers to gain an advantage. These cheats could range from a sniper bullet that felt just a little too accurate to a player teleporting across...

Sriraam Natarajan

Beyond On-Premises: Exploring the Post-Domain Admin Landscape in the Cloud

Organizations are increasingly relying on cloud services from Azure, as there is native support from Microsoft. After obtaining Domain Admin privileges, it is essential to always think of attack paths or scenarios to escalate our privileges or describe...

Tobias Ahnoff

How to f*ck up at OAuth2 while following BCPs

Tomer Bar

OopsSec - The bad, the worst and the ugly of APT’s operations security

Advanced Persistent Threat groups invest in developing their arsenal of exploits and malware to stay below the radar of their victims' security controls and persist on the target machines for as long as possible. We were curious if the same efforts...

Venkatraman Kumar

Beyond On-Premises: Exploring the Post-Domain Admin Landscape in the Cloud

See all speakers at Security Fest

SUBSCRIBE TO OUR NEWSLETTER

Get all relevant information and news regarding Security Fest, when we release recordings of talks, etc.

Get newsletter →