Säkerhetspodcasten #243 - SecurityFest 2023

Lyssna

• mp3, längd: 48:27

Innehåll

I dagens avsnitt går vi igenom årets SecurityFest.

How to f*ck up at OAuth2 while following BCPs -Tobias Ahnoff, Pontus Hanssen

• How to f*ck up at OAuth2 while following BCPs -Tobias Ahnoff, Pontus Hanssen
  • https://oauth.net/2.1/
  • https://openid.net/wg/fapi/
  • Best Current Practice’s vi ordar om i poddens:
    • IETF Draft: OAuth 2.0 for Browser-Based Apps
    • IETF Draft: OAuth 2.0 Security Best Current Practice

Keynote: Red Notice - Pros And Cons - Alethe Denis

• Keynote: Red Notice - Pros And Cons - Alethe Denis

The C2 tool no one talks about: AWS SSM - Run Command - Eduard Agavriloae

• The C2 tool no one talks about: AWS SSM - Run Command - Eduard Agavriloae

Bypassing Anti-Cheats & Hacking Competitive Games - Rohan Aggarwal

• Bypassing Anti-Cheats & Hacking Competitive Games - Rohan Aggarwal

OopsSec - The bad, the worst and the ugly of APT’s operations security - Tomer Bar

• OopsSec - The bad, the worst and the ugly of APT’s operations security- Tomer Bar

SQLi to Root Access: Exploiting a ISP infrastructure - Ignacio Navarro

• SQLi to Root Access: Exploiting a ISP infrastructure - Ignacio Navarro

When the Red Team Goes Passwordless - Hasain Alshakarti

• When the Red Team Goes Passwordless - Hasain Alshakarti

Lightning talk: Badge challenge - Abhinav Pandagale

• Lightning talk: Badge challenge - Abhinav Pandagale

Architecting for security: the old ways - Dan Tentler

• Architecting for security: the old ways - Dan Tentler

How to: Hack the company, before someone else does it for you - STÖK

• How to: Hack the company, before someone else does it for you - STÖK

Tales from the %TEMP% - Jonas Vestberg

• Tales from the %TEMP% - Jonas Vestberg

Beyond On-Premises: Exploring the Post-Domain Admin Landscape in the Cloud - Natarajan, Kumar

• Beyond On-Premises: Exploring the Post-Domain Admin Landscape in the Cloud - Natarajan, Kumar

Aikido: Turning EDRs to malicious wipers using 0-day exploits - Or Yair

• Aikido: Turning EDRs to malicious wipers using 0-day exploits - Or Yair