BSides London 2021
| title | author | length |
|---|---|---|
| Big Data Lake, Big Data Leak | Ben Caller | 16m |
Finds internet-exposed EMR master interfaces (Zeppelin, Livy, ResourceManager) that accept job submissions and allow remote code execution; uses the… | ||
| Tokyo Takedown Reviewed: A International Tour To Japan | Ben Ellis | 13m |
Japan sees frequent late disclosure of breaches driven by losing face and a shrinking IT workforce caused by an aging population, forcing reliance on foreign… | ||
| Making Big Datasets Searchable | Calum Boal | 15m |
A fast API indexes Rapid7 Project Sonar DNS data so large lookups become file seeks not full-text queries: 183 GB / 1.8B records are parsed with a suffix-array… | ||
| When Encryption Fails | Eva Summerfield | 14m |
Argues that weaknesses come from lifecycle and links not just algorithms, splitting cryptography into the math layer (textbook RSA, elliptic-curve choices for… | ||
| Getting Started With CTF’s | Jeff Moye | 21m |
A practical how-to shows free CTF platforms (Hack The Box, TryHackMe, HackerOne01, SANS Holiday Hack) and walks a solved puzzle: a SANS 2018 terminal challenge… | ||
| The Challenges Of Remediation During A Cyber Incident | Johanna Strachan | 14m |
Argues remediation is an umbrella process distinct from eradication, warns organizations should expect remediation to cost roughly as much as investigation… | ||
| Introduction To Red Team Tooling And Opsec | Marwan El-Gendi | 12m |
Red team builds repeatable infrastructure with terraform and ansible, uses Cobalt Strike as C2 and guardrails to avoid accidental runs, then exploits a local… | ||
| Chaos Engineering: Break It On Purpose | Morgan Carter | 18m |
Defines chaos engineering as running controlled failures (often in production) to prove resilience, citing Netflix Simian Army and tools like Chaos… | ||
| X-Com - Editing Save Game Files Is Still Strategy | Paul Williams | 16m |
Hex-editing X‑Com: Terror from the Deep save files changes actual game state: edit libglub.dat to set 285 million dollars, patch base.dat (eight bases, 296… | ||
| JWTs And Why They Suck | Rory M | 15m |
JWTs often break guarantees developers expect: they are stateless = unrevokeable so compromised sessions cannot be revoked without server-side tracking, short… | ||
| Think Zero Days Are Your Your Biggest Risk - Think Again | Ciara Campbell | 15m |
A CISA/FBI/NCSC/Australian joint advisory claims routinely exploited, publicly known vulnerabilities far outnumber zero-days, urging rapid remediation; the… | ||
| OS Fingerprinting From Scratch (Or) Offensive Scapy | Harry Williams | 17m |
Passive OS fingerprinting that extracts the DHCP option 55 parameter request list with Scapy, maps the requesting MAC to an IP via ARP, and matches the integer… | ||
| DFIR - Don't Forget Your Roots! | Sabastian Hague | 14m |
Shares concrete repeatable work: built a Cobalt Strike lab and a post‑exploit server to learn real C2 behaviors; spins up a webserver plus a misconfigured REST… | ||
| MITRE D3FEND | James Gibbins | 13m |
MITRE D3FEND is a beta defender framework that maps over 232 artifacts to more than 100 countermeasures and links to MITRE ATT&CK techniques (example… | ||
| MITRE D3FEND | James Gibbins | 13m |
MITRE D3FEND is a defender-focused complement to ATT&CK, currently beta v0.9, mapping over 100 countermeasures across five tactics and linking them to 232… | ||
| nothing matches | ||