Ground Floor·24 min
Lenin Alevski
Walks through a command injection flaw in an open-source automation UI, from code review to exploitation and mitigation.
vulnerability-researchappsecopen-source+2
Ground Floor BSidesLV 2024
Las Vegas, USA · August 2024 · 16 talks
Ground Floor talks from BSides Las Vegas 2024.
1–16 of 16 talks
Ground Floor·26 min
Roy Sherman · Adi
Compares how attackers and defenders approach cloud environments, where identity and API access replace traditional breach paths.
cloudattackthreat+3
Ground Floor·37 min
John Evans
Shows how HR data and identity provider rules can automate employee access grants and revocations with low-code workflows.
identityautomationlessons-learned+1
Ground Floor·44 min
Shows how to build custom detections for GitHub Enterprise, demystifying the detection engineering process.
detectiondefensive-securitybuilding+1
Ground Floor·22 min
Glenn Thorpe
Analyzes CISA's Known Exploited Vulnerabilities catalog to reveal trends that help rank competing vulnerabilities for remediation.
intelligencevulnerabilitiesthreat+2
Ground Floor·27 min
Ignacio Navarro
Shows how a cashless arcade payment system exposed customer data, free credit and card cloning through web, API and NFC flaws.
webvulnerabilitiesapplication+2
Ground Floor·52 min
Odd Job
Shows how to draft an incident response plan covering people, process and technology before a breach hits.
incident-responsemanagementrisk+2
Ground Floor·39 min
Blake Hudson
Shows how CI/CD pipeline misconfigurations in GitHub Actions can expose cloud secrets and grant administrative access to AWS.
clouddevopsidentity+2
Ground Floor·22 min
Amit Srour
Shows how to find undocumented and forgotten API endpoints and reconcile them with API specifications.
appsecwebvulnerabilities+2
Ground Floor·54 min
George Polivka · arv
Walks through building a Terraform-deployed Azure C2 platform with overlay VPN, redirectors, and reporting services.
infrastructurecloudopen-source+2
Ground Floor·24 min
Josh Kamdjou
Shows how generative AI lets attackers build convincing, fabricated email threads for phishing campaigns at scale.
phishingaithreat+2
Ground Floor·42 min
Angel Gamboa
Shows how one tester can build their own physical entry tools from everyday retail and craft materials.
tooldevicebuilding+2
Ground Floor·56 min
Mauro Eldritch · Cybelle Olivera
Surveys ransomware operations that never gained notoriety, from copied builders to rebranded crews and failed extortion schemes.
ransomwarethreatintelligence+1
Ground Floor·16 min
Sing Ambikapathi
Shares practical ways for security teams to build trust, reduce friction and collaborate with software developers.
lessons-learneddevelopmentteam+2
Ground Floor·23 min
Will Vandevanter
Shows how to build a large WHOIS dataset to find a company's domains and get alerted when new ones appear.
reconintelligenceinfrastructure+2
Ground Floor·32 min
Fabricio Gimenes
Shows red team bypasses of PowerShell constrained language mode and shellcode hidden in a Windows event log for persistence.
windowsexploitationattack+2