PasswordsCon·43 min
Jeff Deifik
Walks through cracking hundreds of millions of leaked NTLM password hashes using CPU rigs, custom rules and curated wordlists.
attacktoolpassword-cracking+2
PasswordsCon BSidesLV 2025
Las Vegas, USA · August 2025 · 15 talks
PasswordsCon talks from BSides Las Vegas 2025.
Filters+
1–15 of 15 talks
PasswordsCon·31 min
Or Eshed
Examines unmanaged SaaS accounts outside corporate identity providers and how weak, reused passwords expose organizations.
identityriskthreat+2
PasswordsCon·43 min
Or Eshed
Explains how malicious browser extensions access cookies and passwords, and what defenders can do about it.
attackidentityweb+2
PasswordsCon·46 min
Shows how threat intelligence sources overlap, lag and conflict, and what that means for defenders who rely on them.
intelligencethreatopen-source+2
PasswordsCon·41 min
Dwayne McDaniel
Argues that hardcoded, long-lived credentials make non-human identities a major breach risk and outlines practical fixes.
identitycloudkubernetes+2
PasswordsCon·24 min
Dave Lewis
Argues that defenders should treat breaches as lessons, using anecdotes on shadow IT, default credentials and incident planning.
riskincident-responselessons-learned+2
PasswordsCon·55 min
Filipi Pires
Shows how one overly broad cloud permission can let an attacker escalate privileges across an entire organization.
cloudidentityattack+2
PasswordsCon·48 min
Mat Saulnier
Shows how cracking your own Active Directory password hashes can turn compliance rules into a measurable control.
identitywindowsdefensive-security+2
PasswordsCon·22 min
Dimitri Fousekis
Shows cracked-password data from real organizations that undercuts forced password rotation and suggests risk-based alternatives.
password-policyidentityrisk+2
PasswordsCon·19 min
Gautier Bugeon
Shows how a decoy login portal can expose attackers reusing stolen credentials so defenders can reset them early.
phishingthreat-detectionidentity+2
PasswordsCon·17 min
Dustin Heywood
Shows how F5 load balancers protect stored service account passwords and how those values can be recovered after a compromise.
reverse-engineeringnetworkinfrastructure+2
PasswordsCon·39 min
John-André Bjørkhaug
Follows a red team engagement that clones access cards and reaches a server room guarding a national power grid.
attackinfrastructureics+2
PasswordsCon·39 min
Marluan "Izzny" Cleary
Shows how HMAC misuse, weak keys, replay gaps and timing leaks can break authentication in systems that look secure.
appsecvulnerabilitiesweb+3
PasswordsCon·21 min
Travis Moore
Explains how botnets generate high-entropy synthetic passwords to flood logins and evade breach-based detection.
attackthreat-detectionidentity+2
PasswordsCon·46 min
Dwayne McDaniel
Explains how non-human identities and hardcoded secrets create risk, and how to raise the issue with developers.
identityriskcode+3