Track 3·44 min
Louis
Shows how JWT algorithm confusion lets attackers forge tokens, and how libraries can block it in code.
webappsecvulnerabilities+2
Track 3 CC13
Mesa, AZ, USA · February 2025 · 8 talks
Track 3 talks from CactusCon 13 2025.
1–8 of 8 talks
Track 3·47 min
Drew “Hoodoer” Gilbert
Demonstrates turning an XSS foothold into a JavaScript C2 platform that captures credentials and replays user actions.
webappsecattack+2
Track 3·15 min
Alissa Gilbert
Shows how chatbot prompts can speed up wireless pentest tasks, from packet capture review to handshake extraction.
aimachine-learningnetwork+3
Track 3·45 min
Yelena Williams · Trevor Costanzi
Shows how blind SSRF is found, exploited through out-of-band callbacks, and defended with secure infrastructure defaults.
webclouddefensive-security+2
Track 3·18 min
EvilMog
Shows how a captured NTLMv1 challenge response is cracked with hashcat and turned into domain controller NT hashes.
windowsvulnerabilitiesexploitation+2
Track 3·54 min
R.J. Chap
Gives practical tips for presenting well, both over video calls and on a conference stage.
learningguidepractical+1
Track 3·54 min
Corey Overstreet
Shows how payloads get past AV and EDR defenses, and what defenders should monitor to catch them.
attackwindowsdetection+2
Track 3·25 min
Harlequinn
Explores how over-reliance on AI can erode analyst skills, introduce bias and misinformation into SOC work, and what teams can do.
aisecurity-operationslearning+1