Cloud Village·39 min
Alexandre Sieira
Alexandre Sieira breaks down common implementation pitfalls and bypasses in AWS API Gateway custom Lambda authorizers.
aws-api-gatewaylambdaserverless+2
DEF CON 29/Cloud Village across years
Cloud Village DC29
Paris and Bally's Hotels, Las Vegas · 5-8 August 2021 · 21 talks
Cloud Village focuses on cloud security, container escapes, Kubernetes hardening, AWS and Azure exploitation, multi-cloud IAM toxic combinations, and CaaS runtime analysis.
1–21 of 21 talks
Cloud Village·35 min
Mazin Ahmed
Mazin Ahmed exposes attack vectors targeting Terraform Infrastructure-as-Code environments, extracting plaintext secrets from state files and CI/CD pipelines.
terraformiacstate-file+2
Cloud Village·40 min
Kavisha Sheth
Kavisha Sheth reviews top AWS cloud attack vectors, mapping adversary techniques to defensive detection rules and IAM governance controls.
awsiamcloud-security+2
Cloud Village·39 min
Batuhan Sancak
Batuhan Sancak demonstrates advanced attack techniques targeting Azure Active Directory, including Primary Refresh Token (PRT) theft and OAuth abuse.
azure-adentra-idpass-the-prt+2
Cloud Village·41 min
Rami McCarthy
Rami McCarthy shares a pragmatic guide for newly hired security engineers to rapidly orient, map, and prioritize risk in sprawling, messy multi-cloud estates.
cloud-securitycspmasset-discovery+2
Cloud Village·10 min
Jayesh Singh Chauhan
Jayesh Singh Chauhan welcomes attendees to DEF CON 29 Cloud Village, introducing the speaker lineup, cloud CTF challenges, and community workshops.
cloud-villagedefconorientation+2
Cloud Village·20 min
Rodrigo Montoro
Rodrigo Montoro introduces CSPM2CloudTrail, bridging static Cloud Security Posture Management misconfigurations with dynamic AWS CloudTrail event analysis.
cspmcloudtrailaws+2
Cloud Village·46 min
Rod Soto
Rod Soto explores the telemetry gaps and detection challenges facing defenders when threat actors abuse SSO and cloud credentials across hybrid perimeters.
credential-accesshybrid-cloudtelemetry+2
Cloud Village·14 min
Cassandra Young
Cassandra Young demonstrates a misconfiguration in Microsoft 365 Duo 2FA implementations that allows mobile email clients to bypass two-factor prompts.
m365office-365duo+2
Cloud Village·47 min
Karl Fosaaen
NetSPI researcher Karl Fosaaen demonstrates automated Azure post-exploitation with MicroBurst, dumping credentials from Automation Accounts and Key Vaults.
azuremicroburstpassword-extraction+2
Cloud Village·27 min
Felipe Pr0teus
Felipe Pr0teus shares automated OSINT and scanning techniques to discover exposed AWS cloud assets, including public RDS database snapshots and SQS queues.
awsexposed-resourcess3+2
Cloud Village·22 min
Igal Flegmann
Igal Flegmann explores Cloud Infrastructure Entitlement Management (CIEM), demonstrating how to continuously monitor effective permissions across multi-cloud.
iamciemcloud-governance+2
Cloud Village·35 min
Michael Raggo
Michael Raggo examines toxic combinations across 24,000 cloud permissions in AWS, Azure, and GCP, mapping privilege escalation graphs.
iamtoxic-combinationsmulti-cloud+2
Cloud Village·23 min
Madhu Akula
Madhu Akula introduces Kubernetes Goat, an open-source vulnerable-by-design Kubernetes cluster environment for hands-on offensive and defensive learning.
kubernetes-goatkubernetescontainer-security+2
Cloud Village·1 hr 39 min
Wes Lambert
Security Onion lead Wes Lambert demonstrates deploying distributed network security monitoring (NSM) and threat hunting sensors in AWS and Azure.
security-onioncloud-monitoringnetwork-security+2
Cloud Village·12 min
Kevin Chen
Kevin Chen breaks down Public Key Infrastructure (PKI) concepts, removing the intimidation around TLS certificates, trust chains, and cloud CAs.
pkitlscertificates+2
Cloud Village·38 min
Joshua
Joshua presents GCP Goat, an intentionally vulnerable Google Cloud Platform testbed for learning IAM privilege escalation and cloud storage exploitation.
gcpgcp-goatgoogle-cloud+2
Cloud Village·21 min
Mohammed Aldoub
Mohammed Aldoub presents Barq, an AWS post-exploitation framework that automates attacking live EC2 instances and dumping SSM Parameter Store secrets.
barqawspost-exploitation+2
Cloud Village·16 min
Yuval Avrahami
Palo Alto Networks researcher Yuval Avrahami presents WhoC, a container image tool that extracts the underlying container runtime in public CaaS clouds.
whoccaascontainer-escape+2
Cloud Village·35 min
Daniel Prizmant
Daniel Prizmant demonstrates fundamental architectural security flaws in Windows Server Process-Isolated Containers, executing root container escapes.
windows-containerscontainer-escapekernel+2
Cloud Village·2 hr 30 min
Magno Logan
Magno Logan delivers a comprehensive workshop on securing Kubernetes clusters, covering API servers, etcd, RBAC, admission controllers, and network policies.
kubernetesk8srbac+2