App Sec Village·27 min
Avi Lumelsky · Gal Elbaz
Unveils the 0.0.0.0-day vulnerability in major browsers that lets public websites pivot to internal localhost APIs and achieve RCE.
0-0-0-0-daybrowser-securityremote-code-execution+2
8-11 August 2024 · Las Vegas Convention Center
DEF CON 32
8 villages · 267 talks
Villages at this event
App Sec Village
23 talks
DEF CON 32 App Sec Village focuses on application security, secure software development, and modern API and cloud vulnerabilities. The talks cover topics ranging from CI/CD pipeline exploitation and LLM application security to frontend defenses and vulnerability management.
Creator Stage
107 talks
DEF CON 32 Creator Stage showcases technical presentations, hardware demonstrations, and research by independent security creators, builders, and practitioners. Talks cover embedded exploitation, automotive and avionics security, bug bounty tradecraft, operational technology, and practical community education.
Main Stage
93 talks
DEF CON 32 Main Stage features the conference's headline presentations, fireside chats, and technical security research across hardware, cloud, AI, and offensive tradecraft. Sessions cover silicon-level exploitation, cloud attack paths, reverse engineering, and critical discussions on cybersecurity policy and internet resilience.
Main Stage & General
3 talks
DEF CON 32 main stage and general track presentations covering cybersecurity, hacking, and related technologies.
Policy
1 talks
DEF CON 32 Policy presentations and discussions focusing on cybersecurity policy, government initiatives, and digital governance.
Policy Village
1 talks
DEF CON 32 Policy Village brings together hackers, policymakers, legal scholars, and government officials to explore cybersecurity legislation, regulation, and digital rights. Sessions focus on vulnerability disclosure policies, national cyber strategy, privacy protections, and the legal implications of emerging technologies.
Village Interviews
30 talks
Interviews, village walkthroughs, and contest spotlights produced by the DEF CON Video Team at DEF CON 32.
War Stories
9 talks
DEF CON 32 War Stories features first-hand accounts from seasoned security researchers, investigators, and defenders detailing high-profile investigations and complex vulnerability discoveries. Presentations explore real-world digital forensics, reverse engineering operations, supply chain compromises, and federal law enforcement operations.
All DC32 talks
1–24 of 233 talks / 267
App Sec Village·18 min
Aleise McGowan · Tennisha Martin
Examines ransomware attacks against casino giants like MGM and Caesars, highlighting application vulnerabilities and ICT and IoT security challenges.
ransomwareiotincident-analysis+1
App Sec Village·33 min
Ravid Mazon · Jay Chen
Automated detection of Broken Object Level Authorization (BOLA) vulnerabilities across web APIs using LLMs in BOLABuster.
bolaapi-securityllm+2
App Sec Village·18 min
Wang Zhilong · Xinzhi Luo
Analysis of when and why large language models hallucinate during automated code review, and how misleading identifier names induce errors.
llmaicode-review+1
App Sec Village·13 min
Spyros Gasteratos · Andra Lezza
Spyros Gasteratos and Andra Lezza explore strategies for integrating security into the product development lifecycle through threat modeling, OWASP Cornucopia, and collaborative developer workflows.
threat-modelingsecure-developmentowasp+1
App Sec Village·29 min
Ben Dechrai
Implementing scalable fine-grained authorization using Relationship-Based Access Control (ReBAC) without hardcoded business logic.
access-controlrebacauthorization+2
App Sec Village·31 min
Chloé Messdaghi · Kasimir Schulz
Navigating the complexities of responsible vulnerability disclosure, data bias, and model manipulation in AI systems.
ai-policyresponsible-disclosureprompt-injection+2
App Sec Village·29 min
Vangelis Stykas
How API vulnerabilities in EV chargers and solar inverters create systemic risks for power grid infrastructure.
critical-infrastructureics-otv2g+2
App Sec Village·21 min
niks · Charles Waterhouse
Reconnaissance and vulnerability discovery across enterprise banking software used by major financial institutions worldwide.
bankingbug-bountyaccess-control-bypass+2
App Sec Village·27 min
Javan Rasokat · Andra Lezza
Practical insights and defensive strategies from real-world development and hardening of production LLM applications.
llmaiprompt-injection+2
App Sec Village·28 min
SheHacksPurple
A practical three-tier maturity model for evolving application security programs beyond intimidating compliance frameworks.
methodologysecurity-controlsrisk-assessment+1
App Sec Village·27 min
punkcoder
Practical strategies for solo AppSec engineers navigating burnout, team layoffs, and expanding threat landscapes.
workforceburnoutculture+2
App Sec Village·29 min
Ian Hickey
Exploits URL path handling differentials to turn trusted websites into malware delivery platforms using Relative Path File Injection.
rpowebpolyglot+2
App Sec Village·25 min
Jen Ozmen · Aaron Shim
Google's engineering blueprint for eliminating cross-site scripting at scale using compile-time and runtime frontend protections.
xsswebmitigations+1
App Sec Village·32 min
Paulo Silva · David Sopas
Vulnerability chaining and web application research uncovering flaws across eleven major automotive manufacturers.
automotivewebvulnerability-research+2
App Sec Village·33 min
Jason Haddix
Unvarnished perspective on the systemic friction, triage dynamics, and economic realities of commercial bug bounty platforms.
bug-bountycultureresponsible-disclosure+2
App Sec Village·26 min
Michelle Eggers
Architecture, operational role, and defensive controls for securing modern enterprise mainframe environments supporting mission-critical banking.
mainframelegacyinfrastructure+2
App Sec Village·31 min
Cassie Crossley
How Schneider Electric generates, stores, and operationalizes thousands of product SBOMs to accelerate CERT incident response.
sbomsupply-chainvulnerability-management+1
App Sec Village·25 min
Iggy
Exploration of time-based blind SQL injection techniques and data extraction strategies through the lens of Operation GhostShell.
sql-injectiontiming-attacksdatabase+2
App Sec Village·45 min
Kunal Bhattacharya
Modernizing application security programs to protect infrastructure-as-code, secrets, and emerging cloud and AI technology stacks.
iacsecrets-detectioncloud+2
App Sec Village·25 min
Jerry Gamblin
How the Exploit Prediction Scoring System (EPSS) uses threat data and probability modeling to prioritize patching across pipelines and systems.
epssci-cdrisk-assessment+2
App Sec Village·24 min
Peiyu Wang
Real-world attack vectors, threat modeling techniques, and vulnerability case studies for penetration testing decentralized Web3 applications.
web3dappsthreat-modeling+2
App Sec Village·26 min
Elad Pticha · Oreen Livni
Demonstrates a command injection vulnerability in the Bazel GitHub Action that allowed malicious tampering in Google's build pipeline.
ci-cdgithub-actionsbazel+2
Creator Stage·24 min
Lacey Harbour
Examines FDA regulatory challenges and security requirements surrounding point-of-care 3D-printed medical device production systems.
policyaihardware+2