A suggested watch order
Skill Tree An experiment: talks from the archive, sorted by difficulty and topic into suggested paths. Treat it as a loose guide to what to watch next, not a course.
4h 00m more to Specialist
Red Team Blue Team AppSec Malware Cloud AI Security Threat Intel OSINT & Recon Social Engineering Hardware Wireless ICS / OT Mobile Supply Chain Privacy
Careers & foundations0/15 watched
Adversary emulation & C20/15 watched
Web & bug bounty0/16 watched
Physical & social engineering0/16 watched
Network & infrastructure0/12 watched
Windows & Active Directory0/15 watched
Exploit development0/15 watched
The Pentester Blueprint: A Guide to Becoming a Pentester Phillip Wylie · 48 min Student Roadmap to Becoming a Penetration Tester: Bridging Academia & Industry Jonathan Helmus · 61 min So You Think You Want to Be a Penetration Tester Anch · 42 min 2017 - Track3: Managing Your Cyber Career & Job Hunt by Bob Wheeler Bob Wheeler · 55 min Skills For A Red Teamer Brent White, Tim Roberts · 51 min Inside the Mind of a Threat Actor: Red Team vs. Penetration Testing Disciplines Phillip Wylie · 38 min Inside the Mind of a Threat Actor: Beyond Pentesting Phillip Wylie · 51 min Building A Red Team - The Best Defense Is A Good Offense by Daniel Fabian Daniel Fabian · 51 min The Monkey in the Middle: A Pentester's Guide to Playing in Traffic Anch · 53 min I Hunt Penetration Testers: More Weaknesses in Tools and Procedures Wesley McGrew · 42 min One Hundred Red Team Operations A Year Ryan O'Horo · 25 min Area41 2018: Stefan Friedli and Michael Schneider: Red Team: Stories From The Trenches Stefan Friedli, Michael Schneider · 50 min New Red Team Networking Techniques for Initial Access and Evasion Jason Lang · 42 min Modern Red Team Tradecraft: Bridging the Gap with Real-World Espionage Sajal Thomas · 60 min Gone Apple Pickin': Red Teaming macOS Environments in 2021 Cedric Owens · 52 min Introduction to Adversary Emulation Samuel Kimmons · 31 min The Way of the Adversary Phillip Wylie · 31 min A Hillbilly's First C2 Adam Compton · 40 min CALDERA: Automating Adversary Emulation 52 min Prelude Operator: Accessible Adversary Emulation David Hunt · 30 min PurpleSharp: Automated Adversary Simulation Mauricio Velazco · 38 min Designing a C2 Framework Daniel Duggan · 47 min Deep Dive into Adversary Emulation: Ransomware Tradecraft & Purple Teaming Jorge Orchilles · 46 min Tradecraft Development in Adversary Simulations Fatih Ozavci · 106 min Koadic C: Windows COM Command & Control Framework Sean Dillon, Zach Harding · 45 min Abusing Webhooks for Command and Control Dimitry Snezhkov · 22 min Ghost Calls: Abusing Web Conferencing for Covert C2 and Exfiltration Gal Weizman · 42 min Windows Agentless C2: (Ab)using the MDM Client Stack Marcos Oviedo, Zach Wasserman · 39 min Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover 44 min C2Centipede: APT-Level C2 Communications for Common Red Teams Jose Garduno · 48 min Hacking Web Apps Brent White · 38 min Demystifying Bug Bounties: Insights from a Decade of Experience Yassine Aboukir · 69 min Recon and Bug Bounties What A Great Love Story Abhijeth Dugginapeddi · 29 min The Bug Hunter’s Methodology Jason Haddix Jason Haddix · 76 min XSS For the win Brute Logic · 15 min Hacking SQL Injection for Remote Code Execution on a LAMP Stack Nemus · 39 min BurpKit: Using WebKit to Own the Web Nadeem Douba · 29 min Weaponized XSS - Moving Beyond Alert(1) by Ray Doyle Ray Doyle · 47 min Attacking OWASP Exploiting the Top 10 David Coursey · 44 min Infiltrating Corporate Intranet Like NSA: Pre-auth RCE on Leading SSL VPNs Orange Tsai · 46 min A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! 47 min HTTP Desync Attacks: Request Smuggling Reborn 48 min Friday the 13th: JSON Attacks 43 min HTTP/1.1 Must Die! The Desync Endgame James Kettle · 38 min Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls Gareth Heyes · 42 min Gotta Cache Em All: Bending the Rules of Web Cache Exploitation Martin Doyhenard · 36 min The Basics of Social Engineering Chris Pritchard · 25 min Sizing People Up Robin Dreeke · 54 min Basics of Hacking Physical Access Control Systems Babak Javadi · 63 min Intro to Physical Security Bypass Karen Ng, Matthew Cancilla · 57 min Elevator Hacking: From the Pit to the Penthouse Deviant Ollam, Howard Payne · 60 min Breaking in Bad! Real-World Physical Red Teaming & Facilities Penetration Jayson E. Street · 53 min Are We Really Safe? Bypassing Access Control Systems Dennis Maldonado · 46 min How NOT to Perform Covert Entry Assessments Brent White, Tim Roberts · 56 min Real time RFID Cloning in the Field Dennis Maldonado · 21 min Flipping Locks: Remote Badge Cloning with the Flipper Zero and More Langston Clements, Dan Goga · 37 min RFIDiggity: Guide to Hacking HF NFC & UHF RFID Francis Brown, Shubham Shah · 54 min Owning a Building: Exploiting Access Control and Facility Management Systems by Billy Rios Billy Rios · 65 min Safe to Armed in Seconds Deviant Ollam · 38 min Hacking Hotel Keys and Point of Sale Systems Weston Hecker · 44 min Reverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device 48 min Your Passkey is Weak: Phishing the Unphishable Chad Spensky · 24 min MITM 101: Easy Traffic Interception Techniques Using Scapy Bob Simpson · 34 min WEP and WPA Cracking 101 Zero Chaos and Wasabi · 57 min Exploiting Network Printers 45 min Cisco Catalyst Exploitation Artem Kondratenko · 41 min Pivoting Without Rights: Introducing Pivoter Geoff Walton and Dave Kennedy · 50 min OFFENSIVE: Exploiting DNS Servers Changes by Leonardo Nve Leonardo Nve · 63 min Routopsy: Modern Routing Protocol Vulnerability Analysis and Exploitation 42 min CDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days 37 min Key Reinstallation Attacks: Breaking the WPA2 Protocol 47 min Dragonblood: Attacking the Dragonfly Handshake of WPA3 47 min BlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device 57 min EtherOops: Exploring Practical Methods to Exploit Ethernet Packet-in-Packet Attacks 43 min Level Up! Practical Windows Privilege Escalation Andrew Smith · 43 min Winning the Game of Active Directory Brandon Colley · 43 min Red vs Blue: Modern Active Directory Attacks & Defense Sean Metcalf · 50 min PowerPreter Post Exploitation Like a Boss Nikhil Mittal · 42 min Six Degrees of Domain Admin Andy Robbins, Rohan Vazarkar, Will Schroeder · 45 min Get $pwnd: Attacking Battle Hardened Windows Server Lee Holmes · 22 min The Rise of Potatoes: Privilege Escalations in Windows Services Antonio Cocomazzi · 42 min Certified Pre-Owned: Abusing Active Directory Certificate Services 35 min Abusing Microsoft Kerberos: Sorry You Guys Don't Get It 51 min An ACE Up the Sleeve: Designing Active Directory DACL Backdoors 47 min Advanced Active Directory to Entra ID Lateral Movement Techniques Dirk-jan Mollema · 39 min Relaying Credentials has Never Been Easier Marina Simakov · 44 min The UnRightful Heir: My dMSA Is Your New Domain Admin Yuval Gordon · 34 min Walking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities Dirk-jan Mollema · 35 min Breaking Kerberos' RC4 Cipher and Spoofing Windows PACs Tom Tervoort · 41 min Assembly Language is Too High Level XlogicX · 45 min The Rise and Fall of Binary Exploitation Stephen Sims · 48 min KEYNOTE: The Exploit Development Life Cycle: From Concept to Compromise, Valentina Palmiotti Valentina Palmiotti · 40 min Introduction To Cheat Engine David Weinman · 22 min Exploit Development Is Dead, Long Live Exploit Development! 48 min The ABC of Next Gen Shellcoding Hadrian Barral · 36 min Advanced Format String Attacks Paul Haas · 31 min Exploiting Windows Exploit Mitigation for ROP Exploits Omer Yair · 42 min Can't Stop the ROP: Automating Universal ASLR Bypass and ROP Generation Tim 'diff' Becker · 43 min Demystifying Windows Kernel Exploitation by Abusing GDI Objects Saif El Sherei · 44 min USA 2012 - The Info Leak Era on Software Exploitation Fermin J. Serna · 51 min return-to-csu: A New Method to Bypass 64-bit Linux ASLR 57 min Windows 10 Segment Heap Internals 42 min USA 2012 - Exploiting The Jemalloc Memory Allocator: Owning Firefox's Heap 60 min Exploring a New Class of Kernel Exploit Primitive Rohit Mothe, Andrew Ruddick · 33 min TIER I Beginner
TIER II Intermediate
TIER III Advanced
TIER IV Expert
Penetration testing and offensive operations
Red Team 40%
+ − FIT
Scroll or press + to zoom in and read talk names
Map
Careers & foundations Tier I · Beginner
I The Pentester Blueprint: A Guide to Becoming a Pentester I Student Roadmap to Becoming a Penetration Tester: Bridging Academia & Industry I So You Think You Want to Be a Penetration Tester I 2017 - Track3: Managing Your Cyber Career & Job Hunt by Bob Wheeler Tier II · Intermediate
Skills For A Red Teamer Inside the Mind of a Threat Actor: Red Team vs. Penetration Testing Disciplines Inside the Mind of a Threat Actor: Beyond Pentesting Building A Red Team - The Best Defense Is A Good Offense by Daniel Fabian Tier III · Advanced
The Monkey in the Middle: A Pentester's Guide to Playing in Traffic I Hunt Penetration Testers: More Weaknesses in Tools and Procedures One Hundred Red Team Operations A Year Area41 2018: Stefan Friedli and Michael Schneider: Red Team: Stories From The Trenches Tier IV · Expert
New Red Team Networking Techniques for Initial Access and Evasion Modern Red Team Tradecraft: Bridging the Gap with Real-World Espionage Gone Apple Pickin': Red Teaming macOS Environments in 2021 Adversary emulation & C2 Tier I · Beginner
I Introduction to Adversary Emulation I The Way of the Adversary I A Hillbilly's First C2 Tier II · Intermediate
CALDERA: Automating Adversary Emulation Prelude Operator: Accessible Adversary Emulation PurpleSharp: Automated Adversary Simulation Designing a C2 Framework Tier III · Advanced
Deep Dive into Adversary Emulation: Ransomware Tradecraft & Purple Teaming Tradecraft Development in Adversary Simulations Koadic C: Windows COM Command & Control Framework Abusing Webhooks for Command and Control Tier IV · Expert
Ghost Calls: Abusing Web Conferencing for Covert C2 and Exfiltration Windows Agentless C2: (Ab)using the MDM Client Stack Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover C2Centipede: APT-Level C2 Communications for Common Red Teams Tier I · Beginner
I Hacking Web Apps I Demystifying Bug Bounties: Insights from a Decade of Experience I Recon and Bug Bounties What A Great Love Story I The Bug Hunter’s Methodology Jason Haddix Tier II · Intermediate
XSS For the win Hacking SQL Injection for Remote Code Execution on a LAMP Stack BurpKit: Using WebKit to Own the Web Weaponized XSS - Moving Beyond Alert(1) by Ray Doyle Attacking OWASP Exploiting the Top 10 Tier III · Advanced
Infiltrating Corporate Intranet Like NSA: Pre-auth RCE on Leading SSL VPNs A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! HTTP Desync Attacks: Request Smuggling Reborn Friday the 13th: JSON Attacks Tier IV · Expert
HTTP/1.1 Must Die! The Desync Endgame Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls Gotta Cache Em All: Bending the Rules of Web Cache Exploitation Physical & social engineering Tier I · Beginner
I The Basics of Social Engineering I Sizing People Up I Basics of Hacking Physical Access Control Systems I Intro to Physical Security Bypass Tier II · Intermediate
Elevator Hacking: From the Pit to the Penthouse Breaking in Bad! Real-World Physical Red Teaming & Facilities Penetration Are We Really Safe? Bypassing Access Control Systems How NOT to Perform Covert Entry Assessments Tier III · Advanced
Real time RFID Cloning in the Field Flipping Locks: Remote Badge Cloning with the Flipper Zero and More RFIDiggity: Guide to Hacking HF NFC & UHF RFID Owning a Building: Exploiting Access Control and Facility Management Systems by Billy Rios Tier IV · Expert
Safe to Armed in Seconds Hacking Hotel Keys and Point of Sale Systems Reverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device Your Passkey is Weak: Phishing the Unphishable Network & infrastructure Tier I · Beginner
I MITM 101: Easy Traffic Interception Techniques Using Scapy I WEP and WPA Cracking 101 Tier II · Intermediate
Exploiting Network Printers Cisco Catalyst Exploitation Tier III · Advanced
Pivoting Without Rights: Introducing Pivoter OFFENSIVE: Exploiting DNS Servers Changes by Leonardo Nve Routopsy: Modern Routing Protocol Vulnerability Analysis and Exploitation CDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days Tier IV · Expert
Key Reinstallation Attacks: Breaking the WPA2 Protocol Dragonblood: Attacking the Dragonfly Handshake of WPA3 BlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device EtherOops: Exploring Practical Methods to Exploit Ethernet Packet-in-Packet Attacks Windows & Active Directory Tier I · Beginner
I Level Up! Practical Windows Privilege Escalation I Winning the Game of Active Directory I Red vs Blue: Modern Active Directory Attacks & Defense Tier II · Intermediate
PowerPreter Post Exploitation Like a Boss Six Degrees of Domain Admin Get $pwnd: Attacking Battle Hardened Windows Server The Rise of Potatoes: Privilege Escalations in Windows Services Tier III · Advanced
Certified Pre-Owned: Abusing Active Directory Certificate Services Abusing Microsoft Kerberos: Sorry You Guys Don't Get It An ACE Up the Sleeve: Designing Active Directory DACL Backdoors Advanced Active Directory to Entra ID Lateral Movement Techniques Tier IV · Expert
Relaying Credentials has Never Been Easier The UnRightful Heir: My dMSA Is Your New Domain Admin Walking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities Breaking Kerberos' RC4 Cipher and Spoofing Windows PACs Tier I · Beginner
I Assembly Language is Too High Level I The Rise and Fall of Binary Exploitation I KEYNOTE: The Exploit Development Life Cycle: From Concept to Compromise, Valentina Palmiotti I Introduction To Cheat Engine Tier II · Intermediate
Exploit Development Is Dead, Long Live Exploit Development! The ABC of Next Gen Shellcoding Advanced Format String Attacks Tier III · Advanced
Exploiting Windows Exploit Mitigation for ROP Exploits Can't Stop the ROP: Automating Universal ASLR Bypass and ROP Generation Demystifying Windows Kernel Exploitation by Abusing GDI Objects USA 2012 - The Info Leak Era on Software Exploitation Tier IV · Expert
return-to-csu: A New Method to Bypass 64-bit Linux ASLR Windows 10 Segment Heap Internals USA 2012 - Exploiting The Jemalloc Memory Allocator: Owning Firefox's Heap Exploring a New Class of Kernel Exploit Primitive