Monday

This recording is a run of Monday afternoon sessions from the BSides Las Vegas Ground Floor stage rather than a single talk. It opens with a fast tour of network reconnaissance and pivoting: certificate transparency logs that reveal new domains as they are registered, split DNS leaks that expose internal names, reused SSH public keys used to test server access, VPN appliances as common entry points, and IPv6 exposures that bypass expected firewalls. The same section covers pivot points through management platforms, legacy systems, out-of-band management, IPMI hash retrieval, and backup systems.

Later sessions shift to cloud identity and exposure. One presenter walks through replacing static secrets with passkeys, short-lived role assumption, OIDC workload federation between clouds, and mutual TLS, with a live demo of cross-cloud access failing and being fixed. Another introduces Luminot, a tool for quickly listing public cloud resources, checking what is reachable, and building an exposure timeline during incident response. A separate session describes teaching secure coding in schools and universities through hands-on exercises that deliberately include traps. A red team segment covers prompt injection, indirect injection through poisoned documents, and data exfiltration from LLM applications, and a final session explains common OAuth and OIDC mistakes such as missing state checks, weak token validation, and long-lived bearer tokens that can be replayed.

The practical takeaways are to minimise shared secrets, favour short-lived credentials, inventory exposed services continuously, validate every claim in an identity token, and treat any data source connected to an LLM as part of the attack surface.