Creator: OWASP Foundation
2001: Agentic Odyssey” is a hands-on, drop-in workshop where we threat model the HAL 9000 system from 2001: A Space Odyssey as if it were a modern agentic AI system (LLM + tools + permissions + side effects). I bring a HAL DFD, and together we mark trust boundaries and do classic “what can go wrong?” threat identification. Participants then split into small groups to build attack-tree branches and translate them into Fault Tree Analysis (FTA) using AND/OR logic and minimal cut sets, including lightweight probability estimates to prioritise the most likely failure chains. We finish by turning those failure paths into automation-ready test ideas (fault injection, invariants, evidence), and optionally drafting a structured HAL threat model for submission to the OWASP Threat Model Library. Designed so anyone can contribute in 10-15 minutes, while advanced participants can go deep on FTA and prioritisation. Every stage is split into a way to enable drop-ins at any time.
Links:
    Register here – https://luma.com/l3j6ecg5

People:
    SpeakerBio:  Petra Vukmirovic, Project Leader, Threat Model Library at OWASP

Petra is a technology enthusiast, leader and public speaker. A former emergency medicine doctor and competitive volleyball athlete, she thrives in challenging environments and loves creating order from chaos. Initially pursuing a medical career, Petra’s passion for technology led her to pivot into cyber security, earning a Master’s in Information Security and Digital Forensics.

Creator: Malware Village

DLL sideloading is one of the most common tricks in modern malware — a trusted program is quietly made to load an attacker’s code instead of the library it expected. In this hands-on workshop you’ll take one apart in IDA and learn to read what a binary actually does versus what it wants you to think it does. You’ll start by cracking a small serial-check program to get comfortable moving around IDA, then triage a suspicious “updater,” and finally dissect a sideloading library that hides a single real payload among convincing decoys — fake C2 URLs, unused “scary” API calls, and dead-end code planted to waste an analyst’s time. The takeaway skill is the one that matters most in real analysis: follow what executes, not what looks dangerous. Every sample is completely deweaponized — the worst any of them does is pop a message box — so you can poke at everything freely. You’ll leave with the samples, a written walk-through, and an IDA command cheat-sheet to keep practicing. Level: Beginner-friendly; no reverse-engineering experience needed. Bring: A laptop with IDA (IDA Free will work, you can download here) You’ll leave able to: navigate IDA, read imports/exports/strings, recognise a DLL sideload and its proxy/forwarder disguise, and see through common anti-analysis decoys

People:
    SpeakerBio:  David Rushmer, Tech Evangelist, Hex-Rays
No BIO available

Creator: OWASP Foundation

Large language models have rapidly evolved from chat interfaces into autonomous agents capable of interacting with real-world systems. In this hands-on workshop, participants will build an AI-powered security agent from the ground up and learn the core principles behind agentic penetration testing using intentionally vulnerable OWASP applications.

Rather than simply prompting an LLM, attendees will explore how to equip an agent with practical capabilities—including shell access, browser access, and orchestration to discover, exploit, and document vulnerabilities in an OWASP vulnerable web application (VWAD). Along the way, we’ll discuss the architecture of effective security agents, tool integration, memory, and safe execution practices.

The workshop also introduces an iterative evaluation workflow. Participants will analyze vulnerabilities the agent failed to identify, compare results against known findings, and use those gaps to refine prompts, tool selection, workflows, and evaluation criteria. This iterative approach demonstrates how modern AI security agents can continuously improve their effectiveness through systematic testing and feedback rather than relying on a single execution.

By the end of the session, attendees will have built a functional AI security agent, understand the fundamentals of agent tooling and orchestration, and leave with practical techniques for evaluating and improving AI-assisted security testing on OWASP vulnerable applications.

Links:
    Register here – https://luma.com/yw0xkarr

People:
    SpeakerBio:  Philippe “pilvar” Dourassov, AI Pentest Lead at Aikido Security

Philippe Dourassov is a Swiss ethical hacker and AI security researcher. He represented Switzerland at the European Cybersecurity Challenge and later joined Team Europe at the International Cybersecurity Challenge. In 2024, he won the Gold Medal in Cyber Security at WorldSkills.

He later worked as an independent bug hunter and security auditor at Zellic, assessing complex web applications. Philippe then co-founded Haicker, an AI-driven automated pentesting platform, which was acquired by Aikido Security. He now serves as AI Pentest Lead, building the next generation of autonomous security testing.

Creator: Noob Community

AI went from a tech toy to critical enterprise infrastructure practically overnight, and the security world is scrambling to keep up. This hands-on session completely bypasses the complex academic math to show you exactly how attackers target, exploit, and manipulate AI systems in the real world. Led by Jason Haddix and the Arcanum team, this workshop is a crash course in AI security basics. You’ll get your hands dirty with prompt injection, break open AI systems, and dive into LLM shenanigans to understand firsthand how the modern AI attack surface is exploited.

People:
    SpeakerBio:  Jason “jhaddix” Haddix, CEO and “Hacker in Charge” at Arcanum Information Security

Jason Haddix AKA jhaddix is the CEO and “Hacker in Charge” at Arcanum Information Security. Arcanum is a world class assessment and training company.

Jason has had a distinguished 20-year career in cybersecurity previously serving as CISO of FLARE, CISO of Buddobot, CISO of Ubisoft, Head of Trust/Security/Operations at Bugcrowd, Director of Penetration Testing at HP, and Lead Penetration Tester at Redspin. He has also held positions doing mobile penetration testing, network/infrastructure security assessments, and static analysis. Jason is a hacker, bug hunter and currently ranked 57th all-time on Bugcrowd’s bug bounty leaderboards. Currently, he specializes in recon, web application analysis, and emerging technologies. Jason has also authored many talks on offensive security methodology, including speaking at cons such as DEFCON, Bsides, BlackHat, RSA, OWASP, Nullcon, SANS, IANS, BruCon, Toorcon and many more.

SpeakerBio:  Arcanum Information Security Team
No BIO available

Creator: Bug Bounty Village

This workshop provide hands-on labs plus for turning a prompt injection into a real, reportable bounty, specifically the exfiltration step that bridges “I made the AI say something weird” and “I exfilled PIIsystem prompts to my server .” We cover injection vectors hackers actually encounter on agentic apps (calendar invites, emails, markdown rendering, DNS-based egress) and the patterns that get programs to pay.

People:
    SpeakerBio:  Ben “NahamSec” Sadeghipour

Ben Sadeghipour (NahamSec) is a security researcher, ethical hacker, and educator who has spent more than a decade finding and disclosing critical vulnerabilities in some of the world’s largest organizations. As one of the most recognized names in the bug bounty community, he has reported thousands of security flaws and consistently ranked among the top researchers on leading hacking platforms. Beyond his own research, Ben is passionate about lowering the barrier to entry in cybersecurity. Through his widely followed educational content, live streams, and the conferences he founds and organizes, he has helped train a new generation of hackers around the world. His work blends deep technical expertise with a commitment to mentorship and community building.Ben speaks regularly at industry conferences on offensive security, bug bounty hunting, and building a career in cybersecurity.

SpeakerBio:  Kameron “clovismint” Bettridge

Kameron Bettridge (Clovis Mint) is an application security engineer at Blizzard Entertainment, where he works to secure systems behind some of the world’s most popular games. Alongside his day-to-day role, he takes on contract work for Gray Swan as an AI red teamer and arena engineer, where he has contributed to testing the limits of modern AI systems. Kameron is a fierce competitor on the CTF circuit, playing with The Hackers Crew; ranked 3rd globally on CTFtime in 2024, as well as Squid Proxy Lovers and the US Cyber Team, with whom he will represent the United States in Tokyo. He has competed at the highest levels of the sport, reaching the finals of DEF CON, Google CTF (Hackceler8), and more

Creator: IoT Village

UART, it’s in your smart camera, router, maybe even your phone and it’s usually the easiest foothold into a device. In this hands-on workshop you’ll learn to find it with a multimeter, read it with a logic analyzer…

Links:
    More Info – https://training.brownfinesecurity.com

Creator: Malware Village

Patrick has spent the past 20 years studying macOS malware, building tools to detect it, and authoring The Art of Mac Malware book series. In this training, you’ll learn the tools and techniques needed to detect and analyze modern threats targeting Apple’s desktop OS.

We’ll cover common infection vectors, persistence mechanisms, and capabilities of macOS malware, along with an introduction to the tools and techniques used to classify and analyze malicious binaries.

People:
    SpeakerBio:  Patrick Wardle, CEO and Co-Founder at DoubleYou

Patrick Wardle is the cofounder of the Objective-See Foundation, CEO and cofounder of DoubleYou, and author of The Art of Mac Malware series. He previously worked at NASA and the NSA, and has presented at countless security conferences, making him intimately familiar with aliens, spies, and talking nerdy.

Creator: Recon Village

Reconnaissance is the foundation of every successful engagement but fragmented tooling, manual chaining, and missed data leave gaps that cost you findings. BBOT (Bighuge BLS OSINT Tool) was built to solve that. Developed by Black Lantern Security, BBOT is a recursive, event-driven OSINT framework that replaces the traditional phased approach with continuous, real-time discovery every new piece of data is immediately fed back into the scan engine to uncover what linear workflows miss.

This is a fully hands-on workshop. Attendees will install and configure BBOT, then run it live against their own scoped bug bounty targets turning the session into real reconnaissance rather than a slide-driven demo. We’ll cover BBOT’s 100+ module architecture spanning subdomain enumeration, cloud asset discovery, email harvesting, web spidering, and vulnerability scanning with Nuclei, all chainable in a single command and firing recursively in real time. Along the way we’ll dig into scope management, passive vs. active recon tradeoffs, and the web hacking modules that can point you toward real findings.

By the end of the session, attendees will walk away with actual scan output from a live target, a repeatable BBOT-driven recon workflow they can drop into their next program, and a clear understanding of how to triage findings into real submissions. Whether you’re new to automated recon or a seasoned bug bounty hunter still stitching tools together by hand, this workshop will change how you approach OSINT at scale.

Module 1 — Why BBOT? The Problem with How We Recon Now

The fragmented toolchain problem: Amass → Subfinder → httpx → manual grep

Why phased OSINT misses things — and what recursive, event-driven recon solves

BBOT’s origin at Black Lantern Security and design philosophy

Quick architecture overview: modules, events, presets, scope

3.0 Updates – Rustification of HTTP and DNS

Q&A / audience skill check

Module 2 — Getting Oriented: Installation, Config & First Scan

Verify install and run bbot –help

Listing and exploring modules with bbot -l

Understanding flags vs. modules vs. presets

Exercise 2.1: Run your first subdomain scan

Reading and understanding BBOT output

Scan output folders, naming conventions, and where data lives

Module 3 — Subdomain Enumeration Deep Dive

How BBOT’s recursive engine finds more than traditional tools

Passive vs. active enumeration — when to use each

Subdomain mutations and wordcloud usage

Exercise 3.1: Full active subdomain enum

Module 4 — Going Deeper: Cloud, Email & Asset Discovery

Cloud enumeration: S3 buckets, Azure blobs, GCP assets

Email harvesting for org footprinting

Combining flags for broader discovery

Exercise 4.1: Run a combined cloud + email + subdomain scan

Identifying misconfigured or exposed cloud assets in output

Discussion: how these findings translate to bug bounty submissions

Module 5 — Web Hacking Modules & Vulnerability Scanning

Overview of BBOT’s web module suite: httpx, gowitness, wappalyzer, nuclei

Web spidering for email, secrets, and exposed paths

Nuclei integration — what it scans for and how to interpret results

Exercise 5.1: Full web scan with screenshots

Exercise 5.2: Kitchen sink scan (instructor-guided, safe target only)

Setting expectations: BBOT points you at the doors — you still have to kick them open

Module 6 — Triage, Workflow & What Happens After the Scan

How to structure your post-BBOT workflow: what to investigate first

Prioritizing findings by severity and exploitability

Avoiding common pitfalls: rate limiting, duplicate findings, out-of-scope mistakes

Building a repeatable bug bounty recon workflow around BBOT

Scheduling and automating recurring scans for continuous monitoring

Wrap-Up & Q&A

Recap of key takeaways

Recommended next steps and resources

GitHub, docs, and community links

Open Q&A

People:
    SpeakerBio:  Mark Gaddy
No BIO available

Creator: Noob Community

Cybersecurity has its own language, and business has its own language, and most of the time we’re not speaking either of them well. The people who learn to translate between the two are the ones who get listened to, get funded, and get promoted. That’s the craft Tony is teaching you in this session.

People:
    SpeakerBio:  Tony Martin-Vegue
No BIO available

Creator: Noob Community

Same session as Saturday. You don’t need years of experience to start thinking like an attacker—you just need the right environment and someone to show you the ropes. In this hands-on session, Evolve Security Academy completely bypasses the theory to walk you through the fundamentals of ethical hacking in a live, browser-accessible lab environment. You’ll adopt an attacker mindset, perform real reconnaissance, run vulnerability scans, and assess live exploits firsthand. Best of all, all registered participants get 7 days of extended access to the CyberLab platform to keep hacking at their own pace after DEF CON.

People:
    SpeakerBio:  Evolve Security Academy
No BIO available

Creator: Noob Community

You don’t need years of experience to start thinking like an attacker—you just need the right environment and someone to show you the ropes. In this hands-on, 45-minute session, Evolve Security Academy completely bypasses the theory to walk you through the fundamentals of ethical hacking in a live, browser-accessible lab environment. You’ll adopt an attacker mindset, perform real reconnaissance, run vulnerability scans, and assess live exploits firsthand. Best of all, all registered participants get 7 days of extended access to the CyberLab platform to keep hacking at their own pace after DEF CON.

People:
    SpeakerBio:  Evolve Security Academy
No BIO available

Creator: IoT Village

Beginners can now create off-grid, encrypted mesh networks for cheap, with applications in emergency communication, sensor monitoring, and more! Kit Cost: $80. Class Cap: 30.

Links:
    Friday Purchase & Registration – https://retia.io/products/defcon-build-your-own-meshtastic-node-off-grid-encrypted-lora-meshnets-for-beginners

People:
    SpeakerBio:  Kody Kinzie
No BIO available

Creator: Bug Bounty Village

Ever found yourself scrolling through thousands of requests looking for the few that matter? Repeating the same checks across every target? Wishing Burp Suite would automate part of your workflow?

This hands-on workshop teaches bug bounty hunters how to build Burp customizations that surface valuable signals and eliminate repetitive work.

People:
    SpeakerBio:  Hannah L, Burp Suite Extensibility Specialist at PortSwigger

Hannah is an Extensibility Specialist at PortSwigger, where she helps shape how Burp Suite can be adapted to real-world testing workflows. She works hands-on with submissions to the BApp Store, as well as the Bambdas and BChecks community repositories, helping refine extensions and community contributions before they’re shared more widely.

She especially enjoys making extensions better and finding creative workarounds to awkward testing problems. She has also written extensions for customers, internal teams, and her own projects, including the original WebSocket Turbo Intruder extension.

Creator: AppSec Village

Burp Suite already solves most daily testing problems, but the security landscape constantly evolves. New vulnerabilities, CVEs, and techniques emerge every day, and sometimes the capability you need simply does not exist yet.

In this hands-on workshop, you’ll learn how to adapt Burp Suite to your workflow using custom scan checks, Bambdas, extensions, and the BApp Store. You’ll create your own Bambdas, test them against Web Security Academy labs, modify a free template extension, and start a project you can continue after the session.

You’ll leave with practical tools, a repeatable development approach, and guidance on sharing your work with teammates or the wider community.

Links:
    Registration – https://www.zeffy.com/en-US/ticketing/burp-but-yours-hands-on-extension-and-bambda-development

People:
    SpeakerBio:  Hannah L, Burp Suite Extensibility Specialist at PortSwigger

Hannah is an Extensibility Specialist at PortSwigger, where she helps shape how Burp Suite can be adapted to real-world testing workflows. She works hands-on with submissions to the BApp Store, as well as the Bambdas and BChecks community repositories, helping refine extensions and community contributions before they’re shared more widely.

She especially enjoys making extensions better and finding creative workarounds to awkward testing problems. She has also written extensions for customers, internal teams, and her own projects, including the original WebSocket Turbo Intruder extension.

Creator: AppSec Village

Want to build secure applications without co-sponsoring a Formula 1 team? The modern threat landscape is a mess of AI-generated vulnerabilities, supply chain poisoning, and cloud misconfigurations. You don’t need a seven-figure vendor budget to fight it.

In this 2-hour hands-on workshop, we will build a complete, automated AppSec pipeline using entirely open-source tools. We will wire up Opengrep for SAST, Trivy for containers, Checkov for infrastructure, and ZAP for DAST – piping the chaos into DefectDojo for centralized vulnerability management. We will also explore how to use local AI models to triage the inevitable mountain of false positives. You will walk away with a functional pipeline and a realistic understanding of where open-source excels, and where it falls apart.

Links:
    Registration – https://www.zeffy.com/en-US/ticketing/code-to-cloud-secure-modern-applications-using-open-source-tools

People:
    SpeakerBio:  Mackenzie

Mackenzie is a developer advocate with a passion for DevOps and code security. As the co-founder and former CTO of a health tech startup, he learnt first-hand how critical it is to build secure applications with robust developer operations.

Today as the Developer Advocate at GitGuardian, Mackenzie is able to share his passion for code security with developers and works closely with research teams to show how malicious actors discover and exploit vulnerabilities in code.

Creator: AppSec Village

Containers aren’t tiny fortresses. They’re leaky rowboats unless you know what you’re doing. This hands-on workshop demystifies container security layer by layer, showing how real-world missteps in runtime, image, and host configurations open doors to escapes, persistence, and lateral movement. We’ll dissect how containers actually work, walk through common isolation failures, and demonstrate how attackers exploit weak assumptions. Whether you’re building, securing, or regulating containerized apps, you’ll leave with a threat model, practical tools, and maybe a new trick or two for literally popping out of the box.

Links:
    Registration – https://www.zeffy.com/en-US/ticketing/container-escapes-101annual-gala

People:
    SpeakerBio:  some-natalie

Natalie is a principal solutions engineer at XBOW serving the public sector market. She spent years designing, building, and leading complex systems in regulated environments at a major systems integrator, but has also taken her career in many other directions – including detours into project management, systems engineering, and teaching.

She’s passionate about diversity in technology and empowering engineers to build better.

Creator: La Villa Community

Demostrar cómo las relaciones de confianza entre entornos híbridos de Azure DevOps, Microsoft Azure, Active Directory, Amazon Web Services y Kubernetes pueden ser abusadas por un atacante para realizar movimientos laterales, escalamiento de privilegios y compromiso de identidades utilizando herramientas y funcionalidades legítimas de administración cloud en infraestructuras hibridas corporativas.

People:
    SpeakerBio:  Juan Camilo Palacio Arango, Un token, una confianza, una cadena de compromiso.

Juan Camilo Palacio

Suboficial retirado de la Fuerza Aérea Colombiana, con sólida formación en Ingeniería de Sistemas y un Máster en Ciberseguridad y Privacidad. A lo largo de los últimos 7 años, he perfeccionado y especializado mis habilidades en diversas áreas de la Ciberseguridad, Ciberdefensa y Ciberinteligencia, aplicando con éxito mis conocimientos en los sectores de defensa nacional y financiero.

Mi compromiso con la actualización constante de técnicas se evidencia en la obtención de certificaciones destacadas en técnicas de ethical hacking y red teaming, tales como OSEP, OSCP, CRTO, ARTE, CRTE, entre otras. Estas certificaciones expresan mi dedicación continua a la mejora de mis habilidades y destacan mi capacidad para enfrentar desafíos complejos en el dinámico campo de la ciberseguridad.

Andres Restrepo Gonzalez

Profesional de ciberseguridad especializado en Red Team y seguridad ofensiva en entornos multicloud. Cuenta con certificaciones avanzadas en AWS, Azure y operaciones de Red Team, incluyendo OSCP, CRTE, CRTP, CARTS, CCPenX-AWS y MCRTA, entre otras. Su trabajo se enfoca en la simulación de adversarios, pentesting de infraestructuras cloud y evaluación de la resiliencia de organizaciones frente a amenazas avanzadas.

SpeakerBio:  Andrés Restrepo, Hacker

Entusiasta de la seguridad con experiencia en actividades de RedTeam

Creator: Bug Bounty Village

In the workshop we will explore how to setup yourself for success with AI agents by using a tight integration with your proxy of choice. We will start with why you would want to use a proxy with AI agents (Scoping, Guardrails, Human-in-the-loop, Tool provider) and then showcase multiple ways to achieve the integration (MCP, Skills, Plugins). It will use Caido for the workshop but the concepts will be applicable to all proxies.

People:
    SpeakerBio:  Emile “TheSytten” Fugulin, Caido Labs

Emile was a freelance devops & backend developer for many years prior to starting Caido. He always had a passion for security and working on Caido is the perfect combinaison of both!

SpeakerBio:  Vitor “busf4ctor” Falcao Habibe Costa, Frontier AI Red Team Operator, BT6

Vitor is an AI security researcher, Community Manager at Critical Thinking, and a Google VRP hunter, named Best AI Researcher at Google bugSWAT. He’s part of the BT6 team and hunts bugs full time.

Creator: La Villa Community

Practicaremos algunas técnicas modernas que utilizamos en equipos globales de Respuesta a Incidentes para procesar y analizar evidencias digitales durante ataques cibernéticos, y responder con conclusiones acertadas en un lapso muy corto.

Este taller está dirigido para quienes desconocen cómo empezar su carrera en DFIR o buscan afinar sus técnicas de investigación.

Habrá un pequeño CTF de un incidente de Ransomware con regalos para los ganadores.

People:
    SpeakerBio:  Ashley Hiram Muñoz, Kaspersky – Incident Response Specialist

I currently work as an Incident Response Specialist on Kaspersky’s Global Emergency Response Team (GERT). I live in Mexico and have over seven years of experience in Incident Response, Digital Forensics, Malware Analysis, and Reverse Engineering. Before joining DFIR, I worked for two years as a Penetration Tester.

I have collaborated on various Threat Hunting and Threat Intelligence projects.

Additionally, I have been a speaker at international events such as DEFCON (La Villa Hacker), BSides, Ekoparty, 8.8, HackGDL, BugCON, Pwnterrey, and others. I currently teach the Digital Forensics, Malware Analysis, and Incident Response modules in an information security diploma program at UNAM (Universidad Nacional Autónoma de México).

Certifications: GREM, GCFA, GCFR, eCTHP, CHFI.

—

Actualmente me desempeño como Incident Response Specialist en el Global Emergency Response Team (GERT) de Kaspersky, cuento con +6 años de experiencia realizando Respuesta a Incidentes, Análisis Forense Digital, Análisis de Malware y Reversing; previo a dedicarme a DFIR laboré 2 años como Penetration Tester.

He colaborado en distintos proyectos de Threat Hunting y Threat Intelligence.

Adicionalmente, he sido ponente en eventos internacionales como DEFCON (La Villa Hacker), BSides, Ekoparty, 8.8, BugCON, etc.

Actualmente soy profesor de los módulos de Análisis Forense, Análisis de Malware y Respuesta a Incidentes en un diplomado de seguridad de la información de la UNAM.

Certificaciones: GREM, GCFA, eCTHP, CHFI.

Creator: Noob Community

Led by a seasoned security speaker with over 600 presentations under their belt and training from world-class Toastmasters, this interactive session completely bypasses the fluff to focus entirely on real-world delivery. This workshop is your chance to turn stage fright into stage might, equipping you with the tools to present with poise, project authority, and own the room.

People:
    SpeakerBio:  James McQuiggan
No BIO available

Creator: Blacks In Cyber Village

Most cybersecurity workshops teach you how to do the work. This one teaches you how to own it. Tyrone E. Wilson Army veteran, CISO, and founder of Cover6 Solutions breaks down what it actually takes to transition from practitioner to principal: building a service-based firm, pricing your expertise, navigating GovCon as an SDVOSB, and sustaining a business that doesn’t depend on your last client check.

People:
    SpeakerBio:  Tyrone E. Wilson, Cover6 Solutions

Tyrone E. Wilson is a U.S. Army veteran, cybersecurity executive, and founder of Cover6 Solutions a Service-Disabled Veteran-Owned Small Business delivering vCISO and compliance services to organizations across the public and private sectors. With over two decades of experience in security leadership, they built Cover6 from the ground up while simultaneously growing a 9,000+ member cybersecurity community for career changers and professionals of color. They are the creator of the Breaking Into Cyber framework and host of the Cover6 Community a free resource for anyone navigating the industry without a built-in network. Tyrone has delivered training for Blacks In Cybersecurity and speaks regularly on the intersection of entrepreneurship, community, and cybersecurity career development.

Creator: CodeBloom

Input, output, and variables are the building blocks behind every single program you’ve ever used, and once you understand them, you’re well on your way to writing your own code! In this session, we’ll play some fun games together to show how these ideas already show up in your everyday life, then practice matching them to real Python code. All are welcome, no coding experience required. If you’ve ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

Creator: CodeBloom

Have you ever had to do the same thing over and over and thought, there has to be an easier way? Good news, there is, and it’s called a loop! Come play some classic schoolyard games with us and discover that you’ve been using loops in real life all along. Then we’ll show you how programmers use for loops and while loops to make computers repeat tasks automatically, whether that’s counting to 100 or spawning enemies in your favorite video game. No experience needed, just come ready to play! If you’ve ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

Links:
    More Info – https://codebloom.org/defcon

Creator: Bug Bounty Village

IDE extensions are a lucrative slice of the modern bug bounty scope. They run with privileged capabilities, parse arbitrary workspace files, and increasingly ship LLM backed agentic features that execute commands, edit files, and follow instructions found in the project under review. AI assistants have become an exploit chain accelerator: agents touch every stage from file ingestion to primitive acquisition to escalation, often with minimal sandboxing. This workshop turns those ideas into hands on practice. Attendees install “Nopilot”, a deliberately vulnerable mock AI assistant VS Code extension, learn how to debug it, review code for bugs, and chain primitives from “user opened a folder” to code execution that requires no further interaction and bypasses workspace trust entirely. Built around a generalized IDE exploitation killchain and drawn from a multi-six-figure IDE bug bounty practice. Bring a laptop and curiosity. Read the full description here: https://gist.github.com/nickcopi/daf5b24b262c802830ab6c1ef9d5d49d

People:
    SpeakerBio:  Nick “7urb01” Copi

Nick Copi is a full-time bug bounty hunter targeting web applications, cloud infrastructure, desktop apps, and pretty much anything with an attack surface. His background spans application security engineering, full-stack development, and a long track record of local CTF competition wins. He has presented several technical talks at security conferences and regularly publishes and reviews security research. He really likes JavaScript. Maybe too much. Maybe someone should check on him.

Creator: IoT Village

Using tools like OpenOCD and Segger J-Link Mini, we’ll guide you through modifying the boot ‘init=’ process in memory via JTAG, forcing the device into a single user mode shell via UART.

Links:
    More Info – https://iotvillage.org/events/defcon-34/index.html

Creator: Recon Village

Every organization relies on third-party vendors, open-source packages, and CI/CD tools to build and deliver software. In this session, we’ll learn how to identify and map these external dependencies, understand the trust relationships between them, and discover potential security risks. Through practical demonstrations, attendees will see how issues such as dependency confusion, insecure GitHub Actions workflows, and vendor-related weaknesses can become entry points for supply chain attacks. The goal is to help security teams find and fix these risks before attackers do.

People:
    SpeakerBio:  Dhiyaneshwaran Balasubramaniam
No BIO available
SpeakerBio:  Aman Rawat
No BIO available

Creator: Malware Village

Abstract A malicious document is no longer only a payload for the endpoint. It is an input your tooling has to parse and judge, and as SOC teams bolt language models onto triage, that input becomes something an attacker can shape to corrupt the verdict itself. This workshop treats the document as an adversarial surface aimed at the analyst’s tooling, including the analyst’s AI.

It is hands-on, starting from basic command-line tools, participants build the techniques that defeat AI-assisted triage, then build triage that survives them: a prompt injection placed where no human reader sees it, a metadata and ToUnicode parser differential where the renderer and the extractor disagree on the same glyphs, and a staged payload the document never reveals on its own. The two contributions that carry the workshop are treating extractor disagreement as a detection signal, and a triage architecture where a deterministic stage owns the verdict and the model is confined to advisory roles downstream of it.

Participants leave with a working pipeline, the sample set, and a scoring harness, and can state exactly where a language model belongs in triage and why putting it anywhere else is the vulnerability. The pipeline runs locally on modest models, because the detection power is in the tooling, not the model. Clean files never leave the environment.

Outline Deterministic floor. Point an autonomous agent at a file, watch an indirect injection in the document hijack it. That failure is the problem statement. Participants then lay the structural floor with pdfid and pdf-parser: the facts an attacker cannot phrase their way out of.

Demote the model. Analyze a malicious PDF structurally, then watch a hidden render-mode injection talk a naive model pipeline into a clean verdict. Rebuild it so a deterministic stage owns the verdict and the model is fed structural findings, not the attacker’s prose. Rule: extracted content is untrusted input, never instruction.

Add redundancy: the parser differential. Two documents that defeat detection by placement alone: an injection living in metadata a body-text extractor never reads, a ToUnicode trick that makes the rendered page and the extracted text disagree on identical glyphs. Participants build a multi-extractor differential and treat disagreement as the alert.

Resolve, and place the model. A staged payload forces the last lesson: Participants add input validation and type-confusion detection at the floor, extract the hidden artefact as a suspicion finding, decode it in-terminal, and let bounded model roles explain it and assemble competing hypotheses with evidence while the analyst decides. The model advises downstream of a deterministic gate, never holds the verdict.

Capstone CTF and Q&A. A fresh set: technique-carriers, clean decoys, and documents styled as beingenin PDFs Sthat baits the analyst into pasting it straight into the model. Participants show their work: verdict, technique, extraction path, hidden URLs, execution behaviour. Scoring rewards correctness first, then fewest tokens, because the analyst who needed the model least played the strongest game.

Learning objectives Participants will be able to: 1. Build a PDF triage pipeline from command-line tools and explain exactly where its verdict comes from. 2. Analyze a malicious PDF structurally (pdfid, pdf-parser, stream inspection) and decode embedded artefacts in-terminal. 3. Construct and recognize the three adversarial-document techniques that defeat AI-assisted analysis: hidden-layer prompt injection, metadata and ToUnicode parser differentials, and staged payloads. 4. Distinguish an early structural suspicion verdict from a late analytical identification verdict, and treat extractor disagreement as a detection signal. 5. Place a language model in bounded advisory roles downstream of a deterministic gate, never holding the verdict, and select the right model for each task. 6. Run the whole pipeline locally on modest models, understanding why the detection power lives in the tooling and why the architecture is private by construction.

People:
    SpeakerBio:  Klaus Wunder, Principal Cyber Defence Analyst at SECUINFRA

With nearly two decades in cybersecurity, Klaus has gone from configuring firewalls to protecting industrial control systems where breaches cost safety, not just data. That journey gives him a full-spectrum perspective on security operations. He guides teams through complex incidents and builds detection engineering capabilities across hybrid environments as a Principal Cyber Defence Analyst, while his role as an Authorized OffSec Instructor, Ambassador keeps him equally focused on developing the next generation of analysts. His current work explores how Large Language Models can revolutionize cyber defence with practical applications, not hype. He recently launched The Analyst Mind on Substack (theanalystmind.io), where he writes about analytical thinking, critical frameworks, and the evolving analyst mindset.

Creator: Recon Village

North Korean threat actors are running one of the largest software supply chain campaigns ever observed in the npm ecosystem, and the infrastructure hiding it in plain sight is discoverable through open-source reconnaissance alone.

This workshop walks participants through how we mapped a live DPRK delivery network targeting cryptocurrency developers, starting from a single malicious npm package and expanding outward to uncover 50+ malicious packages, 100+ GitHub repositories, 30+ throwaway npm personas, 20+ rotating C2 domains, and a social media promotion layer spanning X and Reddit.

The investigation surfaces three malware families: PromptMink, ClipViper, and OtterCookie, which operate through what initially appeared to be separate campaigns but share overlapping infrastructure, actors, and delivery techniques.

The workshop focuses on the recon methodology behind the mapping through six hands-on modules:

• Dependency chain tracing: How malicious payloads hide one to three hops deep in transitive npm dependencies, evading surface-level code review and automated scanners

• Actor network pivoting: Using email patterns, SSH key reuse, shared C2 infrastructure, and build artifact fingerprints to link 30+ throwaway npm accounts into operational clusters

• Identity spoofing detection: How to catch developer identity theft through timezone offset analysis

• GitHub delivery front reconnaissance: Tracing 40+ fork chains across front organizations all serving identical malicious payloads behind bot-inflated star counts and SEO-stuffed descriptions

• Social media promotion mapping: Connecting verified X accounts and Reddit personas to the distribution layer, and observing how the social infrastructure persists even after GitHub takedowns

• Evasion tracking in real time: Documenting the operators’ shift from obfuscated JavaScript to on-chain payload storage via Solana, where the npm package contains zero malicious code and the payload lives in a blockchain account beyond the reach of static analysis

Participants work directly with actionable IoCs (packages, C2 domains, SSH keys, YARA rules, detection queries) and leave with a breakdown of how current Contagious Interview and Contagious Trader toolsets are converging into a unified threat.

Attendees will leave with a repeatable framework for mapping supply chain malware delivery networks using open-source data: package registries, Git metadata, DNS records, social media artifacts, and cross-referencing with community threat feeds.

People:
    SpeakerBio:  Alessandra Rizzo
No BIO available
SpeakerBio:  Ariel Ropek
No BIO available

Creator: AppSec Village

This workshop introduces the practical world of threat modeling, combining hands-on exercises and real-world scenarios. In particular, we will focus on how AI can enhance your threat modeling work plus introduce the basics of securing AI systems.

We will review some of the latest threat intelligence and attack methods projected for 2026/2027, including vulnerabilities in LLMs and Agentic AI. Participants will engage in practical exercises inspired by real industry projects, such as integrating threat modeling into security-by-design and DevOps/MLOps workflows. Key features include threat-informed defense using MITRE frameworks such as ATLAS for real-world analysis, leveraging threat intelligence libraries to deepen threat understanding, and addressing modern challenges.

By the end of this workshop, you will walk away not just with knowledge but also the ability to start practicing threat modeling effectively in your organization.

Links:
    Registration – https://www.zeffy.com/en-US/ticketing/introduction-to-ai-enhanced-threat-modeling-workshop

People:
    SpeakerBio:  Robert Hurlbut

Robert brings over 30 years of experience in secure coding, software architecture. Robert started and led the threat modeling program at Bank of America, filled in a similar role at Aquia and was a trainer and coach at Toreon. He is passionate about helping teams identify, communicate, and understand threats and mitigations and enhance workload security through threat modeling.

Robert is a Microsoft MVP for Developer Security and an ISC2 Certified Secure Software Lifecycle Professional (CSSLP). He holds a Master of Science in Cyber Security from Southern New Hampshire University and is a Ph.D. candidate in Space Cybersecurity at Capitol Technology University.

Robert is co-author of the Threat Modeling Manifesto (https://www.threatmodelingmanifesto.org/), Threat Modeling Capabilities Model (https://www.threatmodelingmanifesto.org/capabilities), and co-host of the Application Security Podcast (https://appsec.buzzsprout.com/).

Creator: Malware Village

In this workshop, Dr. Wesley McGrew will be presenting a live and unscripted introduction to using Ghidra to reverse engineer real malware samples, targeting people who are new to malware reverse engineering, but have some programming background.

Dr. McGrew will cover the Ghidra user interface, how to load samples, perform initial processing, and how to navigate around a malicious binary. Then, for most of the workshop time, he will provide commentary, advice, heuristics, and approaches for malware analysis as the workshop group takes a look at one or more samples live on the projector.

This workshop is meant to be interactive, driven by attendee questions and interests. Beyond the essentials needed to load malware into Ghidra, the workshop attendees and Dr. McGrew will be collaborating on the direction of the workshop material.

People:
    SpeakerBio:  Wesley McGrew, Senior Cyber Fellow at MartinFed

Dr. Wesley McGrew directs research, development, reverse engineering, and offensive cyber operations as Senior Cybersecurity Fellow for MartinFederal. He has presented at DEF CON and Black Hat USA on topics of penetration testing, malware analysis, critical infrastructure, and vintage computing, and has taught self-designed courses on reverse engineering and cyber operations at Mississippi State University. Wesley has a Ph.D. in Computer Science from Mississippi State University for his research in vulnerability analysis of SCADA HMI systems. He has entertained audiences at many DEF CON parties as a house music DJ, as well.

Creator: Payment Village

The Payment Village set out to design a badge that represents a purposefully vulnerable ATM for educational use. Providing conference attendees with access to a real ATM is impractical due to its size, weight, and limited accessibility. Instead, the badge offers a portable ATM-inspired platform, available to all, that simulates real-world attack surfaces through interactive challenges. We have five prototypes available to try!

To extend its value beyond DEF CON, the badge will be supported by an online platform featuring learning resources, firmware updates, and community support via a website and Discord. We also have a life-size version of the badge as a fully interactive ATM demonstration for attendees to interact with in the village

People:
    SpeakerBio:  Vincent Sloan, Software Engineer, GoFundMe

20+ years of experience in payments, spanning e-commerce and crowdfunding; currently leads payments engineering at GoFundMe.

Creator: Noob Community

Before you can secure the web, you have to understand how to break it. This 90-minute hands-on session completely bypasses the static slides to give you a practical, interactive introduction to web exploitation. Led by Roman Bohuk, CEO of SkillBit (formerly MetaCTF), you will explore the core technologies that power the web and learn proven, real-world attack methodologies. Whether you are aiming to break into professional web application penetration testing or just looking to sharpen your CTF skills, you’ll get dirty with live vulnerabilities, learn how modern web targets are enumerated, and walk away with a solid, actionable foundation in offensive web security.

People:
    SpeakerBio:  Roman Bohuk
No BIO available

Creator: IoT Village

2 Mini-Workshops, Only 15 Minutes Each: QEMU: Emulate Your ‘Things’ – Hack a Drug Lord’s Smart Toilet; Encryption! What Encryption? – Decrypt TLS Traffic with mitmproxy. No Schedule.

Links:
    More Info – https://iotvillage.org/events/defcon-34/index.html

Creator: Blacks In Cyber Village

Join B.I.C. Village for KaliGPT Vibe-Ethical Hacking Session, a welcoming session focused on hands-on ethical hacking concepts, Kali Linux workflows, and responsible security learning. Come ready to learn, ask questions, and connect with the community.

People:
    SpeakerBio:  Timothy E. Bates, Professor of Practice, University of Michigan / Fractional CTO

Timothy E. Bates, also known as “The Godfather of Tech,” is a distinguished cybersecurity professional and educator. Discovered as a hacker at age 13 by the U.S. Marshals Service, he was later recruited by the U.S. Government to train on tracking digital pirates and hackers. He brings over 40 years of experience in the tech industry, with extensive expertise in Artificial Intelligence (AI), Blockchain, and Immersive Technologies. His career includes significant roles as Chief Technology Officer (CTO) at Global Fortune 200 companies like Lenovo and General Motors. Timothy currently serves as a Professor of Practice in the College of Innovation & Technology at the University of Michigan-Flint and as a Fractional CTO. He has received numerous accolades, including the BEYA Black Engineers Association Award: Modern-Day Technology Leader.

Creator: OWASP Foundation

The fences on Apex Island were supposed to keep its visitors safe, but one hacker turned this theme park into a containment failure…with teeth. You’ll use the ASVS secure coding standard to identify and patch vulnerabilities in a lab app, bringing each park facility back online using our rigorous approach to code review. Bring a Docker-capable laptop with GitHub access; bonus if you know your way around a Unix system.

Links:
    Register here – https://luma.com/5geigcgf

People:
    SpeakerBio:  Eden Yardeni, OWASP Contributor, SecureHabits

Eden Yardeni is an application security specialist and OWASP contributor who joined the ASVS working group in 2024. She previously worked as a full-stack developer, but moved into AppSec when she heard there’d be cookies.

Creator: Scambait Village

Hands-on workshop focused on live scambaiting calls. Participants can observe, learn techniques, and join in on calls under guidance from experienced scambaiters. Covers safety practices, common scam types, tools, and real-time interaction strategies. Open to all skill levels. This is not a contest, but standout calls may earn a donated training course, handed out by village staff at their discretion at the end of the session.

Links:
    scambaitvillage.org/join – https://scambaitvillage.org/join

Creator: IoT Village

Want to create a beautiful, squishy, and cute Wi-Fi controllable cat lamp? In this class, we’ll put together a ‘Purrsheen’ cat shaped Wi-Fi lamp. Kit Cost: $60. Class Cap: 30.

Links:
    Friday Purchase & Registration – https://retia.io/products/hope-make-your-own-evil-iot-cat-lamp-with-wled
    Sunday Purchase & Registration – https://retia.io/products/defcon-day-2-make-your-own-evil-iot-cat-lamp-with-wled

People:
    SpeakerBio:  Nick
No BIO available

Creator: IoT Village

Meshtastic is a long range, encrypted, off-grid mesh protocol that features many powerful modules, configurations, and settings. Kit Cost: $140. Class Cap: 30.

Links:
    Friday Purchase & Registration – https://retia.io/products/defcon-day-1-mesh-nets-for-hackers-how-when-to-use-meshtastic-meshcore-reticulum
    Saturday Purchase & Registration – https://retia.io/products/defcon-day-2-mesh-nets-for-hackers-how-when-to-use-meshtastic-meshcore-reticulum

People:
    SpeakerBio:  Kody Kinzie
No BIO available

Creator: Noob Community

AI went from a tech toy to critical infrastructure overnight, but measurement is lagging behind. This 90-minute session skips the theory to show how AI actually performs using OASIS – a free, independent benchmarking tool you can run right from your phone.

People:
    SpeakerBio:  Marshall Livingston
No BIO available

Creator: OSINT For Good Community

An opportunity to ask questsions and get clarification on things that happened during the CTF.

People:
    SpeakerBio:  Trace Labs Staff
No BIO available

Creator: OWASP Foundation

The OWASP Amass Project has become a foundational toolset for security researchers, bug bounty hunters, red teamers, and defenders who rely on automated reconnaissance and external asset discovery to map attack surfaces. With the release of Amass v5.0, the project has undergone a major architectural transformation centered around the Open Asset Model (OAM)—a structured property graph that defines how Internet-facing assets and their relationships are stored, analyzed, and queried.

This two-hour hands-on workshop, led by Jeff Foley, the project’s founder and long-time maintainer, offers attendees a first look at Amass v5.0’s new intelligence collection engine, which seamlessly populates the Open Asset Model database during enumeration operations. The session will walk through how Amass collects and organizes OSINT from various sources—including DNS records, WHOIS/RDAP data, TLS certificates, and more—and models the results as a dynamic graph of properties and relationships between discovered assets.

Participants will learn to use core Amass tools such as:

amass enum – for deep, recursive asset discovery using passive and active techniques

amass subs – for quick subdomain discovery from the Open Asset Model database

amass viz – to render interactive visualizations of asset relationships in the Open Asset Model

In addition to these staples, the workshop will introduce the new assoc tool, a powerful query interface designed to unlock the true potential of the Open Asset Model database. Built around a custom Triples query language, the assoc tool enables users to describe paths—called association walks—through the asset graph, surfacing linked insights across related properties (e.g., domains associated with a network, IPs linked to DNS records, etc.). The language is inspired by RDF-style triples but optimized for simplicity and clarity in cybersecurity investigations.

Amass v5.0 also ships with completely refactored documentation, providing diagrams to help users understand the data types, their fields, and their associations within the OAM. This new documentation dramatically lowers the learning curve for users new to the Amass Project, making it easier to build mental models of how different types of Internet assets are discovered and interrelated.

This workshop will include a live walkthrough of setting up and running Amass v5.0, from enumeration to advanced queries. Participants will leave with hands-on experience using the full Amass suite, understanding how the Open Asset Model works under the hood, and writing association walk queries using Triples.

What to Expect:

Real-world reconnaissance examples using Amass against publicly available targets

Query design exercises with assoc to extract actionable intelligence

Tips for integrating Amass data into your own tooling and pipelines

Visual mapping of organizational assets using OAM and viz

Level: Intermediate Some experience with OSINT tools, command-line interfaces, or network security is recommended but not required. The workshop is designed to be self-contained and accessible.

Attendees are encouraged to bring a laptop and follow along. Project contributors will be present throughout the session to provide hands-on support, answer questions, and help troubleshoot issues in real time, making this a highly interactive experience.

By the end of the session, participants will walk away with practical skills in reconnaissance, data extraction from structured asset models, and a solid understanding of how Amass v5.0 is redefining modern Internet-wide discovery.

Join us at DEF CON to explore the future of OSINT automation and asset intelligence with OWASP Amass!

Links:
    Register here – https://luma.com/n6t7cuqm

People:
    SpeakerBio:  Jeff Foley, Founder and Project Leader at OWASP Amass Project
No BIO available

Creator: OWASP Foundation

Step into the world of ethical hacking and uncover the unseen vulnerabilities hiding inside everyday connected devices. This immersive, beginner-friendly lab teaches IoT security the way professionals actually practice it — using the OWASP IoT Security Testing Guide (ISTG) as your map — wrapped in an approachable Capture-the-Flag format, and led by the team that authors and field-tests the methodology.

No experience necessary. Just bring your curiosity. Whether you’re a student, a tech enthusiast, or someone eyeing a cybersecurity career, this session makes real device hacking accessible, hands-on, and genuinely fun.

Working against a custom-built networking device, you’ll follow the ISTG methodology from the outside in. You’ll start at the hardware: reading and interpreting physical signals to locate and identify an exposed UART interface (ISTG-PHY, ISTG-INT) — the kind of serial debug port that, in real-world assessments, hands attackers an unauthenticated root shell within minutes of opening the enclosure. Unlocking that interface opens a cyber range where you’ll pivot through firmware secrets (ISTG-FW), then practice attacks at the network and application layers — each flag mapped back to an ISTG test-case category, so you leave understanding not just how you got in, but how the risk is classified and defended.

By the end, you’ll have a repeatable, standards-based mental model for testing any connected device — and a firsthand look at the most overlooked risks living inside the networks we all rely on.

Links:
    Register here – https://luma.com/zpp2nq09

People:
    SpeakerBio:  Piero “p33_p33_” Picasso, Senior Security Leader at Cisco

Piero Picasso (p33_p33_) is a Senior Security Leader for Device Penetration Testing at Cisco, where he leads security testing for network infrastructure and IoT devices. Based in the Fort Lauderdale area, he brings over 20 years of experience in offensive security, penetration testing, and product security engineering. Over five-plus years at Cisco — including as Offensive Security Leader at Cisco Meraki — he built and scaled security testing programs for cloud-managed networking products. Earlier, he assessed Fortune 500 clients as a penetration tester at Secureworks and led ethical hacking within Citi’s regulated financial environment. He continues to advance Cisco’s device security posture through hands-on testing methodologies and cross-functional security research.

SpeakerBio:  Aaron Guzman, Project Leader at OWASP

Aaron Guzman is CISO of Cisco Network Product Engineering, the organization responsible for securing Cisco’s enterprise and industrial networking portfolio — from wireless access points, routers, and switches to IoT cameras and sensors — much of the infrastructure that moves the world’s data. He is the author of the IoT Penetration Testing Cookbook and a technical reviewer for Practical IoT Hacking and Bug Bounty Bootcamp. As OWASP’s IoT Project Leader, he leads the IoT Security Testing Guide (ISTG) — the very methodology at the heart of this lab. He started as a hacker, driven by a curiosity to take things apart and make them do what they were never designed to — a curiosity that now scales across hardware, firmware, supply chains, and software at enterprise scale.

Creator: Payment Village

Join us to discover some of the highlights of the Payment Village at DEF CON

Creator: La Villa Community
PentestGPT: The Art of Hacking with Words regresa a DEF CON, esta vez como un workshop completamente práctico. Luego de presentar el año pasado cómo los LLMs comenzaban a transformar la seguridad ofensiva, esta nueva edición lleva la experiencia al siguiente nivel: no solo será escuchar de este proyecto, lo podrás crear y ejecutar en tu entorno favorito.

Durante 100 minutos, los participantes trabajarán directamente con PentestGPT y PentestGPT 2.0 para aprender cómo integrar IA en flujos reales de pentesting. A través de ejercicios guiados y escenarios ofensivos realistas, explorarán reconocimiento asistido por IA, generación de attack paths, análisis de hallazgos, prompt engineering ofensivo y validación técnica de resultados.

Más allá de usar una herramienta, el workshop propone un cambio de mentalidad: entender cómo pasar de ejecutar tareas manuales a orquestar inteligencia ofensiva.

People:
    SpeakerBio:  Matias Armándola, Cybersecurity Lead, Proffesor and Speaker

I’m Mati Armándola, an Information Security leader with over 20 years of experience in technology and more than a decade dedicated exclusively to asset protection, regulatory compliance, and organizational culture.

I have led teams and projects in companies with regional reach and have participated as an international speaker at conferences such as Ekoparty, DevOpsDays, Nerdearla, and DEF CON, addressing topics such as offensive security, awareness, applied AI, and governance.

In addition to my work as a teacher at various institutions and educational platforms, training the next generation of professionals in security, cloud computing, and leadership.

My motto is LEAD – TEACH – PROTECT

Creator: IoT Village

In this hands-on workshop, we’ll turn an ESP8266 into a self-contained Wi-Fi pocket server that anyone nearby can connect to without the internet. Kit Cost: $80. Class Cap: 30.

Links:
    Saturday Purchase & Registration – https://retia.io/products/defcon-day-2-playing-with-hyper-local-pocket-sized-servers

People:
    SpeakerBio:  Brandon
No BIO available

Creator: OWASP Foundation

How do you actually verify that an AI system is secure? In this workshop, the AISVS project leads walk through practical assessment scenarios using the OWASP AI Security Verification Standard. We’ll work through real requirements from chapters on prompt injection defense, agentic action security, RAG/vector database hardening, and output safety controls, showing what “verify that” looks like in practice against running systems. Participants will leave with a working understanding of how to scope an AI security assessment, select appropriate verification levels, and apply AISVS requirements to LLM-based applications, autonomous agents, and MCP-connected tool ecosystems. Bring a laptop if you want to follow along.

Links:
    Register here – https://luma.com/3jqf6wrg

People:
    SpeakerBio:  Jim Manico, Founder at Manicode Security

Jim Manico is the founder of Manicode Security, where he specializes in training software developers on secure coding and security engineering. He is actively involved in multiple ventures, serving as an investor/advisor for companies like 10Security, MergeBase, Nucleus Security, KSOC, and Inspectiv, among others. Jim is a recognized speaker, focusing on secure software practices, and holds a distinguished position as a member of the Java Champion community. He is also the esteemed author of “Iron-Clad Java: Building Secure Web Applications” published by Oracle Press.

Additionally, Jim generously volunteers for the OWASP foundation, co-leading key projects such as the OWASP Application Security Verification Standard and the OWASP Cheatsheet Series.

Creator: Noob Community
The Ginger Hacker Initiative and CompTIA are teaming up for an interactive session focused on the three critical dimensions of AI cybersecurity: securing AI systems, securing with AI, and governing AI. Built directly around the new CompTIA SecAI+ course, this workshop completely bypasses the fluff to focus entirely on real-world application.

People:
    SpeakerBio:  James Stanger
No BIO available
SpeakerBio:  Stephen Schneiter
No BIO available

Creator: AppSec Village

Prompt injection has rapidly emerged as one of the most critical and least understood vulnerabilities in modern application security. As organizations race to integrate LLMs into customer-facing products, internal tools, and autonomous agents, attackers are already exploiting these systems in ways traditional security controls were never designed to catch. This one-day, hands-on training gives attendees a thorough, practical understanding of prompt injection — from basic chatbot manipulation to sophisticated attacks against RAG pipelines and autonomous AI agents. Using a purpose-built lab environment, attendees will exploit real vulnerabilities in LLM-powered applications, understand exactly why they work, and then build effective defenses against them. The course is structured as an attack-first, defend-second journey. By experiencing these vulnerabilities as an attacker, attendees leave with deep intuition about where AI systems.

Links:
    Registration – https://www.zeffy.com/en-US/ticketing/prompt-injection-attacking-and-defending-ai-powered-applications

People:
    SpeakerBio:  Mohammed Ilyas Ahmed

I am a seasoned security and DevSecOps professional with deep expertise in helping organizations strengthen their security posture across modern, cloud-native environments.

I am an active contributor to the global technology community and a frequent speaker at leading industry conferences and platforms, including DEF CON, Black Hat, KubeCon (Paris), ISACA, IANS, and Wallarm, among others. I am also regularly invited to serve as a technical session judge.

publishing work that advances discussions around modern security practices, governance, and risk management. I am also a distinguished member of the Harvard Business Review Advisory Council.

My work has a global reach through my role as a Member of the Global Advisory Board at VigiTrust Limited (Dublin, Ireland).

I am the author of Cloud-Native DevOps, a practical guide to building scalable, reliable, and secure cloud-native applications.

Creator: IoT Village

Encrypted IoT firmware doesn’t have to be a dead end. In this hands-on workshop, we’ll reconstruct a real vendor’s firmware decryption pipeline without ever touching the hardware…

Links:
    More Info – https://iotvillage.org/events/defcon-34/index.html

Creator: Noob Community

This 2-hour, hands-on training is built around redStack – the open-source AWS project Mike developed to stand up a red team environment on demand. One Terraform command deploys an entire operator stack: three C2 frameworks (Mythic, Sliver, and Havoc), Kali and Windows hosts, a redirector, and a Guacamole portal.

People:
    SpeakerBio:  Michael Ortiz

Michael Ortiz is a Red Team Engineer and SME on the U.S. Department of State’s Red Cell, running adversary emulation across State enterprise and partner networks. His focus spans offensive tradecraft, evasion engineering against modern EDR’s, and the cybersecurity engineering behind durable red team infrastructure. He’s the founder of devZero Security, an SDVOSB offering offensive security and security engineering services to federal and commercial clients, and the developer of redStack, an open source AWS and Terraform project that stands up a full red team operations stack on demand. A Marine Corps veteran, Mike holds OSEP, OSCP, CRTO, and CRTL, among other certifications.

Creator: AppSec Village

Software supply chain attacks are no longer limited to outdated, vulnerable, or compromised open-source libraries. Today, attackers target developers directly by poisoning package ecosystems, abusing build pipelines, exploiting IDE extensions, and increasingly manipulating AI-assisted coding workflows.

In this interactive two-hour workshop, Tanya Janca will break down the modern software supply chain, what has changed, and why traditional DevSecOps approaches are no longer enough. Participants will learn how attackers think, how developer behavior is being exploited, and what practical controls actually reduce risk (without slowing teams down too much!).

The session covers the next evolution of DevSecOps tooling and practices, explores emerging threats including AI-generated dependency confusion, and provides concrete guidance for securing the developer environment, from IDEs to sandboxes to CI systems.

Links:
    Registration – https://www.zeffy.com/en-US/ticketing/supply-chain-isnt-just-dependencies-anymore-defending-developers-tooling-and-builds

People:
    SpeakerBio:  Tanya “SheHacksPurple” Janca

Tanya Janca, known online as SheHacksPurple, is the best-selling author of Alice and Bob Learn Secure Coding and Alice and Bob Learn Application Security. She is the CEO of She Hacks Purple Consulting, where she delivers high-impact, live, secure-coding training for engineering teams. She is also the host of DevSec Station Podcast.

Over 29 years in the industry Tanya has received numerous awards, spoken at events worldwide, and built a reputation as one of the most approachable and influential voices in application security. She has trained thousands of developers and security practitioners through her academies and live programs. Her experience includes counter-terrorism work, leading security for the 42nd Canadian federal election, as well as building and securing a vast range of applications. Today, she is recognized internationally as a leading authority on the security of software.

Creator: Malware Village

4 hour workshop. 1hr Lecture on trojan creation. Followed by 2 hrs hands on practice creating trojans, setting up malware servers. Using C## loaders and malicious dll’s to trojanise normal programs with ransomware. Instructor aide and easy to follow instructions throughout.

1 hr CTF. Students will develop their own new trojan containerize it and send to our victim computer. Prizes.

People:
    SpeakerBio:  Leigh Gilbert, Malware village

Leigh Trinity is a Canadian exploit developer, red team hacker, and instructor known for her work in binary exploitation and reverse engineering. Now branching out into malware development.

Creator: Recon Village

Attack Surface Management (ASM) lives or dies on a deceptively simple question: who owns this? Without reliable attribution, an asset inventory is just a pile of hosts, domains, certificates, and cloud endpoints—with no defensible way to scope an organization’s true digital footprint or separate first-party infrastructure from vendors, subsidiaries, acquisitions, joint ventures, and brand portfolios.

This talk dives into the real-world challenge of attributing internet-exposed assets to legal entities, not just names. Corporate identity is messy: organizations operate under trade names, localized spellings, legacy names, and jurisdiction-specific registrations. Meanwhile, the internet leaks ownership signals through fragmented, lossy metadata—RDAP/WHOIS, certificate subject/issuer fields, ASN registrations, DNS TXT verification records, trademark references, and public corporate registries. Each source is incomplete on its own; together they can still conflict, drift over time, and create duplicate “identities” that quietly degrade attribution accuracy.

Using the OWASP Amass Project as a concrete reference point, we’ll walk through an attribution-centric discovery workflow: collecting signals, normalizing entity identity, resolving aliases across jurisdictions, and scoring confidence to decide when to merge, when to split, and when to escalate for analyst review. We’ll also explore how attribution errors propagate into ASM outcomes—missed scope, false positives, and blind spots in third-party exposure—and how disciplined entity modeling can turn noisy OSINT into a repeatable system of record.

Attendees will leave with practical techniques for improving attribution quality, a mental model for entity resolution, and actionable ideas for making ASM outputs trustworthy enough to drive risk decisions.

People:
    SpeakerBio:  Jeff Foley, Founder and Project Leader at OWASP Amass Project
No BIO available

Creator: Malware Village

Some backdoors are noisy. Others whisper.

During a real-world Incident Response investigation, I uncovered an unusually stealthy Linux persistence mechanism that had silently granted an attacker continued access to a compromised system. Even more concerning – it was used to establish an SSH tunnel, allowing undetected remote control while evading traditional security measures.

But that wasn’t all. Further analysis led to an even bigger discovery: a live Mirai botnet infection, actively communicating with its command-and-control server. By reverse engineering the malware, I unraveled how it spread, operated, and executed attacks.

This talk is a practical, real-world case study, covering: * How I uncovered an unconventional backdoor that nearly went unnoticed. * The attacker’s use of SSH tunneling for covert persistence. * Reverse engineering a Mirai botnet sample and dissecting its attack mechanisms. * Key lessons for defenders to detect and respond to stealthy threats.

Expect live demonstrations, technical deep dives, and actionable insights to strengthen your EDR detection capabilities.

People:
    SpeakerBio:  Uriel Kosayev, Security Researcher, Trainer & Speaker | Author of the Antivirus Bypass Techniques book | Founder of TrainSec Academy

Uriel Kosayev is a seasoned cybersecurity researcher, reverse engineer, and keynote speaker with over a decade of hands-on experience in malware analysis, offensive security, and real-world incident response.

He is the founder of TrainSec Academy and the author of Antivirus Bypass Techniques and MAoS – Malware Analysis on Steroids, two highly regarded resources in the cybersecurity community. Uriel has worked with global enterprises, led red team operations, and conducted high-impact malware investigations that exposed advanced threat actor tactics.

Known for his ability to break down complex topics into practical, actionable knowledge, Uriel teaches with one goal in mind: to make professionals think like attackers and act like defenders. His courses are packed with real-world examples, battle-tested techniques, and a methodology built on actual field experience, not textbook theory.

Creator: Recon Village
Your mission: Stop chasing single indicators and start profiling the actual behavior of the adversary. From cybercriminals to state-sponsored actors, every threat group leaves a unique operational blueprint. Whether you are an OSINT hobbyist or an experienced cyber intelligence analyst, come ready to dissect real-world attack behaviors, translate data into actionable insights, and master the art of OSINT-powered TTP research.

This hands-on workshop explores the world of cyber threat actors and the open-source intelligence (OSINT) methodologies used to unmask their behavioral patterns. Rather than focusing strictly on fleeting indicators of compromise (IoCs) like file hashes or IP addresses, participants will learn how to extract, analyze, and profile an adversary’s true Tactics, Techniques, and Procedures (TTPs).

Through interactive, real-world case studies, attendees will learn how to analyze public incident reports, open intelligence repositories, and external datasets to map out an actor’s operational playbook. Using frameworks like MITRE ATT&CK and the Diamond Model, participants will practice pivoting from technical data to strategic threat profiles—equipping them with the research skills needed to predict and counter adversarial behavior without ever needing an enterprise budget.

Workshop Structure:

Module 1: Foundations of Threat Intelligence & Actor Profiling

The Threat Landscape: Definitions and categories of actors (APTs, cybercriminals, hacktivists, insiders).

Understanding Adversarial Motivation: Moving beyond what happened to why and how actors select their targets and techniques.

Intelligence Categorization: Differentiating between Strategic, Operational, and Tactical/Technical intelligence, and how TTP research feeds all three.

Module 2: The Analytical Frameworks

MITRE ATT&CK Deep Dive: Navigating the matrix, understanding sub-techniques, and avoiding common mapping pitfalls.

The Diamond Model: Connecting the four core nodes (Adversary, Capability, Infrastructure, Victim) to tell a complete campaign story.

The Pyramid of Pain: Understanding why tracking TTPs inflicts the maximum cost on the adversary compared to trivial indicators.

Module 3: Dissecting the Data (Case Study Analysis)

Deconstructing DFIR Reports: Walking through real-world incident examples (e.g., Gootloader campaigns, ransomware operations) to extract behavioral indicators from public write-ups.

Safe Analysis Practices: Utilizing basic web-based OSINT tools (urlscan.io, Browserling, CyberChef) to safely evaluate delivery mechanisms and landing pages without compromising investigator safety.

Module 4: Live TTP Research (Group Exercise)

The Scenario: Groups are given an initial, ambiguous threat brief or a raw dataset from a recent campaign.

The Analysis: Using open-source resources, teams will collaborate to identify the actor’s threat components (who, what, where, when, how, why).

The Playbook: Teams will map their findings into the MITRE ATT&CK Navigator, build a comprehensive threat intelligence profile, and present their adversarial playbook to the room.

People:
    SpeakerBio:  Marcelle Lee
No BIO available
SpeakerBio:  Will Thomas
No BIO available

Creator: OSINT For Good Community

Learn how to optimize your OSINT workflow and strengthen your performance in the Trace Labs Search Party CTF and beyond. . This session will cover core strategies, ethical guidelines, and preparation methods to help you operate confidently, efficiently, and responsibly in a real-world investigative environment. Normally offered as a paid webinar, this session is lead by a Trace Labs Director and earns a digital badge that is part of the Trace Labs webinar series.

People:
    SpeakerBio:  Sarah “scba” Miller, Trace Labs

Dr. Sarah Miller is a college professor, emergency manager, cybersecurity manager, and a Director for Trace Labs.

Creator: OSINT For Good Community

Join us for an immersive online seminar with the Reporting Team Department Head at Trace Labs, as he walks through real missing person investigations from the Trace Labs CTFs. This session moves beyond foundational OSINT concepts and focuses on how investigations unfold in practice, from a single starting point to the development of actionable, ethically collected intelligence. Participants will follow detailed case walkthroughs drawn from Trace Labs Search Party CTF events, highlighting how analysts:

Pivot from initial clues across platforms and ecosystems Identify meaningful signals of activity Provide actionable intelligence

Normally offered as a paid webinar, this session earns a digital badge that is part of the Trace Labs webinar series.

People:
    SpeakerBio:  Brent Louie, Reporting Team Lead at Trace Labs

Brent Louie is the Reporting Team Lead at Trace Labs and an Associate Director of Data Science with more than 15 years of experience in the biotechnology industry. He focuses on applying OSINT methodologies to missing persons investigations and helping transform crowdsourced research into actionable investigative leads for law enforcement.

Creator: OSINT For Good Community

Need help installing or using the Trace Labs Virtual Machine? Bring your laptop and sit down for some one-on-one help from one of our volunteers.

Creator: Recon Village

Everyone is talking about vibe coding, but most examples stop at TODO apps, landing pages, or simple CRUD applications. This workshop goes far beyond that.

Participants will use modern AI coding agents to build a real-world Open-Source Intelligence (OSINT) platform from scratch designed to aggregate and visualize intelligence data on an interactive 3D globe.

Rather than simply watching a demo, attendees will actively build the application alongside the instructor while learning the mindset, prompting techniques, and engineering workflow required to successfully collaborate with AI coding assistants.

The workshop begins with the fundamentals of vibe coding: what it actually is, why it works, where it fails, and how to communicate effectively with AI agents. Participants will learn practical prompting strategies, iterative development techniques, and methods for breaking large software systems into manageable tasks that AI can successfully implement.

From there, we’ll progressively build an intelligence dashboard capable of consuming and visualizing multiple real-time OSINT sources, including flight tracking, satellite positions, earthquake feeds, maritime traffic, and other publicly available intelligence signals. Along the way, participants will generate modern user interfaces, integrate external APIs, debug AI-generated code, and learn when to trust the model and when not to.

Rather than treating AI as a code generator, this workshop teaches attendees how to use AI as an engineering partner capable of dramatically increasing development velocity while still maintaining high-quality software.

By the end of the workshop, every participant will have:

1. A working open-source intelligence platform running locally

2. A practical workflow for building complex software using AI coding agents

3. A reusable prompting framework applicable to future projects

4. Experience integrating multiple public OSINT data sources

5. An understanding of the strengths and limitations of AI-assisted software development

6. A roadmap for continuing to extend the platform after the workshop

The workshop is based on the open-source project: https://github.com/Alevsk/respondent-community

Workshop Outline (150 Minutes)

Part 1 — Introduction to Vibe Coding (20 min)

• What vibe coding actually means

• Mental models for collaborating with AI

• Selecting the right AI model for the task

• Understanding agentic coding workflows

• Common mistakes and misconceptions

---

Part 2 — Prompt Engineering for Software Development (25 min)

• Structuring prompts that produce maintainable code

• Breaking large systems into incremental tasks

• Designing software through conversation

• Iterating instead of regenerating

• Knowing when to intervene manually

---

Part 3 — Building the Intelligence Platform (75 min)

Participants will build the platform together while learning how to:

• Generate a modern frontend

• Create a real-time 3D globe visualization

• Integrate multiple public OSINT APIs

• Display flights, satellites, earthquakes, ships, and additional intelligence feeds

• Build reusable UI components with AI

• Debug AI-generated code

• Refactor and improve generated implementations

• Continue extending the application using AI as a development partner

---

Part 4 — Lessons Learned & Advanced Techniques (20 min)

• What AI does well

• Where AI still struggles

• Managing technical debt

• Building larger projects with AI

• Cost optimization strategies

• Recommended workflows and tooling

• Future directions for AI-assisted engineering

People:
    SpeakerBio:  Lenin Alevski, Security Engineer at Google

Lenin Alevski is a Full Stack Engineer and generalist with a lot of passion for Information Security. Currently working as a Security Engineer at Google. Lenin specializes in building and maintaining Distributed Systems, Application Security and Cloud Security in general. Lenin loves to play CTFs, contributing to open-source and writing about security and privacy on his personal blog https://www.alevsk.com.

Creator: Payment Village
Wall of Wallets is a hands-on CTF challenge where the goal is simple: collect as many mock payment card details as you can from other participants. Using intentionally vulnerable services in a safe, isolated environment, you’ll learn how common implementation mistakes expose sensitive data. Compete to top the Wall of Wallets leaderboard while discovering the real-world techniques attackers use and, importantly, how to defend against them.

People:
    SpeakerBio:  Dan Borgogno, Security Researcher at Faraday

Dan Borgogno is a security researcher, backend developer, security engineer and international speaker with years of experience on mobile, hardware, IoT and web application hacking.

Creator: CodeBloom

Curious what is actually happening inside an AI when it answers your questions? In this session, you’ll build your very own neural network using flashcards and pipe cleaners, test it out with tricky prompts, and watch what happens when you grow it bigger, just like real AI companies do! We’ll also talk about how AI models pick up new skills, some of the sneaky ways people try to trick AI, and the clever ways researchers keep AI safe. A fun, hands on way to learn about AI for curious minds of all levels. If you’ve ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

Links:
    More Info – https://codebloom.org/defcon

People:
    SpeakerBio:  Sam Mosley, CodeBloom
No BIO available

Creator: Blacks In Cyber Village

AI agents are being handed the keys to enterprise infrastructure, executing code, querying databases, making access decisions, and increasingly controlling physical systems. Most are built on pure LLM inference, making them stochastic, opaque, and vulnerable in ways traditional security tooling was never designed to catch. This session breaks down how LLM-based agent architectures fail from a security perspective, what a more auditable architecture looks like in practice, and why the security community needs to be driving this conversation before the agents are already inside the perimeter. Discover how grounding agent decisions in structured knowledge graphs, symbolic reasoning, and auditable state transitions dramatically reduces this exposure, offering a critical new security layer. Join us to understand the future of secure AI agents.

People:
    SpeakerBio:  Maureese Williams, Senior LLM and Data Engineer

Maureese Williams is a Senior LLM and Data Engineer with extensive experience in media, finance, and technology. They specialize in leveraging AI and Large Language Models (LLMs) to solve real-world problems and empower developers. Their background includes working with companies like Warner Bros Discovery, Accenture, Ugam, Vanguard, and BlackRock, focusing on data engineering, vector databases, and generative AI. Maureese is also known for contributing to open-source projects.

Creator: IoT Village

This course offers hands-on instruction using a unique, cat-shaped Wi-Fi hacking microcontroller, the Wi-Fi Nugget. Kit Cost: $140. Class Cap: 30.

Links:
    Sunday Purchase & Registration – https://retia.io/products/defcon-day-3-wifi-self-defense-wifi-hacker-hunting-for-beginners
    Friday Purchase & Registration – https://retia.io/products/defcon-day-1-wifi-self-defense-wifi-hacker-hunting-for-beginners
    Saturday Purchase & Registration – https://retia.io/products/defcon-day-2-wifi-self-defense-wifi-hacker-hunting-for-beginners

People:
    SpeakerBio:  Kody Kinzie
No BIO available

Creator: CodeBloom

Did you know that every photo, song, and message on your phone is really just a long string of 0s and 1s? Come learn how binary code works and then turn your very own secret word into a wearable friendship bracelet using our binary alphabet chart! This session is beginner friendly and a great way to see how computers really think. If you’ve ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

Links:
    More Info – https://codebloom.org/defcon

Creator: CodeBloom

Ever wanted to send a secret message that only your friend could read? Come build your very own cipher wheel and learn how to do exactly that! We’ll walk you through the Caesar Cipher, a code used by a Roman emperor over 2,000 years ago, and show you how to pick a secret key, encrypt a message, and pass it to a friend to decrypt. This is a great hands on introduction to cryptography for folks of any age or background. If you’ve ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

Links:
    More Info – https://codebloom.org/defcon

Creator: La Villa Community

La mayoría de los SOCs son reactivos por diseño: los eventos llegan, se almacenan, se correlacionan horas después, y en el mejor de los casos un analista los revisa cuando puede.

Este workshop rompe ese modelo.

Presentamos una arquitectura SOC-less impulsada por IA donde la detección ocurre en línea — antes de que los datos lleguen al SIEM — usando reglas Sigma traducidas a lógica ejecutable en Groovy.

Cuando una regla hace match, el evento se enriquece al instante con contexto de usuario, criticidad del activo, estructura de procesos y técnicas asociadas a MITRE ATT&CK.

El diferenciado de nuestra propuesta es la memoria. Cada alerta, ticket, resolución, triaje de analista y falso positivo alimenta un índice recurrente.

los agentes consultan ese historial para determinar si una detección es nueva, recurrente, vinculada a un activo crítico o parte de un patrón conocido — luego generan el ticket, sugieren severidad, recomiendan la contención y, en escenarios controlados la ejecutan.

El resultado del flujo es la detección y respuesta inicial medidas en segundos, no en turnos de analistas.

People:
    SpeakerBio:  Luis Pazmino, Cyber Defense Manager Banco Pichincha, Principal Consultor DataProtect Information Security

Cybersecurity Lover, Red Teamer, OSCE | OSEP | OSCP | CISM | ECSA | CEI

SpeakerBio:  Yoshihito Adachi, Cybersecurity Specialist

I have a strong passion for data exploration and threat hunting, which drives me to constantly seek out new methods to detect high-level threats. Being a highly logical individual, I am deeply interested in understanding how things work. This curiosity fuels my dedication to uncovering innovative approaches and enhancing cybersecurity measures.