¿Qué puede ser más aterrador que una vulnerabilidad de día cero? Una serie de falsos negativos combinados con una falsa sensación de seguridad en un equipo de operaciones de seguridad desprevenido. En esta charla práctica, mostraré cómo un atacante puede interrumpir la recopilación de registros de AWS y evadir la detección dentro del margen de tiempo disponible
ResearchersSantiago Abastante AR
Presented at Ekoparty Miami 2026
New features are the most fertile ground for bug hunters. In this turbo talk I walk through how an endpoint in the "Unboxing" feature of a major e-commerce platform turned out to be vulnerable to SSRF: the first sniff at the feature, the validation bypass, and the road to the report in the bug bounty program.
ResearchersAdrián Pedrazzoli AR
Presented at Ekoparty Miami 2026
Static wordlists are a lie we tell ourselves: same wordlists == same bugs. This talk shows why content discovery and fuzzing in real-world bug bounty targets fail when every assessment starts from the same stale inputs. This talk walks through dynamic fuzzing techniques and introduces an open-source tool that builds, mutates and combine wordlists based on the live context of the assessment, tested across bug bounty programs and pentest engagements.
ResearchersAgustin Aguirre AR
Presented at Ekoparty Miami 2026
Es una charla intensiva y práctica que te recorrera desde los fundamentos hasta la vanguardia de la Cyber Threat Intelligence (CTI). Descubriremos por qué la CTI dejó de ser un “nice-to-have” para convertirse en un imperativo de supervivencia organizacional, tocando piezas clave como el ciclo de inteligencia, los tipos (estratégica, táctica y operacional), las fuentes éticas y efectivas (OSINT, HUMINT, SIGINT y más). Aprenderemos a aplicar frameworks de referencia mundial como MITRE ATT&CK, Cyber Kill Chain y el Diamond Model. Cerraremos con una demo en vivo: “Puedes correr, pero no puedes esconderte”. Ahi mostrare, paso a paso y en tiempo real, cómo desanonimizar servicios y operadores en la Dark Web, demostrando que ni siquiera los rincones más oscuros de internet son 100 % seguros cuando se aplica inteligencia correctamente.
ResearchersDavid Perez AR
Presented at Ekoparty Miami 2026
What happens when you are reverse engineering a device and you hit the wall? You found that the device’s architecture is not X86, no ARM, no MIPS, it’s just a proprietary architecture with basic information available online. You know you can reverse engineer a full Instruction Set Architecture (from now, ISA), but it is going to take a lot of time and effort. So we asked ourselves: can AI do the tedious work for us?
The instructions for the processor are not more than bits, but for us, it could be translated to assembly instructions. This assembly is just a human-readable encoding of bits, and it could be completely novel. And finding the relation between this semantics and the bits is a really tedious job, so why not let this to the AI?
In this talk, we propose a methodology to automatically reverse engineer ISAs using a multi-agent AI pipeline. The approach combines deterministic bit-level analysis with LLM reasoning to recover the ISA from a JieLi JL7012F6 processor, taking as input the disassembled instructions from the vendor's toolchain and producing a processor specification for Ghidra.
Beyond the tool we develop and release, this talk explores new ways in which AI can help in the reverse engineering process and proves the capacity of this technology in this field. Today, AI focuses on the higher levels of computation, but it is really useful in the lower levels too; we just have to find the fit.
ResearchersGaston Aznarez AR·Dan Borgogno AR
Presented at Ekoparty Miami 2026
Demostrar la viabilidad de utilizar el algoritmo Shor para romper la Criptografía de Curva Elíptica (ECC)
ResearchersGerman Gustavo Bollmann AR
Presented at Ekoparty Miami 2026
Se mostraran métodos prácticos para capturar y analizar tráfico en aplicaciones móviles Android, iOS y basadas en Flutter. Se abordan proxies a nivel de sistema operativo, instrumentación dinámica para redirigir tráfico hacia un proxy y técnicas de bypass de SSL pinning. Se incluyen demos operativas y material reproducible.
ResearchersJuan Martinez Blanco AR
Presented at Ekoparty Miami 2026
What happens after submitting a bug bounty report. This talk explores the full process from a triager’s perspective: how reports are evaluated, what common mistakes affect their acceptance, and which best practices can make a difference. We will also look at how AI is influencing report quality and the validation process. A practical perspective on how decisions are made on the other side—and how to maximize the impact of your findings. Presented in Spanish.
ResearchersLeandro Pintos AR
Presented at Ekoparty Miami 2026
Discovering a vulnerability outside program scope poses an uncomfortable question: how far can I go without legal exposure? This talk examines that boundary in practice: minimal validation, controlled impact, and responsible disclosure—all with one goal: preventing your bug from becoming your legal liability.
ResearchersLuciano Paccella AR
Presented at Ekoparty Miami 2026
Startups and small businesses are increasingly expected to meet enterprise-level cybersecurity standards, but many lack the budget, staff, and specialized expertise required to perform formal risk and maturity assessments. As a result, security frameworks such as the NIST Cybersecurity Framework can feel too complex, abstract, or expensive to operationalize. This session explores how artificial intelligence could be used as a “virtual security assessor” to make cybersecurity assessments more accessible for resource-constrained organizations. Rather than presenting a commercial product, the talk will focus on the design patterns, risks, and safeguards behind AI-assisted assessment systems: adaptive questioning, framework-grounded analysis, maturity scoring, risk prioritization, and actionable remediation roadmaps.
The session will also discuss the limitations of AI in cybersecurity assessment, including hallucination risks, dependency on user-provided data, lack of environmental visibility, and the need for human review. Attendees will leave with a practical understanding of how AI can support—not replace—cybersecurity professionals in assessing organizational maturity and translating complex frameworks into clear, prioritized actions.
ResearchersMariano Facundo Scigliano AR
Presented at Ekoparty Miami 2026
No abstract was found on the conference website.
ResearchersMariano E Quintana AR
Presented at Ekoparty Miami 2026
Smart devices in your house are likely vulnerable and easy to hack. This talk will show you how to. Using a handful of cheap tools such as a UART to TTL adapter, an RTL-SDR dongle, and some open-source software, we'll walk you through the process of how I hacked two real targets from scratch. Don’t worry if you don’t know what UART or TTL means, we have you covered.
First, we will explore how a Smart Display was compromised, from gaining initial access to reverse engineering the device and identifying vulnerabilities along the way. Then, we will analyze how a commercial weather station's RF protocol was decoded and how custom data was injected into it.
Along the way, we'll cover the basics: initial reconnaissance of an electronic board, how to identify debug interfaces, and how to approach an unknown radio frequency signal. No prior hardware experience. No expensive lab. Just cheap hardware, open-source tools, and curiosity. Hopefully, you’ll walk away having a plan to start your journey in the hardware hacking world.
ResearchersMatias Perez Fumega AR
Presented at Ekoparty Miami 2026
La inteligencia artificial está redefiniendo el panorama de la ciberseguridad. Lo que antes eran piezas de código estático y predecible hoy evoluciona hacia amenazas dinámicas capaces de adaptarse, mutar y tomar decisiones en tiempo real.
En esta charla exploramos cómo los atacantes están incorporando modelos de AI para automatizar la generación de variantes, mejorar la evasión y acelerar el ciclo de ataque. A través de casos reales y una demo, se muestra cómo un agente controlado por IA puede cambiar su comportamiento en función del entorno y del resultado de sus propias acciones.
El objetivo no es mostrar malware, sino evidenciar un cambio de paradigma: la detección basada en firmas y patrones está quedando atrás frente a amenazas que evolucionan en cada ejecución.
La pregunta ya no es si esto va a pasar. La pregunta es: ¿estamos preparados para defendernos de algo que aprende?
ResearchersNelson Insaurralde AR
Presented at Ekoparty Miami 2026