Offensive Security research

• August 9, 2026 Arsenal Offensive Security AppSec Village — DEF CON 2026 Lenin Alevski MX ROP for the Web: Smuggling XSS, SQLi, and Web Shells Past Every WAF Using Compression Dictionaries

  Compression Dictionary Transport (RFC 9842) shipped in Chrome 130+ in 2025. Any JavaScript asset designated as a dictionary becomes a set of gadgets an attacker can chain into responses that bypass signature-based WAFs and IDSes. gadget-scanner is the a tool to evaluate that surface: drop in a candidate dictionary and a payload, and it reports how much of the payload hides inside backreferences and how much leaks as literal bytes on the wire. At the table you will score real-world JS libraries as attack primitives, generate the DCB blob with brotli -D, and watch the side-by-side: the raw bytes a WAF would see vs. the payload a browser would execute

  ResearchersLenin Alevski MX

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 9, 2026 Talk Offensive Security Red Team Village — DEF CON 2026 Murilo Caixeta BR Living Off WebView2: Turning Microsoft's Browser into a Red Team Asset

  Modern Windows applications are quietly shipping with a built-in Chromium-based browser, WebView2, running inside trusted, signed processes such as Microsoft Teams, Outlook, and other enterprise software.

  This talk shows how that design choice creates a powerful and largely unmonitored attack surface.

  I demonstrate how this model can be abused in offensive operations, turning WebView2 into a vector for persistence, code execution, and enterprise account impersonation.

  I show how feature flags and environment variables can be leveraged to manipulate the WebView2 runtime, enabling techniques such as DLL sideloading within legitimate applications. This allows arbitrary code execution inside trusted processes, supporting stealthy living-off-the-land persistence.

  Building on this, I present methods to intercept and proxy HTTP/HTTPS traffic generated by WebView2-based applications. This enables the extraction of session tokens, cookies, and other sensitive artifacts, leading to realistic account takeover and impersonation scenarios, including access to platforms such as Office 365.

  In addition to the offensive techniques, I provide a detailed analysis of the Indicators of Compromise (IOCs) generated throughout these attack chains. I highlight detection opportunities, discuss current visibility gaps in EDR solutions, and propose practical approaches for identifying and responding to this type of activity in real-world environments.

  ResearchersMurilo Caixeta BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 9, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Fernando Mengali BR·Thiago Cunha da Silva BR From Buffer Overflow to Blackout: Chaining Attacks Against Industrial Systems

  This presentation takes a practical, demo-driven approach to exploitation, demonstrating how a buffer overflow vulnerability can still serve as an entry point to compromise modern industrial infrastructures. The session is approximately 90% hands-on and 10% theoretical.

  The talk walks through the full attack chain, starting from initial exploitation and progressing to the development and execution of multistage shellcode. This shellcode establishes communication with a remote Command and Control (C2) server, retrieves an additional payload, and executes it directly in memory, bypassing traditional detection mechanisms.

  Once the environment is compromised, the session demonstrates how an attacker can gain full remote control, enabling command execution, lateral movement, and exfiltration of sensitive data, including critical assets such as licenses and proprietary industrial information.

  The talk also includes interaction with real-world devices such as RTUs (Remote Terminal Units), showing how malicious actions can directly impact industrial operations. In critical scenarios, this can lead to disruptions in essential services, including failures in energy systems and potential blackouts.

  The content is based on real-world pentesting experience conducted in an energy sector company in Brazil, providing a practical and applied perspective on risks in ICS/SCADA environments.

  The goal is to demonstrate how modern attacks combine vulnerabilities with advanced techniques, reinforcing the need for robust security strategies to protect critical infrastructure.

  ResearchersFernando Mengali BR·Thiago Cunha da Silva BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 9, 2026 Talk Offensive Security Red Team Village — DEF CON 2026 Elzer Pineda PA·Jose Manuel Rivas PA Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

  Is MFA and Conditional Access a real security guarantee? In this technical session, we will demonstrate how endpoint compromise allows an attacker to bypass traditional identity barriers in the cloud. The talk focuses on exploiting vulnerabilities in Microsoft Entra ID, breaking down an advanced attack chain:

  • Device Code Flow: Abuse of authentication flows for initial access (Demo with Entraith).
  • PowerShell Hijacking: Process interception to obtain session tokens (GrabTokenAzureAD).
  • Sliver BOF Extraction: Use of Beacon Object Files (BOF) for stealthy exfiltration of tokens and the Primary Refresh Token (PRT) from memory, evading anti-malware defenses.
  • MFA Bypass and Intune: The speakers developed custom tooling to extract local PRTs, bypass Intune device management controls, and circumvent MFA. This entire attack lifecycle was consolidated into Entraith — an offensive framework built from scratch by the research team and set to be released publicly at DEF CON 34 (https://github.com/bl4cksku11/entraith) — enabling device code attacks, token renewal, email and app inspection, token exfiltration, and persistence generation from a single interface.

  This talk is not about a single CVE or a niche edge case. It is a comprehensive offensive research presentation covering the full spectrum of attack techniques against Microsoft Entra ID — from the very first foothold to deeply rooted, multi-vector persistence that survives incident response.

  We will demonstrate, live, how an attacker moves through every phase of an Entra ID compromise:

  Initial access and token theft: We begin with Device Code Flow phishing — abusing Microsoft's own authentication protocol to harvest valid tokens without ever touching a password. We then escalate with PowerShell process hijacking (GrabTokenAzureAD) to intercept live session tokens, and culminate with Sliver BOF-based extraction of the Primary Refresh Token (PRT) directly from memory — stealthy, silent, and anti-malware evasive. These three techniques alone demonstrate that MFA and Conditional Access are not the guarantees organizations believe them to be.

  Bypassing Intune and MFA: Purpose-built tools developed during this research extract local PRTs, bypass Intune device compliance controls, and circumvent MFA enforcement at the token layer — not through social engineering, but through direct abuse of Microsoft's identity platform mechanics. Attackers operating from non-enrolled or non-compliant devices can achieve full Tenant access that Conditional Access policies are designed to prevent.

  Persistence across 10 vectors: Once inside, we deploy a "Survival Kit" of 10 chained persistence mechanisms — camouflaged App Registrations, long-lived secrets and certificates, backdoor accounts, strategic role assignments, privileged group inheritance, admin mailbox delegation, inbox-rule-based exfiltration of credentials and MFA codes, OAuth consent grants to external applications, and Temporary Access Pass generation for on-demand MFA bypass. No single blue team action — password reset, MFA enforcement, device wipe — removes all of them simultaneously.

  Entraith — built by us, released at DEF CON: The centerpiece of this talk is Entraith (https://github.com/bl4cksku11/entraith), an offensive framework designed and built from the ground up by the speakers specifically for this research. Entraith is not a wrapper around existing tools — it is original work, developed over months of hands-on red team engagements against real Microsoft 365 environments. It unifies every technique demonstrated in this talk into a single operator interface: device code phishing, PRT extraction from memory, Intune compliance bypass, token renewal and exfiltration, email and application enumeration, and the full 10-step persistence deployment chain. DEF CON 34 will be the moment Entraith is released to the public. Attendees will be among the first to access the tool, its documentation, and the full methodology behind it — making this talk a genuine first-look at original research with immediate real-world impact.

  Why this matters for Cloud Village: The Microsoft 365 and Entra ID ecosystem is the identity backbone of the majority of enterprise organizations worldwide. The techniques presented here are not theoretical — they are being used by real threat actors today. Defenders in the room will leave with concrete detection opportunities and an understanding of exactly which log sources and control gaps allow this attack chain to succeed undetected. Red teamers will leave with a working tool and a fully documented methodology. This talk delivers both offensive depth and defensive utility in a single session, and the live demos ensure no attendee has to take our word for it.

  ResearchersElzer Pineda PA·Jose Manuel Rivas PA

  Presented at Red Team Village — DEF CON 2026

  View official session Entraith on GitHub
• August 9, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Andrés Sabas MX Tu foco IoT nunca tuvo modelo de amenazas

  Compraste una foco IoT. La conectaste a tu WiFi. Le pusiste una contraseña. ¿Quién más le puede mandar órdenes? ¿Quién verifica que el firmware que descarga es legítimo? En esta charla cuento la auditoría completa de Magic Home, la app de Zengge instalada en bombillas, tiras LED y switches que se venden bajo una docena de marcas blancas. No vengo a enumerar bugs. Vengo a mostrar tres preguntas básicas que el ecosistema entero, móvil, nube y radio, no puede responder una sola raíz: nunca hubo modelo de amenazas en el ciclo del producto. Uso firmware ya publicado en internet, scripts caseros y un decompilador. Cero hardware comprado. Una demo grabada de por qué nada detendría a un atacante. Una demo en vivo de cuánto se puede ver del fleet sin tocar a nadie más.

  ResearchersAndrés Sabas MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security Red Team Village — DEF CON 2026 Lenin Alevski MX Red Teaming Kubernetes: From App-Level CVEs to Full Cluster Takeover

  Kubernetes is the de facto operating system of the cloud, and more and more organizations are running their workloads on Kubernetes. While Kubernetes offers many benefits, it also introduces new security risks, such as cluster misconfiguration, leaked credentials, cryptojacking, container escapes, and vulnerable clusters.

  In this workshop, attendees will learn how to attack Kubernetes clusters by simulating a real-world adversary exploiting one of the most recent vulnerabilities in the ecosystem: IngressNightmare (CVE-2025-1974). Participants will practice exfiltrating service account tokens and credentials, performing lateral movement, escalating privileges by targeting common applications deployed in Kubernetes environments, and ultimately compromising the entire cluster.

  ResearchersLenin Alevski MX

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security DEF CON 34 Dan Borgogno AR·Javier Bernardo AR The Glass Perimeter: Systematic Bypasses in Biometric Frameworks and the Rise of Synthetic Identity

  Identity is the new perimeter, and biometrics are its supposed gatekeepers. But what happens when the gatekeepers are blind to the reality they consume? We spent more than 6 months deconstructing the biometric "Root of Trust" across every top-tier framework we could find, solutions relied upon by the world's largest banks and providers worth billions. The result: A 100% bypass rate. From high-fidelity physical spoofs to a first-of-its-kind Cross-PID buffer hijack against integrated anti-tamper SDKs, we prove that even multi-million dollar "fortresses" can be reduced to client-side theater.

  This talk is a technical journey through the guts of the mobile media pipeline, exposing how synthetic identities are manufactured at scale to bypass RASP, Kernel-level integrity, and AI models. When the "Master Key" is just another line of code an attacker can hook, the risk isn't just a bug, it's a systemic failure affecting millions of users. Customers are losing wealth, companies are buying illusions, and the glass perimeter is shattering.

  ResearchersDan Borgogno AR·Javier Bernardo AR

  Presented at DEF CON 34

  View official session
• August 8, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Gerardo Mejia CR When Cash Runs on Windows: A Red Team Look at ATM Attack Surfaces

  Muchos cajeros automáticos siguen siendo, en esencia, computadoras Windows especializadas. Algunos son modernos, otros llevan años operando con sistemas heredados, configuraciones antiguas y controles que nunca fueron revisados a profundidad. Están en gasolineras, supermercados y esquinas, conectados a infraestructura crítica donde una mala decisión de hardening, segmentación o administración remota puede convertirse en un riesgo real. Nadie los toca. Nadie los cuestiona. Hay dinero adentro. Esta charla resume hallazgos de ejercicios reales de pentesting sobre ATMs realizados en América Latina.

  Veremos cómo se ve la seguridad ATM en producción: qué controles suelen estar presentes, cuáles fallan de formas inesperadas y cómo debilidades aparentemente menores pueden encadenarse hasta comprometer infraestructura crítica. Entre los hallazgos analizaremos fallas en controles de endpoint, hardening, segmentación, administración remota y exposición de servicios legacy. También veremos qué controles resistieron, por qué lo hicieron y qué diferencia a un ATM correctamente endurecido de uno que puede convertirse en punto de entrada hacia infraestructura crítica bancaria. Más que mostrar "cómo atacar un cajero", esta charla busca crear conciencia sobre la importancia de endurecer y monitorizar estos equipos.

  ResearchersGerardo Mejia CR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Fernando Mengali BR De la Explotación de Buffer Overflows al C2 Industrial: Infectando y Controlando RTUs con Malware

  En esta charla práctica y directa al punto, se demostrará cómo una vulnerabilidad de buffer overflow puede ser explotada para comprometer entornos SCADA, evolucionando desde la ejecución de shellcode multietapa hasta el establecimiento de canales de comunicación C2 y el control remoto de sistemas industriales críticos. A través de demostraciones técnicas, se analizará cómo una vulnerabilidad aparentemente aislada puede convertirse en una cadena de ataque capaz de afectar procesos industriales, provocar interrupciones operativas e incluso derivar en escenarios de blackout.

  ResearchersFernando Mengali BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Arnold Morales MX Evading EDR in ATM

  ATMs in the end are a computer with windows.

  I will talk about EDRs and how parent-child process inheritance works.

  The Windows boot process, known as the boot process, is divided into several phases as we have already seen: PreBoot (initialization of BIOS/UEFI firmware and POST), Boot Manager (loading of bootmgr or bootmgfw.efi), OS Loader (execution of winload.exe to load the kernel), and Kernel Initialization (loading of ntoskrnl.exe and hal.dll, initialization of drivers and services). Finally, winlogon.exe is started to present the user interface. This process enables the transition from a powered-off state to a functional operating system through a hierarchical and verified sequence.

  Regarding kernel-based EDRs (Endpoint Detection and Response), they operate in kernel mode, the most privileged level of the system (some also operate at the UEFI level), which allows them to monitor low-level activities such as system calls, memory manipulation, driver loading, and file access. By running in this mode, EDRs can detect and block advanced threats such as rootkits or persistent malware that attempt to evade user-mode protections. Their deep integration with the kernel enables real-time monitoring, behavioral analysis, and immediate response to suspicious activities during and after the boot process.

  EDRs are typically located in the kernel, but as mentioned, some also operate at the UEFI level. If we recall how Windows works, beneath UEFI lies SMM (System Management Mode), making this an even more complex layer to analyze and operate within.

  This talk is intended for individuals interested not only in ATMs and simple cash dispensing, but in going beyond that—focusing on deeper analysis and the full experience gained when confronting these systems.

  ResearchersArnold Morales MX

  Presented at Red Team Village — DEF CON 2026

  View official session DMA Introduction (write-up) Telemetry Bypass (write-up)
• August 8, 2026 Talk Offensive Security AppSec Village — DEF CON 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Federico Pacheco AR·Diego Staino AR Learning Deception by Doing: Attacking and Defending

  Cyber deception is one of the most powerful and least understood defensive disciplines, most practitioners have read about honeypots, but few have ever deployed a breadcrumb, watched an attacker chase a fake credential, or felt the confusion deception causes from the attacker's side.

  This session shares the fundamentals of deception by doing and experiencing: what deceptive artifacts exist (honey-credentials, deceptive configs, honey-services, synthetic activity), where they belong in a real environment, what telemetry they generate, and how they change an adversary's behavior. Everything is practiced in an open-source, Docker-based playground that recreates a realistic multi-tier company, with an attacker toolkit on one side and a defender SIEM on the other, so attendees can safely play both roles.

  The 25-minute format is a guided demo; the 50-minute format is a hands-on lab.

  ResearchersFederico Pacheco AR·Diego Staino AR

  Presented at La Villa Hacker — DEF CON 2026

  Speaker page (Fede Pacheco) Speaker page (Diego Staino)
• August 8, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Filipi Pires BR DPAPI Is Not a Boundary: A Full Infostealer Kill Chain Operators Can Replicate

  Complete infostealer kill chain hands-on, executed against Windows 11 21H2 on default UAC using only open-source tooling. No zero-days, no commercial C2. Participants run every command live: HTA delivery, Meterpreter in-memory session, Chrome and Edge credential extraction via DPAPI-locked SQLite, keylogging in explorer.exe memory, UAC bypass via fodhelper, SYSTEM via Named Pipe Impersonation, and LSASS dump via Kiwi. The DPAPI_SYSTEM key recovered from LSA secrets decrypts the browser credentials captured earlier, closing the loop.

  OUTLINE

  • Stage 1: generate HTA payload, deliver via Python HTTP server, open Meterpreter session
  • Stage 2: extract Chrome and Edge credentials via post module, inspect DPAPI-encrypted loot
  • Stage 3: migrate to explorer.exe, start keyscan, capture live keystrokes
  • Stage 4: UAC bypass via fodhelper registry hijack, elevate to SYSTEM via Named Pipe Impersonation
  • Stage 5: load Kiwi, dump NTLM hashes, SAM, LSA secrets, extract DPAPI_SYSTEM key, decrypt browser loot
  • Detection debrief: Sysmon Event ID 1 process tree and PowerShell Script Block log review per stage

  TAKEAWAYS

  1. A complete credential theft playbook from HTA delivery to LSASS dump, validated against Windows 11 21H2 with Chrome 147 and Edge 147 on default UAC, ready to adapt for engagements.
  2. The DPAPI close-loop: how DPAPI_SYSTEM from LSA secrets decrypts browser credentials collected earlier, giving operators a concrete credential pivot from a single user-context session.
  3. A detection gap map calibrated against real Sysmon telemetry showing which events fire on default Windows 11 and which require EDR behavioral rules most organizations do not have deployed.

  ResearchersFilipi Pires BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 8, 2026 Workshop Offensive Security Adversary Village — DEF CON 2026 Filipi Pires BR Infostealer: Replicating Commodity Threat Actor Credential Theft TTPs and Validating Detection Gaps

  Commodity infostealers account for a significant share of initial access in enterprise breaches. Their TTPs are documented, their tooling is public, and most detection stacks still miss them. This workshop emulates the full infostealer playbook against a live target and measures exactly where the gaps are.

  Attendees execute an eight-stage adversary emulation scenario replicating documented commodity threat actor TTPs: HTA phishing delivery, in-memory C2 via Meterpreter, browser credential theft from Chrome and Edge using DPAPI and the SQLite Login Data file, in-memory keylogging via process migration to explorer.exe, UAC bypass using the fodhelper registry hijack documented across multiple threat actor profiles, and LSASS credential dumping via Kiwi/Mimikatz recovering NTLM hashes, SAM contents, and the DPAPI_SYSTEM master key. Every technique is drawn from documented threat actor behavior and mapped to MITRE ATT&CK before execution begins.

  The second half of the workshop shifts to validation. Attendees enable Sysmon64 telemetry and replay the emulation, stage by stage, identifying which techniques generated detectable events and which did not. Each gap maps to a concrete control recommendation. The keylogging stage writes nothing to disk. The Meterpreter session exists only in memory. The DPAPI_SYSTEM extraction is not anomalous to most SIEMs by default. Attendees document all three as validated findings, not assumptions.

  Key Takeaways

  1. Adversary emulation with real TTPs produces validated detection gaps, not theoretical ones. Running the actual technique against your stack tells you whether the control works. Running it in this workshop tells you before an attacker does.

  2. In-memory execution breaks file-based detection entirely. Meterpreter leaves no binary on disk. The only detection path is behavioral: process injection signals, memory scanning, or network correlation between a user-context process and an external C2 session.

  3. DPAPI_SYSTEM recovery after LSASS access retroactively compromises all protected data on the machine. Most SIEMs do not alert on this extraction by default. Attendees leave with the specific Event IDs and Sysmon rule configuration that catch it.

  ResearchersFilipi Pires BR

  Presented at Adversary Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Erik Alcantara MX Point of Failure: Autopsia de una Terminal de Pago

  TPVs como PAX y Mercado Pago corren Android, usan HTTP en producción y tienen un modo kiosco que dura lo que tarda en abrirse un APK. Esta charla es el journey de alguien que compró terminales, las rompió, y documenta lo que encontró.

  ResearchersErik Alcantara MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Christiane Borges Santos BR O Lado Sombrio das Coisas: Transformando Dispositivos DIY em Vetores de Ataque

  O objetivo principal desta palestra é demonstrar como a democratização do hardware e da filosofia Do It Yourself (DIY) aceleraram a prototipagem rápida, mas na pressa para ver o projeto "funcionar" muitas vezes ignoram os padrões mínimos de segurança. A idéia é provocar a audiência a adotar a filosofia "Secure by Making", integrando o hardening e a análise de superfícies de ataque desde a primeira solda e linha de código do protótipo.

  ResearchersChristiane Borges Santos BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Eduardo Contreras MX Demodus Operandi (Cómo tres rf-hacks en tres bandas terminaron siendo una metodología)

  Hay muchas herramientas para hackear RF y mucho conocimiento regado en talks, repos y la cabeza de la gente. Lo que no hay es un mapa. Cuando te paras frente a un dispositivo o señal, ¿por dónde empiezas? ¿y cómo sabes qué se te escapó? Esta charla cubre tres investigaciones reales, cada una en una tecnologia distinta. Primero BLE, sniffeando advertising packets terminé auditando una sala y encontré 6 de 85 dispositivos completamente controlables, incluso con LE Secure Connections habilitado. Después LoRaWAN, capturé 51,304 frames en US915. El 89.3% eran JoinRequests: una red entera fallando en unirse, visible sin transmitir un solo paquete, red que no podia encontrar con un SDR. Y al final LTE, encontrar la celda correcta en México, entender el OFDM, y extraer metadatos en pasivo. Tres casos, tres analisis distintos. Pero siempre sobre las mismas capas: espectro, señal, enlace, cripto, ataque. Ya seguía una metodología, solo no la había nombrado. Así nació RFSAM (Radio Frequency Security Assessment Methodology): una referencia abierta, estructurada, que organiza lo que OSSTMM, BSAM y la comunidad SDR ya construyeron, en algo que puedes navegar. No pretende inventar nada, pretende ser un mapa.

  ResearchersEduardo Contreras MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Rafael Felix BR Shapeshifting C2: Applying DAITA Traffic Shaping to Defeat DPI and DLP Detection

  ML-based DPI and DLP solutions have made signature evasion insufficient. Modern enterprise detection analyzes packet size distributions, inter-packet timing, and burst patterns to fingerprint C2 traffic regardless of how well headers and TLS certificates are spoofed.

  This talk demonstrates how three techniques from the VPN privacy research space - originally developed to defeat traffic analysis against Tor and Mullvad, can be adapted for offensive C2 operations:

  1. Constant-size packet morphing: forcing all frames to a fixed MTU-aligned size removes the packet-size fingerprint that ML classifiers depend on;

  2. Cover traffic injection: dummy packets sent at Poisson-distributed or adaptive intervals make real beacon timing statistically invisible;

  3. Probabilistic pattern distortion: Maybenot-inspired state machines inject cover bursts alongside real packets, destroying recognizable C2 sequences;

  We then will see how layering these techniques with application-layer malleable profiles (traffic impersonating Microsoft Graph, Slack, or Okta) and bonus: indirect transports like cloud storage dead-drops (S3, OneDrive) creates C2 channels that defeat detection at every layer simultaneously - behavioral, flow, and application.

  Attendees leave with a concrete mental model for building evasion stacks that go beyond header manipulation.

  ResearchersRafael Felix BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security DEF CON 34 Romel Marin CR Lowering the Orbit: Exploiting Satellite Protocols and communications via Software-Defined-Radio and GS

  This talk examines the attack surface created by modern satellite communications as the industry moves toward commercial off-the-shelf hardware and standardized protocols such as CCSDS and Space Packet Protocol. It moves beyond simple RF command injection into a broader exploitation methodology for space links, ground stations, and satellite subsystems.

  The session demonstrates protocol fuzzing, GNS spoofing, command exploitation over LoRa and FSK, lateral movement from a compromised RF link to an internal CAN bus, and ground-segment pivoting against mission operations infrastructure. The work uses PWNSAT and PWNCUBE as an open-source satellite exploitation ecosystem for simulating an end-to-end mission under attack.

  ResearchersRomel Marin CR

  Presented at DEF CON 34

  View official session
• August 7, 2026 Talk Offensive Security Payment Village — DEF CON 2026 Arnold Morales MX Breaking BIOS in ATMs

  The analysis begins at Ring -3, advancing toward the positive rings. Starting from the on-screen user perspective imposes too many limitations. The shift in approach was deliberate: rather than assuming a conventional attack vector such as connecting an external device or performing a kiosk-level bypass, the decision was made to start from the deepest layers of the system. This compromise is detected for the following reason:

  • DMA protection exists at the BIOS level.

  The goal of this compromise is to activate PCI/PCIe through BIOS in order to perform a DMA. This section will be referred to as "BIOS Unprotection."

  How was this achieved? Two methods were identified:

  • A bridge was found that triggers a BIOS configuration reset.
  • BIOS duplication with encryption validation bypass (enables both Downgrade and Upgrade).

  DMA or complete chain will not be shown since it is a delicate topic, but BIOS research will be deepened since it does not only apply to ATMs.

  ResearchersArnold Morales MX

  Presented at Payment Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Arnold Morales MX Jackpoting? Bypass de EDR? - Hacking ATM

  En muchas ocasiones cómo pentesters nos aferramos a la idea de buscar multiples técnicas de ataque de manera "virtual", buscando software especializado o creando scripts que nos ayuden a identificar una vulnerabilidad para acceder a un programa o dispositivo en el que nos enfoquemos, pasamos tanto tiempo enfrente de nuestra pantalla, lanzando comandos a lo bastardo hasta ver que podemos encontrar que a veces ignoramos que existen soluciones alternativas y no simplemente de manera virtual, sino de una manera en que podemos tocar, armar y desarmar (esto suele ser menos buscado por pentester, entonces tambien hay menos documentacion).

  El proceso de arranque de Windows, conocido como boot process, se divide en varias fases como ya lo vimos: PreBoot (inicialización del firmware BIOS/UEFI y POST), Boot Manager (carga de bootmgr o bootmgfw.efi), OS Loader (ejecución de winload.exe para cargar el kernel) y Kernel Initialization (carga de ntoskrnl.exe y hal.dll, inicialización de controladores y servicios). Finalmente, se inicia winlogon.exe para presentar la interfaz de usuario. Este proceso permite pasar de un estado apagado a un sistema operativo funcional mediante una secuencia jerárquica y verificada.

  Respecto a los EDR (Endpoint Detection and Response) basados en el kernel, operan en modo kernel, el nivel más privilegiado del sistema (algunos juegan en UEFI), lo que les permite supervisar actividades de bajo nivel como llamadas al sistema, manipulación de memoria, carga de controladores y acceso a archivos. Al ejecutarse en este modo, los EDR pueden detectar y bloquear amenazas avanzadas como rootkits o malware persistente que intentan eludir las protecciones del modo usuario. Su integración profunda con el kernel les permite realizar monitoreo en tiempo real, análisis de comportamiento y respuesta inmediata ante actividades sospechosas durante y después del arranque.

  Normalmente los EDRs se encuentran en KERNEL pero como lo mencione, existen otros que se encuentran en UEFI y si recordamos como funciona windows atrás de UEFI esta SMM entonces es algo un poco mas dicil.

  Esta charla es pensada para personas interesadas no solo en ATMs y una simple dispensación si no la vista mas alla, el análisis y toda la experiencia adquirida cuando te enfrentas a ellos.

  ResearchersArnold Morales MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Workshop Offensive Security La Villa Hacker — DEF CON 2026 Juan Camilo Palacio CO·Andrés Restrepo CO De la nube a la corona: Uso indebido de la identidad híbrida en Azure DevOps Azure, AD, AWS y EKS

  Demostrar cómo las relaciones de confianza entre entornos híbridos de Azure DevOps, Microsoft Azure, Active Directory, Amazon Web Services y Kubernetes pueden ser abusadas por un atacante para realizar movimientos laterales, escalamiento de privilegios y compromiso de identidades utilizando herramientas y funcionalidades legítimas de administración cloud en infraestructuras hibridas corporativas.

  ResearchersJuan Camilo Palacio CO·Andrés Restrepo CO

  Presented at La Villa Hacker — DEF CON 2026

  Speaker page (Juan Camilo Palacio) Speaker page (Andrés Restrepo)
• August 7, 2026 Talk Offensive Security Cloud Village — DEF CON 2026 Elzer Pineda PA·Jose Manuel Rivas PA Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

  Is MFA and Conditional Access a real security guarantee? In this technical session, we will demonstrate how endpoint compromise allows an attacker to bypass traditional identity barriers in the cloud. The talk focuses on exploiting vulnerabilities in Microsoft Entra ID, breaking down an advanced attack chain:

  • Device Code Flow: Abuse of authentication flows for initial access (Demo with Entraith).
  • PowerShell Hijacking: Process interception to obtain session tokens (GrabTokenAzureAD).
  • Sliver BOF Extraction: Use of Beacon Object Files (BOF) for stealthy exfiltration of tokens and the Primary Refresh Token (PRT) from memory, evading anti-malware defenses.
  • MFA Bypass and Intune: Custom tools were developed to extract local PRTs, bypass Intune device management controls, and circumvent MFA. The entire process was automated through the open-source tool https://github.com/bl4cksku11/entraith, enabling attacks via device code flow, token renewal, email and app inspection, token exfiltration, and persistence generation.

  ResearchersElzer Pineda PA·Jose Manuel Rivas PA

  Presented at Cloud Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Elzer Pineda PA·Jose Manuel Rivas PA Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

  ¿Son el MFA y el Acceso Condicional una garantía de seguridad real? En esta sesión técnica, demostraremos cómo el compromiso de un endpoint permite a un atacante saltarse las barreras de identidad tradicionales en la nube. La charla se centra en la explotación de vulnerabilidades en Microsoft Entra ID, desglosando una cadena de ataque avanzada:

  • Abuso de Device Code Flow: Explotación de flujos de autenticación para acceso inicial (Demo con Entraith).
  • PowerShell Hijacking: Intercepción de procesos para la obtención de tokens de sesión (GrabTokenAzureAD).
  • Extracción con Sliver BOF: Uso de Beacon Object Files para la exfiltración sigilosa de tokens y del Primary Refresh Token (PRT) directamente desde la memoria, evadiendo defensas anti-malware.
  • Bypass de MFA e Intune: Hemos desarrollado herramientas personalizadas para extraer PRTs locales, eludir los controles de gestión de dispositivos de Intune y saltarse la aplicación de MFA a nivel de token.

  Todo este ciclo de vida de ataque ha sido consolidado en Entraith, un framework ofensivo desarrollado desde cero por nuestro equipo de investigación que será lanzado públicamente en DEF CON 34.

  ResearchersElzer Pineda PA·Jose Manuel Rivas PA

  Presented at La Villa Hacker — DEF CON 2026

  Speaker page (Elzer Pineda) Speaker page (Jose Manuel Rivas)
• August 5, 2026 Talk Offensive Security BSides Las Vegas 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at BSides Las Vegas 2026

  View official session