Brute Logic, Security Researcher at Sucuri Security

Cross-site Scripting (XSS) is considered the most common plague for the web it is often limited to a straightforward popup screen with the famous
vector. In this short talk we will see what you can do with XSS as an assailant or pentester and the influence from it for a credit card applicatoin, the customers as well as the underlying system. A lot of sorts of black colored javascript wonders is observed, ranging from simple digital defacement to generate worry with bull crap to straightforward and life-threatening RCE (remote control order delivery) assaults on at the very least 25percent with the internet!

Sam Erb Can you determine the difference between gA?A?A?A?gle and google?

Best known for offering beneficial content material in Twitter within his beginning age on a number of hacking subjects, such as hacking frame of mind, methods and code (more fitting in 140 chars). Now their biggest interest and research entails corner web site Scripting (XSS) and filter/WAF avoid. Enjoys aided to repair above 1000 XSS weaknesses in internet applications globally in the shape of the start insect Bounty platform (previous XSSposed). Many of them add larger users in technology market like Oracle, relatedIn, Baidu, Amazon, Groupon e Microsoft. He is served by a blog completely focused on XSS subject and a personal twitter membership in which he offers several of his XSS and avoid strategy (). Recently founded a paradigm-changing XSS online appliance named KNOXSS, which works in an automated way to supply a functional XSS PoC for people. It already possess assisted a number of them to obtain thousands in bug bounty training. He’s usually ready to help skilled researchers and beginners to people nicely with his famous motto: usually do not figure out how to hack, # hack2learn.

‘” 2_saturday,,,RCV,”Palermo space, Promenade level”,”‘ItA?AˆA™s getting Worse earlier Gets Better – The Future of Recon information exploration'”,”‘Shane McDougal'”,”‘

Brute reason (Twitter: ) are self-taught computer hacker from Brazil working as a tsdating web protection researcher at Sucuri Security

The OSINT and reconnaissance surroundings try starting to deal with some difficulties. Existing valuable sources including open sourced databases are already experiencing offensive and malicious data poisoning. Privacy laws and regulations tend to be generating obstacles in lots of places, and as legal rulings become levying growing fines for playing smooth and loose with consumer information confidentiality. Social media marketing agencies are beginning to realize they actually need to begin making profits, and are generally limiting her data.

Internet sites are aggressively fighting online moving, service like TOR and VPN face unstable futures, the list of possible difficulties into the future of OSINT and recon seems grim. But worry maybe not. There was nonetheless expect – and lots of they. This speech will go over both the challenges and variations to both offending and protective reconnaissance that the presenter thinks we will see in the future, and strategies that can help mitigate or enhance these modifications.

Shane MacDougall tactical_intel are a two-time champ of the Defcon societal Engineering catch The Flag, and has placed in the best three of this combat section in most season of contestA?AˆA™s life. They are a principal mate in Tactical cleverness, a boutique InfoSec consulting firm in Canada that focuses primarily on personal engineering, corporate facts get together, and purple staff assaults. Mr. MacDougall started in the pc protection field in 1989 as a penetration tester with KPMG, and worked on the attacking region of the industry until 2002, when he joined up with ID Analytics, the worldA?AˆA™s greatest anti-identity theft discovery business once the mind of real information protection. Last year the guy left the organization to begin their own providers. Mr. MacDougall has actually recommended at several safety seminars, like BlackHat EU, BSides Las vegas, nevada, DerbyCon, LASCON, and ToorCon. He could be at this time carrying out data for the areas of integrating near-realtime OSINT into IDS/SIEM, in addition to the generation of a real-time pre-text creator.