Register Here
Select all sessions you'd like to attend below.
Join the most offensive faculty on the planet for a FREE full day of hands-on workshops and villages, all curated to offer a wide range of skills and techniques, across multiple facets of offensive security. From web app testing, to pen testing, burgeoning AI technologies in the offensive space, CTFs, and more. No matter your level of experience you will find great value in sessions throughout the day.
Workshops Gratis Day Agenda - Sun, June 8
| Workshops | Villages |
|---|---|
10am-12pm Eastern Daylight Saving Time (UTC-4) Artificial Infection: Using AI to Write Malware Keyloggers have long been a tool of choice for both penetration testers and cybercriminals. However, traditional options—like Meterpreter—are easily flagged by antivirus solutions, while writing a custom keylogger from scratch can be cumbersome and technically demanding. But with the rise of Generative AI, that challenge has all but disappeared. In this hands-on workshop, we'll harness the power of AI to build a fully functional keylogger from the ground up—no prior expertise required. Taking an iterative approach, we'll start with a basic keylogger before progressively refining it with quality-of-life enhancements such as output cleanup, window monitoring, timestamps, and clipboard capture. In the second half, we'll push the boundaries further, integrating advanced capabilities like persistence, trojanization, and built-in safety mechanisms—including self-destruct features, file encryption, and blacklisting protections. Whether you're a red teamer looking to sharpen your offensive toolkit or a security professional seeking to better understand and mitigate modern threats, this workshop will equip you with the skills to build, analyze, and defend against next-generation keyloggers—all with the power of AI. CRITICAL NOTE ABOUT THIS WORKSHOP: This is considered an advanced workshop that has a list of device requirements that must be met prior to attending the workshop. The requirements are:
Legal Disclaimer
| 10am-4pm Eastern Daylight Saving Time (UTC-4) Speed Run CTF | Web Workshops | Intro to CTFs Join SANS in this exciting opportunity to hone your skills in a village setting with your peers. We’ve planned an exciting multifaceted engagement to take place over the course of our day. Take part in any one or all parts of our SANS Villages! Speed Run CTF Think you're fast? Prove it.
Web Workshops ThreatShop is an interactive workshop designed to be a hands-on, practical experience to learn about web application security. Attendees will learn the top web vulnerabilities through a guided hands-on approach. Each exercise contains information on the vulnerability and an example of vulnerable code. After attempting the exercise you’ll have a walkthrough allowing you to complete the task on your own. Apply what you’ve learned in the Speed Run CTF! Topic Areas:
Intro to CTFs Capture the Flag (CTF) competitions range in style and difficulty but every CTF offers a wealth of knowledge. After an initial base-lining on CTF basics, the main focus of this workshop relates to how both technical and non-technical skills learned through participation can be applied to real-world scenarios. This workshop aims to excite participants about the value of CTFs and what they stand to gain by playing! Turn these fun puzzles into real-world skills to apply in your career. Workshop Outline:
|
1pm-3pm Eastern Daylight Saving Time (UTC-4) Follow the SSRF rabbit Server-Side Request Forgery (SSRF) vulnerabilities made it to the OWASP Top Ten in 2021, which is quite an accomplishment! But it was not a surprise as in previous years we have witnessed many devastating attacks where SSRF vulnerabilities were to blame. Even though SSRF vulnerabilities can be very devastating, at the core they are quite simple to understand and (sometimes) to exploit. In this workshop we’ll explain how SSRF vulnerabilities work and then we will dive into a lab that will require us to chain a number of vulnerabilities (SSRF included, of course) to achieve the final goal and find that white rabbit! Prerequisites: Familiarity with Burp suite and fuzzers such as ffuf, wfuf or feroxbuster | |
3:15pm-5:15pm Eastern Daylight Saving Time (UTC-4) Active Directory Privilege Escalation Workshop This session will guide attendees through various attack techniques used to escalate privileges within Active Directory environments, leveraging Empire version 5 to execute real-world attack scenarios. By the end of the workshop attendees will gain the skills to perform several privilege escalation techniques that can later be used in real-world environments. Participants will walk away with a fully functional AD lab environment in AWS, allowing them to replay and refine techniques on their own time. Additionally, attendees will gain a solid understanding of AD security weaknesses, empowering them to identify and mitigate these threats in real-world environments. |