Must-Watch InfoSec Talks of 2020

Zseano goes through some of his favourite findings and discusses how he went about finding them.

This talk is perfect for anyone who has just started, or is about to start bug bounties. More seasoned hackers will also glean some tips to improve their workflow. Repping the BugCrowd community.

Always wanted to know how to get into bug bounty? Katie lays it all out for you. It’s introductory, helpful for anyone interested in bug bounties but not sure what to do next! Her community is awesome.

The Bug Hunter’s Methodology is an ongoing yearly installment on the newest tools and techniques for bug hunters and red teamers. Jason explores both common and lesser-known techniques to find assets for a target. Check out his recon interview with NahamSec.

Rhys walks you through hard-hitting bugs, and teaches you the basics of a decision making model that will hopefully lead to bigger scopes and larger rewards.

Everything you need to know about wordlists. Tom expertly teaches you how to create target specific, custom wordlists using various sources and tools. Check out Tom’s recon talk.

Inti tends to look for a very particular range of vulnerabilities, more often than not related to e-mail systems. He’ll share some of his findings in this talk.

Tom demonstrates how you can use Bash for bug bounty. It’s a shell that wraps a kernel so you can launch processes. Learn how to quickly and efficiently automate tasks, and make your own tools.

A somewhat controversial topic in bug bounty, looking at out-of-scope assets. This is not about doing actual hacking on those out-of-scope assets, it’s about doing recon on them in special ways in order to find bugs on the in-scope assets.

HTTP requests are traditionally viewed as isolated, standalone entities. James introduces techniques for remote, unauthenticated attackers to smash through this isolation and splice their requests into others, harvesting over $70k in bug bounties.

Want to know how you become a HackerOne Most Valuable Hacker (get awarded multiple awards and win the Best Team Award) without writing a single line of code? Well this is how STÖK did it. In this talk he touches on his methodology, his mindset and the importance of collaboration.

This talk will take you through finding new attack surface, performing multiple types of test against those targets, and sending real-time alerts — all on a continuous basis using automation from a cloud-based Linux host. It really brought home the Unix philosophy for me.

Add more value to your engagements, better prepare employers and their employees, and learn how to create pretexts that your targets are much less likely to question.

Have you ever felt like no matter how much sleep you get, you feel exhausted? Struggle to concentrate? Having trouble balancing work and personal life? Or perhaps feel your work is your life? Then this talk is for you.

Sixty percent of hackers don’t submit vulnerabilities due to the fear of out-of-date legislation, press coverage, and company’s misdirected policies. This talk will focus on the current landscape for hacker rights and what is needed to improve it.

Jonathan demonstrates new exploit techniques that leverage Unicode normalization behavior to bypass URL security filters. In some cases it even allows one domain to impersonate another.

Louis covers examples of vulnerabilities that are not necessarily obvious. Taking a look at some snippets in Golang, Ruby, Python. Covering Golang Tempfile, Golang path.Clean, Startswith and URL, and Unicode.

The Electronic Frontier Foundation is the leading nonprofit defending digital privacy, free speech, and innovation for 30 years and counting. Eva Galperin explains what the EFF stands for, who they help, and what they do. Her work is primarily focused on providing privacy and security for vulnerable populations around the world.

Heath (the Cyber Mentor) talks about his cybersecurity journey, and touches on his upbringing. I found his story to be inspiring and motivational. He provides you with life lessons and actionable tips, so you can start your own journey.

Jason shows you how to combine OSINT, marketing technology, and a hacker/social engineer mindset to job hunting. Look at job hunting differently and get the career of your dreams.