Red Team and Bug Bounty Conference

Omar Santos: Welcome and Introductions (10 minutes)

Jason Haddix: Adversarial Reconnaissance (30 minutes)

This segment will dive into the world of adversaries, red teamers, and bug bounty hunters and feature common tactics, techniques, and procedures (TTPs) used for extensive recon on their targets. Taught using live demos, the workshop will be performed on LIVE targets, so fasten your seatbelts! This workshop is a must-see for anyone in the offensive security space.

• Explore the TTPs used when targeting an organization and its people.
• Understand email acquisition, technology profiling, external attack surface, and more.
• See common tools and tips and tricks in the recon cyber kill chain in live hands-on labs.

Jason Haddix is the CISO and “Hacker in Charge” at BuddoBot, a world-class adversary emulation consultancy. He has a distinguished 15-year career in cybersecurity, previously serving as the CISO of Ubisoft, head of Trust/Security/Operations at Bugcrowd, director of penetration testing at HP, and lead penetration tester at Redspin. Jason has also authored many talks on offensive security methodology, including speaking at DEF CON, Black Hat, OWASP, RSA, Nullcon, SANS, IANS, BruCon, Toorcon, and many more. Find him on X / Twitter @jhaddix

Omar and Jason Discussion + Q&A (15 min)

Break – 10 mins

Jeff Foley: Exploring the Future of Attack Surface Mapping and the OWASP Amass Project (30 minutes)

Explore the future direction of the Amass Project and its potential to advance the field of ethical hacking and cybersecurity with the project’s founder, Jeff Foley. Amass is a cutting-edge open-source intelligence collection engine designed to enable cybersecurity professionals to discover and map the attack surface of their organizations' exposures on the Internet. This segment will explore

• How this technology can be leveraged to help organizations identify potential vulnerabilities and mitigate risks.
• How attack surface mapping—the process of identifying all the points of entry that an attacker could use to penetrate a target organization—enables security programs to proactively identify and address potential weaknesses in their security postures.
• Learning through a demonstration of attack surface mapping, highlighting its features and capabilities, and discussing how it can be integrated into existing security workflows.

Jeff Foley served in the United States Air Force Research Laboratory from 2001 to 2017 as a contractor specializing in cyber warfare research and capabilities engineering. He was also a subject matter expert for Offensive Cyber Warfare Research & Development and director of penetration testing at Northrop Grumman. Jeff has developed penetration testing training curriculum and taught trainers to utilize the material across the international organization. He has also taught and spoken at various academic institutions on the topics of offensive security and penetration testing during his time in this profession. Find him on X / Twitter @jeff_foley

Omar and Jeff Discussion + Q&A (15 min)

Break – 10 mins

Sandra Stibbards: OSINT for Hackers: Unveiling the Power of Open-Source Intelligence (30 minutes)

In the ever-evolving digital landscape, information is the key to unlocking new possibilities and opportunities. Open-Source Intelligence (OSINT) has emerged as a valuable tool for hackers and cybersecurity enthusiasts, providing a wealth of publicly available information to enhance their understanding and exploit potential vulnerabilities. Join us for an immersive presentation as we delve into the world of OSINT for hackers, exploring its capabilities, methodologies, and real-world applications. This segment will

• Explore the real-life concepts of OSINT and its role in reconnaissance as well as how to target and exploit vulnerabilities
• Discover a wide range of OSINT sources, including social media platforms, publicly accessible databases, and online forums
• Teach through hands-on exercises how to effectively gather, analyze, and leverage publicly available information to gain an advantage in your cybersecurity endeavors
• Apply OSINT techniques to a controlled environment

Sandra Stibbards has worked extensively as a private investigator and owns Camelot Investigations. Specializing in financial fraud investigations, competitive intelligence, counterintelligence, business and corporate espionage, social engineering, and more, she is an investigative expert who has worked both domestically and internationally. Find her on X / Twitter @camelotinv

Omar and Sandra Discussion + Q&A (15 min)

Class Q&A (15 min)