schedule_2026

Dhiyaneshwaran Balasubramaniam

Aman Rawat

Every organization relies on third-party vendors, open-source packages, and CI/CD tools to build and deliver software. In this session, we'll learn how to identify and map these external dependencies, understand the trust relationships between them, and discover potential security risks. Through practical demonstrations, attendees will see how issues such as dependency confusion, insecure GitHub Actions workflows, and vendor-related weaknesses can become entry points for supply chain attacks. The goal is to help security teams find and fix these risks before attackers do.

Marcelle Lee

WT

Will Thomas

Your mission: Stop chasing single indicators and start profiling the actual behavior of the adversary. From cybercriminals to state-sponsored actors, every threat group leaves a unique operational blueprint. Whether you are an OSINT hobbyist or an experienced cyber intelligence analyst, come ready to dissect real-world attack behaviors, translate data into actionable insights, and master the art of OSINT-powered TTP research. This hands-on workshop explores the world of cyber threat actors and the open-source intelligence (OSINT) methodologies used to unmask their behavioral patterns. Rather than focusing strictly on fleeting indicators of compromise (IoCs) like file hashes or IP addresses, participants will learn how to extract, analyze, and profile an adversary's true Tactics, Techniques, and Procedures (TTPs). Through interactive, real-world case studies, attendees will learn how to analyze public incident reports, open intelligence repositories, and external datasets to map out an actor's operational playbook. Using frameworks like MITRE ATT&CK and the Diamond Model, participants will practice pivoting from technical data to strategic threat profiles—equipping them with the research skills needed to predict and counter adversarial behavior without ever needing an enterprise budget. Workshop Structure: Module 1: Foundations of Threat Intelligence & Actor Profiling The Threat Landscape: Definitions and categories of actors (APTs, cybercriminals, hacktivists, insiders). Understanding Adversarial Motivation: Moving beyond what happened to why and how actors select their targets and techniques. Intelligence Categorization: Differentiating between Strategic, Operational, and Tactical/Technical intelligence, and how TTP research feeds all three. Module 2: The Analytical Frameworks MITRE ATT&CK Deep Dive: Navigating the matrix, understanding sub-techniques, and avoiding common mapping pitfalls. The Diamond Model: Connecting the four core nodes (Adversary, Capability, Infrastructure, Victim) to tell a complete campaign story. The Pyramid of Pain: Understanding why tracking TTPs inflicts the maximum cost on the adversary compared to trivial indicators. Module 3: Dissecting the Data (Case Study Analysis) Deconstructing DFIR Reports: Walking through real-world incident examples (e.g., Gootloader campaigns, ransomware operations) to extract behavioral indicators from public write-ups. Safe Analysis Practices: Utilizing basic web-based OSINT tools (urlscan.io, Browserling, CyberChef) to safely evaluate delivery mechanisms and landing pages without compromising investigator safety. Module 4: Live TTP Research (Group Exercise) The Scenario: Groups are given an initial, ambiguous threat brief or a raw dataset from a recent campaign. The Analysis: Using open-source resources, teams will collaborate to identify the actor's threat components (who, what, where, when, how, why). The Playbook: Teams will map their findings into the MITRE ATT&CK Navigator, build a comprehensive threat intelligence profile, and present their adversarial playbook to the room.

Mark Gaddy

Reconnaissance is the foundation of every successful engagement but fragmented tooling, manual chaining, and missed data leave gaps that cost you findings. BBOT (Bighuge BLS OSINT Tool) was built to solve that. Developed by Black Lantern Security, BBOT is a recursive, event-driven OSINT framework that replaces the traditional phased approach with continuous, real-time discovery every new piece of data is immediately fed back into the scan engine to uncover what linear workflows miss. This is a fully hands-on workshop. Attendees will install and configure BBOT, then run it live against their own scoped bug bounty targets turning the session into real reconnaissance rather than a slide-driven demo. We'll cover BBOT's 100+ module architecture spanning subdomain enumeration, cloud asset discovery, email harvesting, web spidering, and vulnerability scanning with Nuclei, all chainable in a single command and firing recursively in real time. Along the way we'll dig into scope management, passive vs. active recon tradeoffs, and the web hacking modules that can point you toward real findings. By the end of the session, attendees will walk away with actual scan output from a live target, a repeatable BBOT-driven recon workflow they can drop into their next program, and a clear understanding of how to triage findings into real submissions. Whether you're new to automated recon or a seasoned bug bounty hunter still stitching tools together by hand, this workshop will change how you approach OSINT at scale. Module 1 — Why BBOT? The Problem with How We Recon Now The fragmented toolchain problem: Amass → Subfinder → httpx → manual grep Why phased OSINT misses things — and what recursive, event-driven recon solves BBOT's origin at Black Lantern Security and design philosophy Quick architecture overview: modules, events, presets, scope 3.0 Updates - Rustification of HTTP and DNS Q&A / audience skill check Module 2 — Getting Oriented: Installation, Config & First Scan Verify install and run bbot --help Listing and exploring modules with bbot -l Understanding flags vs. modules vs. presets Exercise 2.1: Run your first subdomain scan Reading and understanding BBOT output Scan output folders, naming conventions, and where data lives Module 3 — Subdomain Enumeration Deep Dive How BBOT's recursive engine finds more than traditional tools Passive vs. active enumeration — when to use each Subdomain mutations and wordcloud usage Exercise 3.1: Full active subdomain enum Module 4 — Going Deeper: Cloud, Email & Asset Discovery Cloud enumeration: S3 buckets, Azure blobs, GCP assets Email harvesting for org footprinting Combining flags for broader discovery Exercise 4.1: Run a combined cloud + email + subdomain scan Identifying misconfigured or exposed cloud assets in output Discussion: how these findings translate to bug bounty submissions Module 5 — Web Hacking Modules & Vulnerability Scanning Overview of BBOT's web module suite: httpx, gowitness, wappalyzer, nuclei Web spidering for email, secrets, and exposed paths Nuclei integration — what it scans for and how to interpret results Exercise 5.1: Full web scan with screenshots Exercise 5.2: Kitchen sink scan (instructor-guided, safe target only) Setting expectations: BBOT points you at the doors — you still have to kick them open Module 6 — Triage, Workflow & What Happens After the Scan How to structure your post-BBOT workflow: what to investigate first Prioritizing findings by severity and exploitability Avoiding common pitfalls: rate limiting, duplicate findings, out-of-scope mistakes Building a repeatable bug bounty recon workflow around BBOT Scheduling and automating recurring scans for continuous monitoring Wrap-Up & Q&A Recap of key takeaways Recommended next steps and resources GitHub, docs, and community links Open Q&A

Alessandra Rizzo

Ariel Ropek

North Korean threat actors are running one of the largest software supply chain campaigns ever observed in the npm ecosystem, and the infrastructure hiding it in plain sight is discoverable through open-source reconnaissance alone. This workshop walks participants through how we mapped a live DPRK delivery network targeting cryptocurrency developers, starting from a single malicious npm package and expanding outward to uncover 50+ malicious packages, 100+ GitHub repositories, 30+ throwaway npm personas, 20+ rotating C2 domains, and a social media promotion layer spanning X and Reddit. The investigation surfaces three malware families: PromptMink, ClipViper, and OtterCookie, which operate through what initially appeared to be separate campaigns but share overlapping infrastructure, actors, and delivery techniques. The workshop focuses on the recon methodology behind the mapping through six hands-on modules: - Dependency chain tracing: How malicious payloads hide one to three hops deep in transitive npm dependencies, evading surface-level code review and automated scanners - Actor network pivoting: Using email patterns, SSH key reuse, shared C2 infrastructure, and build artifact fingerprints to link 30+ throwaway npm accounts into operational clusters - Identity spoofing detection: How to catch developer identity theft through timezone offset analysis - GitHub delivery front reconnaissance: Tracing 40+ fork chains across front organizations all serving identical malicious payloads behind bot-inflated star counts and SEO-stuffed descriptions - Social media promotion mapping: Connecting verified X accounts and Reddit personas to the distribution layer, and observing how the social infrastructure persists even after GitHub takedowns - Evasion tracking in real time: Documenting the operators' shift from obfuscated JavaScript to on-chain payload storage via Solana, where the npm package contains zero malicious code and the payload lives in a blockchain account beyond the reach of static analysis Participants work directly with actionable IoCs (packages, C2 domains, SSH keys, YARA rules, detection queries) and leave with a breakdown of how current Contagious Interview and Contagious Trader toolsets are converging into a unified threat. Attendees will leave with a repeatable framework for mapping supply chain malware delivery networks using open-source data: package registries, Git metadata, DNS records, social media artifacts, and cross-referencing with community threat feeds.

Jeff Foley

Attack Surface Management (ASM) lives or dies on a deceptively simple question: who owns this? Without reliable attribution, an asset inventory is just a pile of hosts, domains, certificates, and cloud endpoints—with no defensible way to scope an organization’s true digital footprint or separate first-party infrastructure from vendors, subsidiaries, acquisitions, joint ventures, and brand portfolios. This talk dives into the real-world challenge of attributing internet-exposed assets to legal entities, not just names. Corporate identity is messy: organizations operate under trade names, localized spellings, legacy names, and jurisdiction-specific registrations. Meanwhile, the internet leaks ownership signals through fragmented, lossy metadata—RDAP/WHOIS, certificate subject/issuer fields, ASN registrations, DNS TXT verification records, trademark references, and public corporate registries. Each source is incomplete on its own; together they can still conflict, drift over time, and create duplicate “identities” that quietly degrade attribution accuracy. Using the OWASP Amass Project as a concrete reference point, we’ll walk through an attribution-centric discovery workflow: collecting signals, normalizing entity identity, resolving aliases across jurisdictions, and scoring confidence to decide when to merge, when to split, and when to escalate for analyst review. We’ll also explore how attribution errors propagate into ASM outcomes—missed scope, false positives, and blind spots in third-party exposure—and how disciplined entity modeling can turn noisy OSINT into a repeatable system of record. Attendees will leave with practical techniques for improving attribution quality, a mental model for entity resolution, and actionable ideas for making ASM outputs trustworthy enough to drive risk decisions.

Lenin Alevski

Everyone is talking about vibe coding, but most examples stop at TODO apps, landing pages, or simple CRUD applications. This workshop goes far beyond that. Participants will use modern AI coding agents to build a real-world Open-Source Intelligence (OSINT) platform from scratch designed to aggregate and visualize intelligence data on an interactive 3D globe. Rather than simply watching a demo, attendees will actively build the application alongside the instructor while learning the mindset, prompting techniques, and engineering workflow required to successfully collaborate with AI coding assistants. The workshop begins with the fundamentals of vibe coding: what it actually is, why it works, where it fails, and how to communicate effectively with AI agents. Participants will learn practical prompting strategies, iterative development techniques, and methods for breaking large software systems into manageable tasks that AI can successfully implement. From there, we'll progressively build an intelligence dashboard capable of consuming and visualizing multiple real-time OSINT sources, including flight tracking, satellite positions, earthquake feeds, maritime traffic, and other publicly available intelligence signals. Along the way, participants will generate modern user interfaces, integrate external APIs, debug AI-generated code, and learn when to trust the model and when not to. Rather than treating AI as a code generator, this workshop teaches attendees how to use AI as an engineering partner capable of dramatically increasing development velocity while still maintaining high-quality software. By the end of the workshop, every participant will have: 1. A working open-source intelligence platform running locally 2. A practical workflow for building complex software using AI coding agents 3. A reusable prompting framework applicable to future projects 4. Experience integrating multiple public OSINT data sources 5. An understanding of the strengths and limitations of AI-assisted software development 6. A roadmap for continuing to extend the platform after the workshop The workshop is based on the open-source project: https://github.com/Alevsk/respondent-community # `Workshop Outline (150 Minutes)` ## `Part 1 — Introduction to Vibe Coding (20 min)` - `What vibe coding actually means` - `Mental models for collaborating with AI` - `Selecting the right AI model for the task` - `Understanding agentic coding workflows` - `Common mistakes and misconceptions` --- ## `Part 2 — Prompt Engineering for Software Development (25 min)` - `Structuring prompts that produce maintainable code` - `Breaking large systems into incremental tasks` - `Designing software through conversation` - `Iterating instead of regenerating` - `Knowing when to intervene manually` --- ## `Part 3 — Building the Intelligence Platform (75 min)` `Participants will build the platform together while learning how to:` - `Generate a modern frontend` - `Create a real-time 3D globe visualization` - `Integrate multiple public OSINT APIs` - `Display flights, satellites, earthquakes, ships, and additional intelligence feeds` - `Build reusable UI components with AI` - `Debug AI-generated code` - `Refactor and improve generated implementations` - `Continue extending the application using AI as a development partner` --- ## `Part 4 — Lessons Learned & Advanced Techniques (20 min)` - `What AI does well` - `Where AI still struggles` - `Managing technical debt` - `Building larger projects with AI` - `Cost optimization strategies` - `Recommended workflows and tooling` - `Future directions for AI-assisted engineering`