Wild West Hackin' Fest - Deadwood 2024

One of the most important foundations in cloud is identity and access management. Striking the right balance of velocity, guardrails, and acceptable risk is incredibly challenging.  Fortunately it’s easy to close those gaps with open source tooling and cloud provider tools. In this workshop we’ll explore CI/CD workflows, IAM Policy creation, and continuous auditing for the AWS Cloud. Attendees will leave the workshop with a firm understanding of how to integrate AWS with Github actions, AWS Codebuild, Codepipeline, and more. Don’t miss this session with Antisyphon instructor Andrew Krug. Attendees should bring a laptop with any modern Linux virtual machine or MacOS.

Dive into the dynamic world of Open Source Intelligence (OSINT) with this two-hour workshop designed to give you a tantalizing taste of practical online investigations and threat hunting. Led by a seasoned professional, this immersive session offers a condensed yet impactful introduction to essential OSINT techniques.

Experience the power of hands-on learning as you engage in live demonstrations, exploring key concepts such as operational security (OpSec), search engine queries, username and phone number lookups, social media reconnaissance, breached records analysis, government data exploration, network reconnaissance, historical records, and essential documentation, all within the span of this engaging workshop. Through interactive exercises and guided discussions, participants will gain a glimpse into the world of OSINT.

Join us for this brief yet immersive journey into the realm of online investigations and threat hunting, and take your first step towards mastering the art of OSINT.

"A Hacker's Guide to Mindfulness" aims to explore the intersection of mindfulness practices and the hacker mindset. Hacker’s are already uniquely trained to question assumptions and just “see what happens”; this is the core curiosity needed to unlock the cheat codes in life via various mindfulness practices.

This workshop will give attendees an introduction to a large amount of mindfulness practices relating them to things most of us do every day in our infosec jobs. We won't just talk about these techniques, we will go through these exercises so the attendees can do them at least once together and have a solid starting point to expand their practice after the workshop.

Workshop topics:
* Core Programming: Understanding how our beliefs were programmed into us at an early age and what we can and should do about that.
* Limiting Beliefs: Identifying and overcoming limiting beliefs that hinder personal and professional growth.
* Brules (Bullshit Rules): Examining and challenging societal and industry norms that may be limiting or outdated.
* Meditation: Exploring different meditation practices and their benefits for mental clarity, stress reduction, and improved focus.
* Breathwork: Techniques for using breathwork to manage stress, increase energy levels, and enhance mindfulness.
* Burnout: Strategies for preventing and recovering from burnout in the fast-paced world of hacking and programming.
* Distraction: Techniques for minimizing distractions and increasing productivity in coding and problem-solving tasks.
* Life Purpose: exploring who am I?, where am I going? and a different approach to goal setting
* Spiritual DevOps: Applying principles of DevOps to spiritual growth, including continuous improvement and collaboration.

Discovering and exploiting Insecure Deserialization vulnerabilities is not a simple task. In some cases, testers are fortunate that the work has been done for them, and a known exploit can be leveraged to exploit this vulnerability. But honestly, that's no fun, and the reality is that sometimes it'll be on the tester to do the hard work. In this workshop, I will take participants on a journey through Insecure Deserialization. Together, we'll discover a novel Insecure Deserialization vulnerability in a custom application, and step through the process of building and executing a zero-day exploit to compromise the affected application and server. At each bend in the trail, we'll explore the specifics of the process and the tools needed, and seek to gain an understanding of how and why developers create these dangerous vulnerabilities. Our journey will end with a discussion about the challenges of remediating Insecure Deserialization flaws, and participants will step back into reality with a new perspective of this potent and mysterious vulnerability.