Curated cybersecurity video content, discussions, interviews, presentations, and educational material from YouTube.
328 articles
The speakers discuss how military personnel’s Strava activity can reveal sensitive locations through repeated routes and global heat maps, and mention a run recorded aboard an aircraft carrier.
A red-team tutorial demonstrates password spraying against an intentionally misconfigured Active Directory lab using Sliver C2 and NetExec, including password-policy checks, LDAP user enumeration and a SOCKS5 pivot. The presenter reports obtaining domain-admin access.
The video describes two Unitree robot flaws combined into Unibleed, enabling remote code execution and worm-like spread within Bluetooth range. Unitree patched a cloud ownership issue; the Bluetooth-chain fix remained unconfirmed. Two TeamPCP members were charged.
Troy Woda outlines an analyst-led approach to network threat hunting, covering sensor placement, traffic enrichment, behavioral analysis and the potential use of AI-assisted tooling.
Drawing on his cybersecurity career, the speaker recommends starting internships in freshman year, building systems fundamentals and hands-on labs, using certifications to support real projects, and protecting focused practice as AI takes on some entry-level tasks.
A malware-analysis lesson demonstrates using PE-Sieve to dump a suspended packed process from memory, then explains alignment, import-table, and entry-point issues that remain when analyzing the unpacked code.
A lab walkthrough demonstrates using Mythic C2 and unconstrained delegation to capture a domain controller ticket, perform DCSync, and revoke the risky delegation setting.
Security Now discusses limitations in AI-generated security patches, proposes an untested approach to detecting prompt injection, and reviews researchers' findings of remote-command implants in ZBT routers.
Threat Wire reports malicious Rust crates distributed through a compromised maintainer repository, a patched arbitrary-file disclosure flaw in Record Box, and attacks disrupting water utilities and a British power plant.
HackerOne VP of Operations Tony Lee says effective bug bounty programs pair AI-assisted triage with human verification, strong researcher communities, provider guidance and executive backing from discovery through remediation and rewards.
Two penetration testers recount their arrests during a contracted Iowa courthouse security assessment, the dispute over authorization, and the dismissal of all charges in January 2020.
The panel discusses U.S. grid supply-chain risks, reported phone-location tracking in the Iran conflict, a disrupted botnet and a healthcare breach attributed to Shiny Hunters.
The video proposes five practical cybersecurity projects: a network analysis lab, secure containerization, a self-hosted password manager, Kubernetes security exercises, and a home SOC. It also emphasizes Python, SQL, and documenting project work.
Bo Bulock demonstrates AI-assisted cloud security workflows for tenant enumeration, scanner analysis and access-policy review, and discusses local models, sensitive data and the need for human review.
The hosts discuss password and account-security practices, then describe an unverified claim that AliExpress uses browser audio processing to fingerprint devices. They also debate AI's effect on cybersecurity jobs.
The lesson demonstrates how altered UPX section names or packed-header data can make UPX’s unpacker fail even while the sample still runs. It highlights hash changes after unpacking and recommends watching for anomalies in analysis pipelines.
Security Now explores research linking prompt injection to LLM role confusion, explains how coding agents can expose credentials, and discusses Anthropic’s announced expansion of Mythos 5 access for defenders.
HackerOne says H1 Remediation links validated vulnerability findings to root-cause analysis, patch plans and verification, then routes them into developer issue trackers and AI systems to help address growing critical-vulnerability backlogs.
The panel discusses AI-assisted Linux debugging, reported Shiny Hunters targeting, silent-audio browser fingerprinting and an Iran-linked attack that reportedly shut down a UK power plant.
A video demonstrates a C loader downloaded over HTTP that retrieves reverse-shell shellcode over SMB and runs it in memory on Windows. The presenter reports Defender alerted but did not stop the shell; testing was limited to Defender.
Researcher Johan demonstrates how prompt injection in M365 Copilot can poison user memory and leak secrets through remote font requests. The chain combines a CSP bypass with persistent instructions that trigger in later conversations.
ThreatWire reports Apple notifications warning iPhone users of targeted mercenary spyware, a self-propagating worm tied to a compromised npm package, and updates on cyber policy, a retail breach, and security changes.
A reverse-engineering lesson compares packed and original PE files, showing how section metadata, memory mappings, entry-point information, and entropy can help identify packing and guide unpacking.
A sponsored hands-on review tests SafeLine WAF against SQL injection, XSS, directory traversal, command injection and HTML injection, then demonstrates proxying Mythic C2 traffic and protecting file access with authentication. The tester reports several protection gaps.
