To say that 2020 was a difficult year is an understatement. What got me through it were friends, family, and community. Luckily for me, the latter takes place on Discord and Twitch.

This was also the year where virtual conferences became the new norm. Already being familiar with moderating for NahamSec, I was asked to participate in several cons. It was a great experience.

A plus of this new trend was that the barrier of entry was lowered, allowing more people access to amazing talks.

I’ll list the ones that stood out to me. Make sure to follow their social media and show your support!

Zseano, web app hacker + founder BugBountyHunt3r @ VirSecCon

Unique Mindset - Hacking with Zseano

Bug bounty

Zseano goes through some of his favourite findings and discusses how he went about finding them.

twitter icon

Breanne Boland, appsec engineer @ Levelup0x07

How to do Chrome Extension code reviews

Bug bounty

A look at how to do effective code reviews on Chrome extensions, what tools you can use to perform them, and some common tells of security issues.

Hakluke, manager training + QA Bugcrowd @ Levelup0x07

How to Crush Bug Bounties in the first 12 Months

Bug bounty

This talk is perfect for anyone who has just started, or is about to start bug bounties. More seasoned hackers will also glean some tips to improve their workflow.

twitter icon

Katie Paxton-Fear, lecturer + PhD @ GrayHat

How to Get Into Bug Bounty

Bug bounty

Always wanted to know how to get into bug bounty? Katie lays it all out for you. It's introductory, helpful for anyone interested in bug bounties but not sure what to do next!

twitter icon

Jason Haddix, head of security + risk management Ubisoft @ Red Team Village

The Bug Hunter’s Methodology v4

Bug bounty

The Bug Hunter’s Methodology is an ongoing yearly installment on the newest tools and techniques for bug hunters and red teamers. Jason explores both common and lesser-known techniques to find assets for a target.

Rhys Elsmore, product engineer Heroku + firefighter @ levelup0x06

Recognition Primed Bug Bounty Hunting

Bug bounty

Rhys walks you through hard-hitting bugs, and teaches you the basics of a decision making model that will hopefully lead to bigger scopes and larger rewards.

twitter icon

TomNomNom, tech lead security research Detectify @ NahamCon2020

Who, What, Where, When, Wordlist

Bug bounty

Everything you need to know about wordlists. Tom expertly teaches you how to create target specific, custom wordlists using various sources and tools.

securinti, community manager Intigriti @ NahamCon2020

You've Got Pwned - Exploiting E-Mail Systems

Bug bounty

Inti tends to look for a very particular range of vulnerabilities, more often than not related to e-mail systems. He'll share some of his findings in this talk.

TomNomNom, tech lead security research Detectify @ VirSecCon2020

Bug Bounties With Bash

Bug bounty

Tom demonstrates how you can use Bash for bug bounty. It's a shell that wraps a kernel so you can launch processes. Learn how to quickly and efficiently automate tasks, and make your own tools.

twitter icon

Jr0ch17, sr. application security advisor Videotron @ [email protected]

Beyond the Borders of Scope

Bug bounty

A somewhat controversial topic in bug bounty, looking at out-of-scope assets. This is not about doing actual hacking on those out-of-scope assets, it's about doing recon on them in special ways in order to find bugs on the in-scope assets.

twitter icon

Don't leave, there's more content below! 👇

d0nutptr, lead security engineer graplsec @ VirSecCon 2020

Practical Exploitation of Math.random on V8

Bug bounty

A talk about V8's Math.random, what it is and how to break it practically. V8 JavaScript is used in Chrome and Node.js. PoC || GTFO.

James Kettle, head of research PortSwigger @ Black Hat

HTTP Desync Attacks - Request Smuggling Reborn

Bug bounty

HTTP requests are traditionally viewed as isolated, standalone entities. James introduces techniques for remote, unauthenticated attackers to smash through this isolation and splice their requests into others, harvesting over $70k in bug bounties.

STÖK, educational content + hacker Truesec @ [email protected]

How I became a HackerOne MVH without writing a single line of python

Bug bounty

Want to know how you become a HackerOne Most Valuable Hacker (get awarded multiple awards and win the Best Team Award) without writing a single line of code? Well this is how STÖK did it. In this talk he touches on his methodology, his mindset and the importance of collaboration.

twitter icon

Daniel Miessler, cybersecurity expert + writer @ Red Team Village

Mechanizing the Methodology

Bug bounty

This talk will take you through finding new attack surface, performing multiple types of test against those targets, and sending real-time alerts — all on a continuous basis using automation from a cloud-based Linux host. It really brought home the Unix philosophy for me.

twitter icon

Alethe Denis, security consultant + DefCon black badge @ conINT

Phishy Little Liars - Pretexts That Kill

OSINT

Add more value to your engagements, better prepare employers and their employees, and learn how to create pretexts that your targets are much less likely to question.

twitter icon

Chloé Messdaghi, vp strategy Point3 security @ OWASP DevSlop

The Act of Balancing - Burnout in Cybersecurity

InfoSec

Have you ever felt like no matter how much sleep you get, you feel exhausted? Struggle to concentrate? Having trouble balancing work and personal life? Or perhaps feel your work is your life? Then this talk is for you.

twitter icon

Chloé Messdaghi, vp strategy Point3 security @ WWHF Deadwood 2020 Virtual

A Quick Guide to Your Hacker Rights

InfoSec

Sixty percent of hackers don’t submit vulnerabilities due to the fear of out-of-date legislation, press coverage, and company's misdirected policies. This talk will focus on the current landscape for hacker rights and what is needed to improve it.

twitter icon

Jonathan Birch, senior security software engineer Microsoft @ Black Hat

HostSplit - Exploitable Antipatterns in Unicode Normalization

InfoSec

Jonathan demonstrates new exploit techniques that leverage Unicode normalization behavior to bypass URL security filters. In some cases it even allows one domain to impersonate another.

website icon

Louis Nyffenegger, security engineer + founder PentesterLab @ levelup0x06

Code that gets you pwn(s|'d)

InfoSec

Louis covers examples of vulnerabilities that are not necessarily obvious. Taking a look at some snippets in Golang, Ruby, Python. Covering Golang Tempfile, Golang path.Clean, Startswith and URL, and Unicode.

Eva Galperin, director cybersecurity EFF @ AppSecCali

The Electronic Frontier Foundation (Closing Keynote)

InfoSec

The Electronic Frontier Foundation is the leading nonprofit defending digital privacy, free speech, and innovation for 30 years and counting. Eva Galperin explains what the EFF stands for, who they help, and what they do. Her work is primarily focused on providing privacy and security for vulnerable populations around the world.

twitter icon

Heath Adams, founder TCM Security @ CIA

My Journey to Cybersecurity (Keynote)

InfoSec

Heath (the Cyber Mentor) talks about his cybersecurity journey, and touches on his upbringing. I found his story to be inspiring and motivational. He provides you with life lessons and actionable tips, so you can start your own journey.

twitter icon

What's buzzing?

If you want to work together, have a question, or if you just want to say hi, feel free to reach out on Twitter.