Security Videos

GrapheneOS for Beginners with Sean Verity

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits –

AI's Impact on Network Engineers | LIVE AMA | Summer of CCNA

Join us for our 90 minute Sumer of CCNA session, today at 5PM ET!

this Raspberry Pi belongs on your wall

Initiative Gold Eagle - BHIS - Talkin' Bout [infosec] News 2026-07-20

Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.

Automate Volatility 3 Memory Analysis with This Tool

In this episode, we'll look at a tool that can run multiple Volatility 3 plugins simultaneously, automating your memory analysis and saving you valuable time during investigations. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 02:18 - Demo 🛠 Resources VolGolangWrapper:

I got inside FIFA’s Secret World Cup Broadcast Network

HackTheBox Logging

00:00 - Introduction 01:05 - Start of nmap 03:50 - Grabbing files off the open share, looking at logs and seeing an error message that contains an old credential 07:50 - Using BloodyAD to pull information from the account to see password last set, also running BloodHound 09:45 - Running Certipy, then using JQ to show me certificates with non-default groups/accounts in enrollment 12:25 - Going over Bloodhound, showing our SVC_RECOVERY can take over MSA_HEALTH$ 16:30 - Showing BloodyAD to allow ourselves read access to the MSA_HEALTH$ password, could also do Shadow Credentials 20:30 - Getting on the box with WinRM, discovering Monitor.ps1 file. Use COM to look at scheduled task 24:30 - Using MSFVenom to create a malicious DLL, zip it up and upload wait for the scheduled task to execute it 32:40 - Got access to Jaylee Clifton, using Rubeus tgtdeleg to get us a Kerberos ticket so we can run commands as them on our box 38:45 - Using Certipy to confirm the server is vulnerable to ESC17 41:45 - Looking at WSUS Config, discover things are pointed to wsus.logging.htb which does not exist 46:10 - Using Certipy to create a certificate that can impersonate wsus.logging.htb 49:00 - Setting up WSUKS to push a malicious windows update

Microsoft Spying in 2026 is crazy and VPN can't help!

HackTheBox - CCTV

00:00 - Introduction 00:40 - Start of nmap 03:00 - Logging into zoneminder with default credentials, flailing around trying to find the date this version was released 10:55 - Looking into the SQL Injection, lots of weird confusion around the date this was released... should of prepared more 13:30 - Getting this into SQLMap to test the injection, discovering it finds Time Based Blind which is really slow and unreliable 16:00 - Playing with the SQL Injection to get it to turn this into Boolean Based which is much better than time based 19:50 - Getting SQLMap to exploit this with boolean using prefix and suffix 24:10 - Cracking the password 30:00 - Got marks credentials, can login now 32:30 - Forwarding port 8765 back to us and accessing the MotionEye webserver, looking at configs and getting an admin password that lets us login 37:00 - RootPath1: Looking at public exploits, finding a command injection, testing it out and getting a shell 42:00 - RootPath2: Talk to the Web Control Port directly, poison that config and get command injection. Misspeak when i say camera, mean web control port 48:30 - Intended path to sa_mark, can tcpdump, capture packets get a credential and login 58:00 - Beyond Root: Using Claude to help me turn the blind injection into boolean.

LIVE AMA | Summer of CCNA | 07/09/2026

Join us for our 90 minute Sumer of CCNA session, today at 5PM ET!

HackTheBox - DevArea

00:00 - Introduction 00:45 - Start of nmap, discovering an open FTP Server, downloading the jar file. 04:45 - Using JadX to decompile the jar and then look at it in VSCode with Snyk, have to install Maven to see CVE's based upon libraries 11:00 - Looking into Apache CXF CVE's 15:40 - Using SoapUI to analyze the WSDL for us and make the request 19:15 - Showing we need to use the multipart/related functionality of HTTP in order to exploit this 23:20 - Have a File Disclosure, bruteforcing /proc/$pid/cmdline to get a list of running processes (which has hoverfly credentials). Then showing we could read directories from a File Disclosure which is somewhat unique to java. But this eliminates a lot of the bruteforce. 29:00 - Discovering a CVE within Hoverfly that gets us RCE 33:00 - Shell as dev_ryan 35:30 - Enabling commandline in SSH so we can do ~C in order to setup the SSH Tunnel to 7777 without exiting ssh 37:40 - Finding the secret syswatch uses to sign cookies, then giving ourself access to the applicaiton 42:10 - Finding command injection with syswatch, have to evade the filter, can use characters but not uppercase which breaks base64. Using xxd so we can have a hex cradle to get a shell 52:00 - Script we can execute as cron blocks symlinks but does not traverse them, doing a double symlink can evade the next filter and we can read files as root, reading the SSH Private Key.

Fable 5 is back.....run these prompts before July 12th

Fable 5 — the most powerful AI on earth — got pulled offline by the U.S. government three days after it launched, and it just came back. But for most of us the free window is only a handful of days (through July 7). So I sat down with Daniel Miessler, who's already living inside that window, to figure out the one thing that actually matters: what's worth asking it before it's gone. This isn't about doing bigger tasks. It's about pointing maximum intelligence at your deepest systems — your AI harness, the security of everything you've shipped, and the single hardest question about what you're actually building toward — so the payoff outlasts the window. Think of it like a super-intelligent alien that can only help for a week: you don't send it on errands, you have it rebuild your roads. In this video, you'll learn Daniel Miessler's exact list of meta-prompts to run on Fable 5: how to improve the harness that governs all your AI, how to audit the full attack surface of everything you've deployed, and how to ask the model to tell you what you're really shooting at. Whether you're deep into AI already or just trying not to waste the most capable model on earth, this is the prompt playbook for the week Fable is back.

How most people get hacked in 2026

HackTheBox - WingData

00:00 - Introduction 01:00 - Start of nmap 03:20 - Searching for vulnerabilities in Wing FTP Server 06:20 - Testing the RCE and running a command 09:30 - Weaponizing the POC to get a reverse shell 12:10 - Shell returned, grabbing the password hashes, discovering it uses a hard-coded salt and then cracking it 22:40 - Got the wacky password and can run a python script with sudo, searching for CVE's found one in tarfile 31:40 - Got our Elevated File Write working, finding safe files to get a shell, crontab did not work. But overwriting the script or sudoers.d file did work

Can Valorant brick YOUR PC? Is Vanguard safe?

Can Valorant brick your PC? Vanguard sys Driver which is the anti-cheat software for Riot Games has come under scrutiny after bricking a lot of cheating devices, how much control does Valorant have?

HackTheBox - Nanocorp

00:00 - Introduction 01:00 - Start of nmap 05:00 - Looking at the contact form, it behaves oddly so disregarding it 07:00 - Playing with the PHP File Upload to see if we can upload PHP Files 10:00 - Using wget to download an image and see when it was uploaded to the webserver 12:30 - Looking into CVE-2025-24071, which we can create a .library-ms file that leaks NTLMv2 Hashes 17:30 - Cracking the web_svc NTLMv2 hash 19:50 - Using impacket's getTGT, then running RustHound and discovering we can take over another account via changepassword 25:00 - Using BloodyAD to add ourself to a group and then change the password 31:40 - Using WinRMexec to get a shell because Evil-WINRM doesn't support KRB+SSL Auth 36:30 - WinRM Shell returned, discovering we can write php scripts to the web directory but unfortunately this doesn't get us seimpersonate privileges 40:15 - Discovering CheckMK is running on the box, finding a privesc CVE 45:50 - Looking into the registry to discover which cached MSI is CheckMK 52:00 - Using RunasCS to switch to the web_svc user because we need an interactive login 01:04:30 - Changing the PID in the POC Script to be much lower which gets us the shell

Certification Questions | LIVE AMA | Summer of CCNA | 06/18/2026

Join us for our 90 minute Sumer of CCNA session, today at 5PM ET!

Certification Questions | LIVE AMA | Summer of CCNA | 06/18/2026

Join us for our 90 minute Sumer of CCNA session, today at 5PM ET!

I was wrong about VPNs

How the USN Journal Really Works

Have you ever wondered how you can look at the USN Journal on a live and running system? In this episode, we'll dive in to see how it actually works and whether it matches what we’ve been taught. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:04 - Demo 🛠 Resources NTFS Journal Forensics: