Security Videos

Firefox JIT Bug - Pwn2Own Documentary (Part 3)

The First Exploit - Pwn2Own Documentary (Part 2)

The World's Hardest Hacking Competition - Pwn2Own Documentary (Part 1)

Tracking Program Execution with a Little Known Registry Key

In this episode, we’ll take a look at another obscure, registry-based execution artifact that may help you fill in yet another piece of the puzzle. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:33 - About Registry Hives 02:10 - Demo 🛠 Resources FeatureUsage — Evidence of Execution:

The Truth About Windows Explorer Timestamps

In this episode, we’ll uncover how Windows Explorer really retrieves file timestamps when you browse a directory of files. Learn why these timestamps actually come from the $FILE_NAME attribute in the parent directory’s $I30 index, not from $STANDARD_INFORMATION, and how NTFS structures like $INDEX_ROOT and $INDEX_ALLOCATION make this process efficient. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:02 - Recap of MACB Timestamps 04:52 - Recap of $I30 06:58 - Conclusion 🛠 Resources $STANDARD_INFORMATION vs. $FILE_NAME:

Major Update to 13Cubed Courses: Chaos at Cobalt

Chaos at Cobalt, a major new practice scenario, is now available for Investigating Windows Endpoints, Investigating Windows Memory, and Investigating Linux Devices. Access the Additional Content module to get started!

13Cubed AMA - Answering Your Questions!

In this special 13Cubed episode, I answer questions collected from the community! *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** #Forensics #DigitalForensics #DFIR #ComputerForensics

IDA Free Reverse Engineering - Step-by-Step EXE Analysis

Step-by-step reverse engineering tutorial with IDA Free covering decompiling, types, enums, function definitions, and naming for EXEs. Sample can be found on unpac.me 7b5b060d9013725413f3f77719d0881035246b281e18005c0040e78a32e1c6cc Full tutorial series on the OALABS Patreon

The Easy Way to Analyze Linux Memory

In this episode, we'll take a look at a quick and easy way to find the Intermediate Symbol File (ISF) for the Linux memory image you're analyzing. This method will save you time and help streamline your memory analysis workflow. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:37 - Demo 🛠 Resources Abyss-W4tcher ISFs:

IDA Free Reverse Engineering - Step-by-Step DLL Analysis

Step-by-step reverse engineering tutorial with IDA Free covering decompiling, types, enums, function definitions, and naming for DLLs. Sample can be found on unpac.me 93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5ee90a1d424a5ed Full tutorial series on the OALABS Patreon

Will AI Replace Digital Forensics Experts?

Is AI going to replace digital forensic investigators? In this episode, we'll test a local instance of DeepSeek-R1 in Windows forensics to see how it compares to a human investigator. Let’s find out if AI can handle the job! *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:23 - The Questions Begin 10:43 - Closing Thoughts 🛠 Resources #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #AI #DeepSeek

Behind the Book: Threat Hunting macOS with Jaron Bradley

In this episode, I sit down with Jaron Bradley, author of the upcoming book Threat Hunting macOS. With the recent release of the new 13Cubed training course Investigating macOS Endpoints, this felt like the perfect time to bring Jaron on the channel to discuss his new book — a resource I believe will be an excellent companion to the course. 📘 Order Jaron’s Book – Threat Hunting macOS

Windows Memory Forensics Challenge

Welcome to a special Windows Memory Forensics Challenge from 13Cubed. This is an excellent opportunity to get some hands-on practice with Windows memory forensics. You'll find the questions below, as well as a link to download the memory sample needed to answer those questions.

Reverse Engineering Access Tokens Part 2

This tutorial covers Windows Access Tokens, the Logon Session, Token Elevation, AdjustTokenPrivileges and the Windows Access Control Model. This is part of our IDA Pro reverse engineering series. The full series can be found on our patron...

From Zero to Zero Day (and beyond) - Life of a Hacker: Jonathan Jacobi

I met Jonathan in 2018 at the CCC when he was just 18 years old. Back then he referenced my videos which had a little bit of impact on his life. Now a lot of time has passed and in this interview I want to get to know Jonathan better. How did he get into hacking, founding of the CTF team perfect blue, working as a vulnerability researcher and ultimately transitioning into a new career.

Automated AI Reverse Engineering with MCP for IDA and Ghidra (Live VIBE RE)

Testing MCP plugins for IDA and Ghidra live with @mrexodia IDA MCP

Reverse Engineering Access Tokens Part 1

This tutorial walks through the process of reverse engineering malware which uses AdjustTokenPrivileges to enable SeDebugPrivilege. No steps are skipped in the process! This is Module 2.2 of our IDA Pro reverse engineering series. The full series can be found on our patron...

The German Hacking Championship

An amazing event for aspiring German hackers is happening right now. I went to the finals in 2024, share a few impressions and tell you about this year's event.

Do you know this common Go vulnerability?

When auditing code it's crucial to know about common issues. In this video we explore a Go issue that I was not aware of.

USB Ethernet Adapter Malware??? Chinese RJ45-USB Full Analysis - Part 1

Reverse engineering all stages with line by line code analysis. e3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359 OP