pre-auth

Black Hat·46 min

• Black Hat
• Privacy
• Date: 2025
• Location: Black Hat

Infiltrating Corporate Intranet Like NSA

Security researchers examine technical aspects of Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs.

Briefings·30 min

• Black Hat
• AppSec
• Date: Aug 2025
• Location: Las Vegas

Shahar Tal · Yarden Porat

Enterprise vaults are meant to be the last line of defense – the trusted stronghold for your organization's most sensitive assets: secrets, credentials, and encryption keys.

Cyber Saiyan·51 min

• COMMUNITY
• Privacy
• Date: 2025
• Location: Community

Chang

Security researchers examine technical aspects of RomHack 2019 - Orange&Chang - Infiltrating Corporate Intra Like NSA Pre-auth RCE on Leading SSL VPNs.

Hexacon·51 min

• HEXACON
• Red Team
• Date: 2025
• Location: Hexacon

Engineers explore architecture and security mechanisms for 2023 - 9 Years of Overlooked MikroTik Pre-Auth RCE by NiNi.

HITCON·42 min

• HITCON
• Red Team
• Date: 2025
• Location: Hitcon

Engineers explore architecture and security mechanisms for A Comprehensive Review on the Less-Traveled Road: 9 Years of Overlooked MikroTik Pre-Auth RCE.

HITCON·1 hr

• HITCON
• Privacy
• Date: 2025
• Location: Hitcon

Infiltrating Corporate Intranet Like NSA

Industry experts analyze emerging threats surrounding CMT 2019 - Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs.

Main Stage·40 min

• DEF CON
• Red Team
• Date: Aug 2025
• Location: Las Vegas

Nassim Asrir · Zackary Flack

Discloses a pre-authentication remote code execution chain against Synology DSM, demonstrating how attackers achieve root compromise via the S2S protocol.

Hack In The Box Security Conference·57 min

• HITB
• Privacy
• Date: 2024
• Location: Hitb

Orange Tsai · Tingyi Chang

Orange Tsai explores #HITBGSEC D1: A Pre-Auth RCE On Leading SSL VPNs.

Main Stage·36 min

• DEF CON
• AppSec
• Date: Aug 2022
• Location: Las Vegas

Jeffrey Hofmann

Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).

Main Stage·48 min

• DEF CON
• AppSec
• Date: Aug 2021
• Location: Las Vegas

Orange Tsai

Orange Tsai reveals a revolutionary attack surface on Microsoft Exchange Server, chaining pre-auth SSRF, authentication bypass, and post-auth RCE into ProxyLogon, ProxyOracle, and ProxyShell.