Black Hat

Introduction To SeVa [Secret Validator] – Secrets Prioritization Framework

Date: Friday August 8th, 2025
Time: 1:30 PM – 2:30 PM (PST)
Location: Las Vegas Convention Center (LVCC)
Speakers: Pramod Rana, Sr. Manager, Information Security – Redteam and Offensive Operations and Leon Denard, Information Security Engineer

SeVa (Secret Validator) is an open source solution and aims to provide an accurate triage and priority framework for secrets with below philosophy:
1) Secrets which are confirmed to be valid will be of most priority
2) Secrets which are confirmed to be not valid will be of least priority
3) Remaining secrets will have severity as per security solution and manual triage process

SeVA does that by providing a fast and noninvasive way to verify credentials with non-intrusive API calls without secrets leaving organization infrastructure and no need to provide usage permission to SaaS secret detection products.

Whispers Through the Firewall: Data Exfiltration and C2 with Port Knocking

Saturday, August 9, 11:00 – 11:50am PT
Location: Las Vegas Convention Center (LVCC)
Speakers: Hubert Lin – Principal Threat Researcher, Netskope

Description: Port knocking is a stealthy network authentication technique (T1205.001) in which a client sends a specific sequence of connection attempts (or “knocks”) to closed ports on a server. When the correct sequence is received, the server dynamically opens a port or triggers an action, enabling concealed access or communication. Saucepot C2 elevates the port knocking technique to a new level. Instead of using destination ports (DstPorts) in TCP sessions as knock sequences, it leverages source ports (SrcPorts), also known as ephemeral ports. This approach allows data exfiltration even in highly restrictive firewall environments where only a single outbound port, such as port 443, is allowed.

Introduction to CICDGuard – Orchestrating visibility and security of CICD ecosystem

Date: Saturday, August 9, 2025
Time: 12:00 PM – 1:00 PM (PST)
Location: Las Vegas Convention Center (LVCC)
Speakers: Pramod Rana, Sr. Manager, Information Security – Redteam and Offensive Operations

CICDGuard is a graph based CICD ecosystem visualizer and security analyzer, which –
1) Represents entire CICD ecosystem in graph form, providing intuitive visibility and solving the awareness problem
2) Identifies common security flaws across supported technologies and provides industry best practices and guidelines for identified flaws adhering to OWASP CICD Top10 vulnerabilities
3) Identifies the relationship between different technologies and demonstrates how vulnerability in one component can affect one or more other technologies