Hack The Cloud: An AWS CTF Challenge

The best way to understand cloud environments is to think like those trying to breach them. Putting theory aside, this hands-on CTF challenge invites you to step into the shoes of a real threat actor and hunt down 5 hidden flags within AWS.
We've designed the experience so that each flag represents a critical milestone in a live cloud kill chain; you'll start by mapping the target through initial recon, then pivot, exploit, and dig deeper until you've fully compromised the environment.

This activity will require analytical thinking, investigation, and working with the command line (CLI). Using LLM's and Google search is an integral part of the game, helping you crack each stage of the attack chain and understand how the cloud truly works.

Malware RE

Learn how to reverse engineer an Android app to uncover it's malicious activity

Burp Suite for beginners - hack the web

צעדים ראשונים ב-Burp Suite: סדנה מעשית למתחילות. בסדנה נכיר מקרוב את הכלי המרכזי בעולם בדיקות החדירות האפליקטיביות, נלמד על יכולותיו השונות ונתנסה יחד בביצוע התקפות סייבר נפוצות על אתרי אינטרנט בסביבת תרגול ייעודית. הסדנה מיועדת למי שרוצה לצלול לעולם ה-Web Security ולצבור ניסיון מעשי ראשוני (Hands-on).

The Sword of Secrets - A Hardware CTF Platform

The Sword of Secrets ( https://swordofsecrets.com/ ) is a hardware hacking Capture the Flag (CTF) platform, created to teach real-world techniques in an engaging, story-driven way. Recently funded on Crowd Supply with over 200 orders (https://www.crowdsupply.com/nyx-software-security-solutions/sword-of-secrets), it has quickly become a recognized tool for learning and teaching embedded exploitation.

At its core, the sword is powered by a CH32V003 microcontroller and a W25Q128 flash chip. It comes with a secure bootloader, supporting encrypted challenge updates that can be delivered over USB. Out of the box, the device features multiple challenges that cover a spectrum of domains: hardware reverse engineering, cryptography, and embedded exploitation. New challenges can be downloaded and flashed to extend the experience, keeping the platform alive well beyond the workshop.

This workshop is built around direct, hands-on engagement. Participants will:

Learn how to approach an unfamiliar hardware device, from initial inspection through exploitation.
Practice reading and interpreting datasheets to understand microcontroller and flash memory behavior.
Explore low-level attack surfaces, including firmware, bootloaders, and peripheral interfaces.
Gain practical skills in bypassing protections and breaking cryptographic assumptions.

Unlike simulations or “click-through” labs, this workshop uses real hardware. The challenges are designed to scale-from accessible entry-level tasks for beginners to deeper, technical challenges for experienced security researchers.

The Age of the understatement: Threat hunting the agentic AI attack surface with AI

AI agents are now the fastest-growing attack surface in the enterprise — exposed automation platforms, poisoned agent skills, and prompt injection hidden in files only an agent will ever read. In this hands-on workshop, you'll hunt that surface the same way it was mapped for the State of AI Agent Security 2026 report: with an AI agent as your analyst.

Working in small teams through a browser-based environment (nothing to install, no scripting required), you'll compete in Catch the Shadow Puppets — three multi-stage hunts across a frozen real-world dataset: trace a secrets pull back to an exposed automation host, unmask a "benign" skill with a lethal dependency chain, and reconstruct how a public GitHub repo silently exfiltrated a developer's SSH keys, based on a recently disclosed IDE-agent vulnerability. Every hunt ends with the runtime control that would have stopped it.

You'll leave able to run natural-language hunts over your own telemetry, audit agent skills before rollout, and enforce guardrails at the runtime layer — plus a take-home handbook with the playbooks to do it Monday morning.

LLM Hacking 101 - Hackeriot Edition

כפי שהוצג בכנס BlackHat USA השנה בווגאס - הפעם בגרסא ייעודית לקהילת האקריות. בסדנה זו, נלמד על איך נגשים למערכות LLM מבחינת מתודלוגיה, טכניקות ויכולות. נלמד למפות התנהגות אצל מערכות מבוססי LLM באמצעות מתודלוגיה ייחודית שפותחה בשם R.E.A.C.T בשנים האחרונות על גבי עשרות מבדקים של מערכות מבוססות AI.

בסדנה נעבור על הנושאים הבאים:
- מיפוי משטח תקיפה בעולמות ה-LLM
- סקירת מתודלוגיית R.E.A.C.T
- 5 שיטות לבניית ה-Jailbreak הראשון שלנו
- תרגול סופי

לא נדרש ידע קודם או ניסיון בנושא.
הכרות עם עולם ה-OWASP TOP10 - יתרון.

דרישות לסדנה:
- יש להגיע עם מחשב נייד המותקן עליו Burp Community
- ידע בסיסי ב-Web Application