You want some zero days with that netpen? Finding your own way in with LLMs
Network pentests don’t ordinarily have time in scope to do significant research on products encountered during the assessment. This has forced many testers to rely on known CVEs instead of hunting for 0-days. LLM agents like Claude Code have strong capabilities for binary analysis and vulnerability discovery. Even large attack surfaces like appliances can be analyzed in hours. Significant vulnerabilities can be turned into exploits and handed to operators to use during pentests and red team engagements.
Attendees will walk away with a better understanding of how to stand up test labs that let LLMs rapidly discover and weaponize vulnerabilities, techniques for keeping agents on task during research, and a multi-pronged approach for assessing appliances, including patch-diffing, SBOM analysis, config review, binary reverse engineering, and fuzzing. We'll release a Claude Code plugin that integrates several of these approaches using tools like Binary Ninja, headless Ghidra, and IDA Pro. If coordinated disclosure completes before the conference talk, we will also release exploits for two critical vulnerabilities in a popular hypervisor management platform.
Phil Brass has worked in Information Security since 1998. He has been a software engineer, penetration tester, secure code reviewer, application security tester, manager, director and vice president of consulting services.
Matt has been an amateur security enthusiast since the 90s and was a regular 2600 attendee. Holding a B.S. in Computer Science from The University of Kansas, Matt honed his technical skills over 6 years as a systems administrator for various Kansas City businesses. In 2013, he combined his knowledge of complex business computing systems and love for security to pivot into a career in information security. Since then, he has hacked on hundreds of systems and applications for both Fortune 100 companies and smaller startups. His expertise lies in the nuanced realms of Web and Mobile application testing, along with comprehensive Cloud security reviews. Matt excels in uncovering business logic flaws-subtle vulnerabilities often overlooked by automated scanners. Matt has given talks and trainings at security events such as SecKC, Kernelcon, and BSidesKC. A highlight of his career includes presenting tools of his own design at BlackHat USA in both 2015 and 2017.