leHACK Conferences tracks 📅 iCal 📱 INSTALLABLE MOBILE WEB APP

Zone 2 - S3

The mission of the Red Team Alliance is to advance the discipline of security by advancing the people in security.

RTA was formed in 2017 when two consultancies recognized the critical need for mature security training and certification that transcends the traditional "brain dump" style trainings found in hotel business centers and conference rooms. In 2025, RTA expanded its mission to serve the global security community, launching region-specific training programs tailored for Europe and Australia, addressing the unique regulatory environments and security challenges in these markets.

Operating from state-of-the-art facilities in Las Vegas, NV and Fredericksburg, VA, with new training partnerships across Europe and Australia, RTA develops comprehensive programs that expose students to real-world environments as they are deployed in the field through immersive hands-on exercises and labs. This natural learning approach not only improves skill retention but bolsters confidence in the field and promotes mission success.

Led by world-renowned instructors including Babak Javadi and Deviant Ollam, RTA offers flagship courses covering Covert Methods of Entry, Physical Access Control Systems, Physical Intrusion Detection Systems, Surveillance Dynamics, and more. RTA has become an essential training provider for organizations and government customers including the FBI, NSA, DARPA, and National Defense University, as well as European and Australian security agencies.

In addition to providing advanced, practical skills, RTA maintains an established certification program offering three progressive credentials: Covert Entry Associate (CEA), Covert Entry Professional (CEP), and Covert Entry Expert (CEE). These certifications validate proficiency and help security professionals stand out in the field.

Through this integrated approach, RTA has established itself as the definitive training resource for security professionals worldwide seeking to master modern physical and electronic security vulnerabilities.

Zone 2 - Worshop Room 3

Originally developed by MIT, Kerberos is widely used in Microsoft Active Directory environments. Therefore, this protocol is a prime target for exploitation, allowing privilege escalation as well as establishing persistence.

This workshop is designed for cybersecurity professionals who seek to deepen their understanding of Kerberos vulnerabilities and the sophisticated techniques used to exploit them. Participants will embark on a comprehensive journey on Kerberos exploitation, starting with the fundamentals of the protocol and moving swiftly into advanced attack strategies. The workshop will primarily cover:

- Abusing delegations
- Forging tickets (especially Diamond and Sapphire tickets)
- *-roasting (well-known variants as well as their newer versions, such as Kerberoasting without pre-authentication)

Throughout the workshop, participants will engage in hands-on labs to reinforce their learning. By the end of the session, attendees will possess a deep understanding of Kerberos exploitation techniques and practical knowledge to effectively conduct these attacks.
Join us to master the art of Kerberos exploitation and fortify your skills to always be Domain Admin on the first day of your pentest engagement

Requirements:
- Basic knowledge of Active Directory and Kerberos protocol
- A laptop with Exegol (https://exegol.readthedocs.io) pre-installed, with the latest nightly image already downloaded

Zone 2 - Workshop Rooms

This workshop introduces the fundamentals of investigating how cryptocurrency moves across wallets, smart-contracts, bridges, and exchanges. You'll learn how to follow transactions on-chain and apply OSINT techniques to extract context and potential control signals. Through hands-on examples, we’ll explore how to interpret what’s really happening behind the data in a decentralized, multi-chain ecosystem.

Zone 2 - Workshop Rooms

--Let me show you how to detect phishing/scam campaigns by analyzing OSINT data and using open-source tools I've created myself over the last few years.

Going even further, let's discover together how to gather information or material on the actors of these campaigns, their infrastructure, the developers of phishing kits, and even the existing marketplaces to fine-tune our knowledge of these threats.

Get a machine capable of running Docker containers, or a VM image. A network connection is required, as well as basic knowledge of the UN*X shell.

Zone 2 - Workshop Rooms

Join us for a thrilling workshop where you’ll learn the basics of Windows malware analysis, OSINT and CTI, by extracting interesting information from a malware and using it to track down cybercriminals.

Ever wondered how people could make malicious binaries talk? Or how from a single string in a code an analyst could find its developer’s favorite music band? We bring you the best of two worlds, malware analysis and OSINT, in this introduction workshop.

By using some basic malware analysis techniques, you’ll be able to easily extract interesting information from a malware and its functionalities. With OSINT methods, you’ll find how to use the information found in the malware to pivot on data from websites, social networks, and media to extract hidden or forgotten information on your target.

With this 3 hours workshop targeting absolute beginners, you won’t become an expert in both fields, but you’ll have the opportunity to better understand how they work and discover how they can interact with each other.

Zone 2 - Workshop Rooms

This workshop introduces the fundamentals of investigating how cryptocurrency moves across wallets, smart-contracts, bridges, and exchanges. You'll learn how to follow transactions on-chain and apply OSINT techniques to extract context and potential control signals. Through hands-on examples, we’ll explore how to interpret what’s really happening behind the data in a decentralized, multi-chain ecosystem.

Zone 2 - Workshop Rooms

--Let me show you how to detect phishing/scam campaigns by analyzing OSINT data and using open-source tools I've created myself over the last few years.

Going even further, let's discover together how to gather information or material on the actors of these campaigns, their infrastructure, the developers of phishing kits, and even the existing marketplaces to fine-tune our knowledge of these threats.

Get a machine capable of running Docker containers, or a VM image. A network connection is required, as well as basic knowledge of the UN*X shell.