Tessera

Defending Microsoft Entra ID 4-hour hands-on workshop covering common attacks, tokens, Conditional Access, and real KQL hunting. Device code phishing • AiTM • refresh token replay — and how to detect them. With Ethan Bowen. #EntraID #CloudIdentity #SOC

A Phishing Trip with Fancy Bear Hands-on analysis of a real APT28 attack chain — phishing email → payload → persistence → C2. Interactive platform, real artefacts, free tools only. Beginner-friendly. #FancyBear #APT28 #MalwareAnalysis

Cryptography: An Evolutionary Tale From Caesar cipher → Enigma → RSA → Quantum cryptography — in 4 hands-on hours. Encrypt, break, and experiment your way through the history of secret communication. Interactive. Practical. No pure theory.

Hunting Supply Chain Attacks Hands-on analysis of real malware targeting npm, PyPI, GitHub & VS Code extensions. Work with samples from Contagious Interview, Glassworm & TeamPCP — then hunt live and produce actionable intel with Paul McCarty, OpenSourceMalware

Desktop Application Pentesting 101 Java fat clients still matter — and they’re tested very differently from web apps. Reverse engineer the client, analyze proprietary protocols, build a custom pentest client, and exploit the backend. Hands-on workshop with Jakob Steeg & Tim Kranz.

Introduction to Physical Security Testing Lock picking • Door bypasses • Access card cloning Hands-on workshop with Nico Leidecker & Harris Nuhanović (NVISO). Test your skills on the Covert Access Vault (CAV). Time to go physical.

Rustacean Introduction to Shellcoding Write your first position-independent implant in Rust — from scratch. PE parsing, loader design, PIC, and real working code to take home. Bring a Windows VM + x64dbg. Baseline code & Docker container provided.

Keyless Entry: Hacking SwitchBot Smartlocks AES-CTR with no integrity checks → universal software-only unlock of a popular smart lock. Live exploit + the vendor’s broken patch + a legendary 100€ bounty. Kolja Grassmann shows how easy it can get when crypto is done wrong.

Welcome to Hybrid Hell Enterprise identity is no longer just Active Directory. AD + Entra ID + Azure + M365 + SaaS + multi-tenant trusts = a massive, poorly understood attack surface. Georg Heise shows how attackers follow the trust relationships — not the technology boundaries.

Lessons Learned While Building an Agentic SOC The good (L1 triage & timelines), the bad (mediocre results & wasted tokens), and the scary (when agents cause incidents). Aaron Jewitt shares Elastic’s real journey — no hype, just hard-won lessons.

Deconstructing Modern macOS Initial Access Vectors The “macOS is safe” myth is over. Stephan Berger shows how attackers are landing on Apple devices today: Google Ads → ClickFix → AppleScript/JXA → DMGs, PKGs & Electron apps. Real tradecraft. Real defense insights.

Hacking Consumer Drones: From Flash Dumping to Root Exploits Full chain on the Potensic Atom 2: Flash dumping → corrupted firmware recovery → RF protocol RE → remote root. Tim Schmidt shows the real hardware + software exploit process, end to end. #HardwareHacking #IoT

Only 20 days left — grab your ticket now before it’s gone. Don’t miss out! 👉 tickets.bsidesfrankfurt.org/bsidesfrankf... #BSidesFrankfurt #Tickets #CyberSecurity

What Windows 11 Remembers (And Most Investigators Miss) Recall, Phone Link SMS history, Copilot chats, and secondary telemetry most playbooks still ignore. Maurice Fielenbach shows the evidence surface standard triage misses — based on hundreds of real cases. #DFIR #Windows11

Can AI do the job of a senior pentester for a few hundred euros? This talk shows real-world results of AI in SAST, DAST, source code analysis & even Active Directory exploitation — the good, the bad, and the confidently wrong. No hype. Just practical insights.

QuoIntelligence is back as Silver Sponsor! The European Threat Intelligence Provider delivering real Threat Intelligence as-a-Service — actionable, tailored, and built for decision-makers. Welcome back! 🔥 #SilverSponsor #QuoIntelligence www.quointelligence.eu

QuoIntelligence — Finished Threat Intelligence Tailored for YOU.

Our finished intelligence will significantly reduce your operational risks and allow you to make informed security decisions.

quointelligence.eu

First schedule is online! (Still subject to changes — keep an eye on it) Workshops & workshop tickets are live now! Start planning

Secure Code Warrior is now a Bronze Sponsor! Security at the point of code creation — not as an expensive afterthought. Secure coding skills, safe AI tools, and measurable results. Welcome! 🔥 www.securecodewarrior.com

AI Software Governance from #1 Secure Coding Training

AI Software Governance from the #1 secure coding training company.

securecodewarrior.com

Want to splice fiber optics yourself? @schutzwerk.bsky.social is bringing their gear — cut & “glue” real fiber on conference day! Hands-on session you don’t want to miss 🔥 #FiberSplicing #HandsOn

NVISO brings the CAV – Covert Access Vault back! Tired of talks? Try breaking into the box. Spoiler: it won’t be easy 😏 Real physical access fun is back! #CAV #PhysicalSecurity #NVISO

Badge E-Mail is live - if you want a personal badge, send your design from the email you used to buy your conference ticket to badges@bsidesfrankfurt.org See bsidesfrankfurt.org/blog/design-... for details

Design your own BSidesFrankfurt 2026 conference card | BSidesFrankfurt

Every attendee gets a blank ID-1 (CR80) card to design however they like and keep. Here's the spec, a template, and how to get yours printed and waiting for you on conference day.

bsidesfrankfurt.org

Welcome back, IGEL — our Gold Sponsor once again! The Secure Endpoint OS Platform trusted by enterprises worldwide. Simplifying complexity and securing digital workspaces since 2001. Thank you for your continued support! 🔥 www.igel.com #GoldSponsor #IGEL

The Secure Endpoint OS Platform | IGEL Technology

IGEL is a transformative, secure enterprise endpoint OS platform designed for SaaS, DaaS and VDI environments.

igel.com

New at BSidesFrankfurt 2026: a conference card you design yourself. Every attendee gets a blank ID-1 card (85.6×54mm) — your art, handle, QR, favourite CVE. We print it and hand it to you on the day. bsidesfrankfurt.org/blog/design-...

Excited to have Schutzwerk GmbH as our new Bronze Sponsor! Mastering Cybersecurity from Silicon to Cloud with 15+ years experience, penetration testing, Red Teaming, Embedded & AI Security and more. Welcome aboard! 🔥 #BronzeSponsor #SCHUTZWERK www.schutzwerk.com

Willkommen bei SCHUTZWERK

Mastering Cybersecurity from Silicon to Cloud. SCHUTZWERK ist Ihr Partner für die unabhängige Prüfung und ganzheitliche Optimierung aller Aspekte der Informations-, IT- und Cybersicherheit in Ihrem Un...

schutzwerk.com