BSides Orlando Pre-Conference Workshops

Are you ready for a high-octane RFID bootcamp?

This isn’t a sit-and-listen lecture with a few party tricks; it’s a battle-tested 4-hour bootcamp that demystifies RFID and unleashes your skills. All levels welcome - It’s time to blow the dust off your tools, learn the essentials, and more importantly - learn the secret that has helped hundreds of hackers get (and stay!) into RFID for good!

In this Ultimate Bootcamp session, you will:

• Build a rock-solid understanding of how RFID actually works from card, to reader, to full scope system - enabling you to tackle new problems and tools… and get to ACCESS GRANTED!
• Get hands-on with live demos and challenges, utilizing the Flipper Zero, Proxmark, OpenDoorSim, and more learning tactics and mindsets - not just commands.
• Most importantly, learn how to build your own RFID lab to keep the learning going long after you leave BSides Orlando!

Led by Evan “Shortrange” Cook — RF trainer to hundreds and creator of the OpenDoorSim — this is a bootcamp you won’t want to miss. All are welcome!

Requirements for this are:
Laptop

Scheduled 9 AM - 1 PM

Buy a ticket

Binary exploitation is intimidating to get started. It doesn’t have to be. Binary Jiujitsu is the martial art of exploitation, breaking the topics and concepts of binary exploitation into belts and stripes, drilling each step of identifying bugs and writing exploits for compiled binaries.

Each player will get hands on experience moments into the workshop and build on concepts until they’re able to write their first buffer overflow exploit using pwntools. Everything is provided in the browser: No need for VMs or installing tools. The workshop extends into a CTF after conclusion and runs until the end of the conference with top three players winning a binary jiujitsu placement medal. Electronic badge belts are also available to show off skill level.

Requirements for this are:
Understanding of general progamming concepts

Scheduled 2 PM - 6 PM

Buy a ticket

The rise of AI agents is fundamentally changing how security operations are built, automated, and scaled. Yet most security professionals encounter AI agents either as black-box commercial products or as theoretical concepts - rarely as systems they’ve designed and deployed themselves. This training closes that gap.

In this intensive one-day session, participants will move from zero to a functioning AI Security Agent - one capable of accepting a suspicious IP address as input and autonomously performing geolocation lookup, WHOIS/RDAP enrichment, ASN identification, blacklist/reputation checking, risk rating, and generating a human-readable analyst report. Every component is built from scratch, live, in the room.

Requirements for this are:
Basic Python Familiarity
Familiarity with core security concepts

Scheduled 2 PM - 6 PM

Buy a ticket

Bluetooth Low Energy (BLE) is used in countless modern technologies including fitness trackers, smart home devices, medical equipment, asset tracking systems, and industrial IoT devices. Despite its widespread adoption, many cybersecurity professionals have limited experience understanding how BLE works and how to assess the security of BLE-enabled systems.

This hands-on workshop introduces attendees to the fundamentals of BLE communications, common security weaknesses, and practical techniques for analyzing and securing BLE devices. Participants will learn how BLE devices advertise themselves, establish connections, exchange data through GATT services and characteristics, and implement security controls such as pairing and encryption.

Students will work directly with Raspberry Pi Pico W devices configured to emulate BLE-enabled systems. Through guided exercises and mini challenges, participants will discover nearby BLE devices, enumerate services and characteristics, analyze communications, identify insecure configurations, and explore common BLE attack scenarios in a controlled lab environment.

By the end of the workshop, attendees will have a foundational understanding of BLE security concepts and practical experience analyzing and securing BLE-enabled devices.

Requirements for this are:
Laptop at least 8GB of RAM and 250 GB free storage.

Scheduled 9 AM - 1 PM

Buy a ticket

In this intro to web application penetration testing workshop, participants will learn the basics of web application penetration testing including; methodology, tools, techniques, and resources. The skills taught in this workshop are valuable to aspiring bug hunters for use in bug bounties.

Requirements for this are:
Kali or Parrot OS, on a VM or bare metal laptop.

Scheduled 2 PM - 6 PM

Buy a ticket

Everyone is bolting an LLM onto their product, and everyone fixates on the model — which is almost never where the bug is. Real AI incidents happen at the application boundaries: the hidden system prompt, the guardrails that are really just a sentence, the input fields nobody validated, the image the model paints, the provenance metadata no one stripped, the documents it retrieves, and the tools it’s allowed to call.

In this hands-on workshop you’ll red team a full, deliberately vulnerable AI image-generation application — Verdano Atelier, an AI art-commission studio built in the spirit of OWASP Juice Shop. Through a progressive, 7-level capture-the-flag, each level models a documented class of real-world AI product failure and maps to the OWASP Top 10 for LLM Applications (2025). You’ll leak a system prompt, bypass an instruction-only guardrail, smuggle a payload through an unvalidated field, exfiltrate a secret across modalities — painting it into the generated image where text filters can’t see it — pull secrets out of metadata and retrieved (RAG) context, and finally chain an over-privileged tool into a full compromise.

Crucially, this is not “jailbreak golf.” Every challenge ends with the mitigation, because half the room is here to build these features safely, not just break them. You’ll leave with a working mental model of the AI application threat surface, hands-on reps with the core techniques, and a concrete checklist of the controls that actually work.

Everything runs in your browser. No machine-learning background is required — if you can read an HTTP request and think like an attacker, you’ll thrive. This session is ideal for pentesters, SOC analysts, application developers, security engineers, students, and anyone shipping (or defending) AI-powered features.

Requirements for this are:
Laptop with current up to date browser.

Scheduled 2 PM - 6 PM

Buy a ticket

Your red team exercise failed, Again. Your threat intelligence reports gather dust while attackers waltz past your defenses using techniques you’ve read about but never truly understood. The problem isn’t your tools or your budget, it’s that you’re fighting shadows instead of understanding your adversaries.

This hands-on workshop flips the script on traditional cybersecurity testing by diving deep into the attacker’s playbook. Instead of theoretical discussions about threat landscapes, we’ll explore the practical behaviors and methodologies used by modern threat actors through hands-on emulation techniques that will fundamentally change how you think about defense.

Requirements for this are:
Laptop

Scheduled 9 AM - 1 PM

Buy a ticket

Web/API Security: Attack & Exploit with Burp Suite is a fast-paced, hands-on 4-hour workshop that takes participants from Burp Suite setup to real-world exploitation techniques used by professional penetration testers. Attendees will configure Burp Suite (Community and Professional editions) as a proxy and gain practical experience with its core components — Repeater, Intruder, and extensions — before diving into the vulnerabilities that matter most in modern web and API applications.

The workshop covers authentication and authorization flaws including unauthenticated API endpoints, privilege escalation paths, and OAuth attack chains, followed by an in-depth look at client-side vulnerabilities such as XSS and CSRF and how adversaries chain them with client-side gadgets for maximum impact. A final segment on JWT attacks explores weak signing algorithms and token lifespan abuse — the quiet vulnerabilities hiding in plain sight across virtually every modern application stack.

Led by Dr. Sunny Wear — Security Architect, web application penetration tester, and author of Burp Suite Cookbook (Editions 1 & 2) and the Secure Coding Field Manual — this workshop delivers practitioner-grade skills in a structured, approachable format suitable for security professionals looking to sharpen their offensive toolset.

Requirements for this are:
Laptop
Previous hacking knowledge
Portswigger account
Burp Suite installed

Scheduled 9 AM - 1 PM

Buy a ticket

If you are an intermediate hacker, working towards a career in cyber security, come be an unethical hacker for half a day. Get hands on lab experience with OSINT, exploitation, building attack paths, pivoting, and harvesting credentials to achieve root access.

For leaders, the routine, operational demands of a busy cybersecurity and IT department can often get in the way of good security strategy and leave you with little time to prepare for the decisions that really matter. If this sounds like your day-to-day, join this short, hands-on course. It’s designed to take you temporarily out of the ring and put you into the mind of the adversaries targeting your organization so you can adopt a more calculated approach. Plus, you can get your hands dirty with our popular virtual labs and learn from experienced, practicing Penetration Testers with a legacy of training at Black Hat as you do it.

Who it’s for

• Security and IT decision makers (CISOs, Heads of, budget-holding managers, etc.)
• CTOs and development Team Leads
• Network Managers
• Inspiring Hackers

Delegates must have the following to make the most of this course:

• Intermediate to advanced cybersecurity experience
• A good understanding of basic networking technologies
• Confidence using basic computer commands

Top 3 takeaways

• How to think like a real-world threat actor and plan your security tactics with the same offensive mindset
• Where to identify the “low hanging fruit” that’s creating high-risk vectors across your attack surface
• How single vulnerabilities can lead to a larger and more destructive attack chain

What you’ll learn

This course uses a Defense by Offense methodology based on real world offensive research (not theory). That means everything we teach has been tried and tested on live environments and in our labs. By the end of the course, you’ll understand how threat actors may:

• Gather information on your organization to identify exposures and prepare your tactics
• Exploit web application vulnerabilities to achieve Initial Access to your network
• Build attack paths to pivot across your environments
• Evade detection and maintain their foothold in your environments
• Pivot from system to system to gain access to your critical assets
• Harvest credentials and achieve root access By stepping back to trace the behaviors displayed in many cyber attacks and learn more about the tools used, you can arm yourself and approach your security with the same combative mentality.

What you’ll be doing

You’ll be learning hands on:

• Spending over half the session (~55%) on lab-based exercises
• Using lab-based flows to explore and hack lifelike systems and environments
• Discussing the impact of the hacks and the security context around them with your course trainer

Why it’s relevant

We created this course in response to a growing challenge facing many of our own customers. Across the board, CISOs and other security decision makers are finding that in being so caught up with day-to- day operational tasks, they’re not performing the strategic work or providing the leadership needed to keep their organizations safe.

The best way to address the barriers getting in your way is to step back and refocus, which is what this course is designed to help you do. For half a day, drill into the mind of the threat actors you’re up against so you can approach your defense with greater knowledge and deeper insight.

Unlike our technical courses, Ready, Steady, Hack isn’t designed to blow your mind with complex, novel hacks that you’ll never be able to replicate or apply context to in your organization. Instead, you’ll be operating in a bespoke lab that uses commands to simulate many of the common behaviors of a real threat actor. We’ve identified some of the most popular techniques being used in the wild and modeled them so that you can see exactly why threat actors use them, how they’re deployed against the types of systems you use, and how they would impact your organization.

Requirements for this are:
Laptop

Scheduled 2 PM - 6 PM

Buy a ticket

Red teaming is more than popping shells. In this beginner-friendly workshop, students will plan a full-spectrum red-team operation using objectives, rules of engagement, personas, OPSEC, detection mapping, and reporting. No exploit development or prior red-team experience required.

Requirements for this are:
Laptop

Scheduled 9 AM - 1 PM

Buy a ticket