 I (Fyodor) gave my first formal security presentation at CanSecWest in May of 2000 and have enjoyed speaking ever since. Security conferences are a great way to learn, network, and party with like-minded hackers. I've presented at many events, includingDefcon,CanSecWest,Black Hat Briefings,IT Security World,Security Masters' Dojo,ShmooCon,IT-Defense,FOSDEM,SFOBug,Stanford University,George Washington University, and variouscorporate events. Many of my presentations are listed on this page. Most of themonly have slides available, which often don't provide enough contextto follow the talks. Some of my newer talks (where noted) have videoand audio recordings posted. |
Featured Presentations
These are my favorite presentations with audio and video available.
Black Hat USA / Defcon 2010—Mastering the Nmap Scripting Engine
 Most hackers can useNmap for simple port scanning andOS detection, but theNmap Scripting Engine (NSE) takes scanning to a whole new level. Nmap's high-speed networking engine can now spider web sites for SQL injection vulnerabilities, brute-force crack and query MSRPC services, find open proxies, and more. Nmap includes more than 130 NSE scripts for network discovery, vulnerability detection, exploitation, and authentication cracking.Rather than give a dry overview of NSE, Fyodor and Nmap co-maintainer David Fifield demonstrate practical solutions to common problems. They have scanned millions of hosts with NSE and discuss vulnerabilities found on enterprise networks and how Nmap can be used to quickly detect those problems on your own systems. Then they demonstrate how easy it is to write custom NSE scripts by writing one from scratch and using it to hack a webcam. All in 38 minutes, as given live at Defcon 18! |
Black Hat USA / Defcon 2008—Nmap: Scanning theInternet
 TheNmap Security Scannerwas built to efficiently scan large networks, but I took this to a newlevel by scanning millions of Internet hosts during the Summer of 2008as part of my Worldscan project. I present the most interestingfindings and empirical statistics from these scans, along withpractical advice for improving your own scan performance. An overviewof new Nmap features is also provided, includingtheNmap ScriptingEngine,Zenmap UI,new performance options, Ncat, and Ndiff. Most of these features havesince been integrated into official Nmap releases. |
ShmooCon 2006—Advanced Network Reconnaissance with Nmap
 While many security practitioners use Nmap, few understand its fullpower. Nmap deserves part of the blame for being too helpful. Asimple command such as "nmap scanme.insecure.org" leaves Nmap tochoose the scan type, timing details, target ports, output format,source ports and addresses, and more. You can even specify -iR(random input) and let Nmap choose the targets! Hiding all of thesedetails makes Nmap easy to use, but also easy to grow complacent with.Many people never explore the hundreds of available options and scantechniques for more powerful scanning.In this presentation, Nmap author Fyodor details advanced Nmapusage—from clever hacks for teaching Nmap new tricks, to new andundocumented features for bypassing firewalls, optimizing scanperformance, finding free porn, defeating intrusion detection systems,and more. A special Shmoo version of Nmap was released at theconference, though all the features discussed are now integrated withofficial Nmap releases. |
Other Presentations
The presentations in this section generally only have slides available (no video), or they are superseeded by newer talks in theFeatured Section above.
Wireshark Sharkfest 2011—Nmap Turbo Talk a short (25 minute) presentation on Nmap and recent work.
CanSecWest 2009—Ninja Scanning demonstrates new Nmap features and advanced scanning techniques.
iSec Partners Forum (2008)—The New Nmap. A 30-minute presentation about new and upcoming features in Nmap. This was less than 2 weeks after my longer Black Hat and Defcon 2008 talks, and is mostly a subset of that material.
Wireshark Sharkfest (2008)—I particpated on a panel on the future of open source networking tools with Wireshark author Gerald Combs, Kismet author Mike Kershaw. Session video isavailable here.
Defcon 13 (2005)—Nmap Hacking. I provide several missions related to host discovery, single service discovery on a large network, and bypassing firewalls. Then I demonstrate how to solve them effectively using Nmap and complimentary tools.
CanSecWest 2005—Nmap Hacking. This talk covers advanced host discovery, and introduces the Nmap ARP scanning for the first time
IT-Defense 2004—Network Reconnaissance with Nmap. I start by covering footprinting to find an organizations IP addresses, then demonstrate how close examination of raw packets can help determine IP spoofing by firewalls. Next I discuss techniques for enhancing performance, bypassing firewall rules, and evading intrusion detection systems.
Yahoo Security Conference 2003—Network Reconnaissance with Nmap. This is my first talk to introduceNmap Version Detection. It also covers footprinting, performance, and IDS evasion.
San Francisco OpenBSD Users' Group (SFOBUG) 2003—Nmap. This informal talk used scans ofwww.openbsd.org to demonstrate key features of Nmap as well as a few useful scanning tricks.
Affiliated Computer Systems (ACS) Client Symposium (2001)—Security Risks of Emerging Technologies: Wireless Networks and Intrusion Detection Systems. This presentation discussed the risks inherent in wireless networks and IDS systems, and how an enterprise can set those up securely to mitigate the risks.
CanSecWest 2001—Stealth Scanning & IDS Evasion Techniques. Demonstrated how Nmap can be used for stealth scanning, then demonstrated advanced IDS evasion techniques. Custom tools were provided for locating Black ICE IDS installations on networks (or the Internet), and then manipulating their reported results.
Open Source Developers' European Meeting 2001—Network Reconnaissance Techniques. Introduced Nmap (which was only 3.5 years old) and explain advanced (at the time) techniques for host discovery, port scanning, and network topology detection.
Defcon 7 (1999): Introduction to Scanning. The official (registered) speaker was M0dify, but Fyodor ended up joining him on stage when it became clear that the whole talk was about Nmap.