Expert-Led Sessions
Learn from industry leaders with deep technical expertise and real-world experience.
Security BSides
Kraków 2025
September 27th
500 participants
Wydział Informatyki, AGH, D-17 - 21 Kawiory 30-055, Kraków, Poland
welcome
Welcome to the
Security BSides Kraków
BSides events combine security expertise from a variety of platforms in search of the “next big thing” in information security. BSides is an open platform that gives security experts and industry professionals the opportunity so share ideas, insights, and develop longstanding relationships with others in the community. It is a rare opportunity to directly connect and create trusted relationships with key members of the community.
About Us
why
Why you should Join Event
Cutting-Edge Insights
Stay ahead with the latest trends, techniques, and strategies in Cyber Security.
Networking Opportunities
Connect with security professionals, developers, and decision-makers from everywhere in the World.
Modern Venue
Enjoy a modern, comfortable venue designed to enhance your learning and networking experience.
New People
Engage in practical demonstrations and case studies to reinforce key concepts.
Actionable Takeaways
Gain practical knowledge and best practices that you can apply immediately.
speakers
The Speakers
Cássio Perera
BSides Kraków Founder
Application Security Expert, Cássio Pereira is the host of Bsides Kraków.
Jefferson Macedo
PurpleBird Security, Founder and Technical Director
Jefferson is a cybersecurity expert with over 15 years of experience, currently serving as Technical Director and Founder of PurpleBird Security.
Julia Zduńczyk
SecuRing
Julia performs penetration tests for a wide range of IT Projects as a Junior IT Security Specialist at SecuRing.
Spyros Gasteratos
Security Engineer & Architect
Spyros has over 15 years of experience in the security world. Since the beginning of his career he has been an avid supporter and contributor of open source software and an OWASP volunteer.
Panagiotis Fiskilis
Senior Penetration Tester at NVISO
Panagiotis is a Senior penetration tester @ NVISO, with multiple years of experience in ethical hacking and Red Teaming.
Kev Milne
Cyber Threat Intelligence Manager and Cyber Mentor at NatWest Bank
Threat Intelligence Manager, Cyber Mentor, Penetration Tester, mainframe enthusiast, and author.
Ante Gojsalic
CTO and Co-Founder- SplxAI
Ante is the CTO & Co-Founder of SplxAI, specializing in Generative AI, cybersecurity, and cloud technologies.
Thiago Bordini
Head Cyber Threat Intelligence
Thiago Bordini, Head Cyber Threat Intelligence, executive with more than 20 years of experience in the cyber intelligence market.
Wesley Silva
Brazil X-Force Incident Response Leader at IBM
More than 10 years of experience in cyber intelligence and counterintelligence operations.
Diego Matos Martins
Brazil X-Force Incident Response at IBM
Seasoned Cyber Security professional with a comprehensive technical background in Security Engineering.
Dorota Kozlowska aka Woman in Red
Woman in Red
Dorota is passionate about the Red Team, and Black Ops part of the Cyber Universe.
Rishabh Gupta
Opitv Security, Senior Security Consultant, Attack and Pen
I am Rishabh Gupta, a Senior Security Consultant at Optiv Security with over seven years.
Ruslan Kiyanchuk
Information Security Research Engineer
Ruslan is a software engineer and cryptographer.
Aivars Kalvāns
Eat, sleep, code, repeat.
Aivars Kalvāns is a FinTech developer, software architect, and consultant.
Vlastimil Sindelar
Security Engineer | Cybersecurity & Risk
Vlastimil Sindelar is a security engineer who has worked on NATO and EU space and defense programs.
Bodhisattva Das
Cloud Engineer - Nextuple Inc
Bodhisattva is passionate about cloud security and digital rights, and AI Governance.
Noah Jelich
Security Researcher & Software Architect
Technical lead with expertise in security research, full stack software engineering, and blockchain development.
Adrien Lasalle
Offensive Security Advisor
Former firefighter in France 🇫🇷 🚒, I decided to pursue my passion for computing and more specifically for offensive cybersecurity.
Antonio Cortés aka @hackychucky
Cyber Security Analyst
I've been passionate about computers ever since I started "borrowing" my brother’s PC 💾 when I was about 10.
Roald Nefs
CTO at Warpnet
As a Chief Technolog Officer at Warpnet, Roald uses his acquired skills daily within a variety of context related to cybersecurity.
Reworr
AI Security & Safety Researcher at Palisade Research
Reworr is an AI security and safety researcher at Palisade Research.
Chen Shiri
Cyber Security Researcher, Accenture Security
Chen Shiri is a cyber security researcher, hacker, known for his research on low-level security.
Krystian Działowy
Security consultant at Securitum
Kamil Działowy – Penetration Tester at Securitum for 5+ years, conducting dozens of projects annually.
August Joseph
Chief Technology Officer
August Joseph is the Chief Technology Officer at KAZIMI, a cybersecurity firm specializing in pioneering solutions for verified data integrity.
Tony UV
VerSprite, CEO, Author
As the CEO & Founder of VerSprite Security, a global security, privacy, and risk management firm, Tony leads a team of ‘security hybrids’ who deliver tailored and innovative solutions to address the complex challenges faced by some of the world’s largest multi-national companies.
Luigi Gubello
Security Engineer @ Pitch
Security Engineer. Sometimes I try to hack stuff. Investigated by the authorities due to an SQL injection, financed by the powers that be, someone said.
Sam Stepanyan
OWASP London Chapter Leader
Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 25 years of experience in IT.
Robert Shala
Co-Founder, Sentry
Robert Shala is co-founder of Sentry, where he leads 50 security consultants and has delivered 2000-plus red-team and appsec engagements.
Armend Gashi
Managing Security Consultant at Sentry Cybersecurity
Armend Gashi is Managing Security Consultant at Sentry.
Mihai Vasilescu
Threat Hunter
Mihai's expertise lies in gathering Threat Intelligence on recent botnets and network attack exploitation techniques, including malware analysis and botnet tracking.
Małgorzata Grabiec - Bąk
Chapter Lead Security - Heineken
Security Awareness Specialist and Lead of the Security Chapter with an engineering background and expertise in Agile Coaching and Product Development.
Agata Łabęcka
Security Awareness Specialist
Cyber Awareness Specialist with a background in psychology. Agata designs security awareness programs focused on reducing human risk.
Sofía García
Security Awareness Specialist
Security Awareness Specialist with a strong background in cybersecurity. Sofía leads global phishing initiatives and designs targeted programs for high-risk user profiles. She combines technical insights with creative engagement by using data analysis, gamification, and more.
Pedro Dallegrave
EM - Cloud & Security
Security engineer who, after too much time breaking things, became a DevOps to try fixing them.
Łukasz Pastuszak
Penetration Tester at Velite.io
Jon the Traveler
Director
I have been working in dynamic content creation for over 20 years. Live streamed audio and video, movie and film production, training and distance learning, animation, augmented reality, live events, video and practical games, websites, blogs, music and more.
Aadesh Shinde
Threat Researcher at BforeAI
Aadesh Shinde is Threat Researcher at BforeAI, contributing to the forefront of predictive cybersecurity.
John Strand
Owner at Black Hills InfoSec
John is a Managing Intern at Black Hills Information Security, Active Countermeasures, Antisyphon Training, Wild West Hackin' Fest, REKCAH Publishing
Steve Borosh
Managing Intern at Black Hills Information Security
Steve Borosh is a proud U.S. Army Infantry veteran and security consultant at Black Hills Information Security.
Julia Kim (Jules)
Application Security Software Engineer at Netflix
Jules is an Application Security Software Engineer at Netflix leading efforts around code and software security while enabling business velocity.
Andy Hoernecke
Security Engineer at Netflix
Andy Hoernecke is a Security Engineer at Netflix leading the data-driven Security Posture Lifecycle program which aims to deeply understand security posture at scale through data and metrics.
trainings
Exclusive trainings
-
Exclusive Trainings
Sep 26, 2025
schedule
Event Schedule
-
01 - Discovery
Sep 27, 2025
-
02 - Insights
Sep 27, 2025
-
03 - Frontier
Sep 27, 2025
-
AppSec & Red Team Village
Sep 27, 2025
-
Cyber Games Village
Sep 27, 2025
08h - 08h45
Duration 45m
Duration 45m
Registration
Bring your QR CodeRegistration process
This is the moment to arrive and check-in to the conference. Get your badge, bag and all the gadgets available and prepare to the busy day ahead.
08h45 - 09h
Duration 15m
Duration 15m
BSides Kraków Founder
BSides Kraków 2025 & 2026The big opening
Here an overview of the conference will be provided, surprises announced and of course the next year plan already. Be prepare to meet new people at this moment.
09h - 09h45
Duration 45m
Duration 45m
Panagiotis Fiskilis
Senior Penetration Tester at NVISOEvading EDRs for fun and profit (mostly profit): A quick and dirty overview
In this talk we will learn about EDR evasion, in this quick and dirty workshop/overview from day2day Red Team exercises. We will unleash the power of C/C++ and the power of syscalls to evade commercial EDRs. Furthermore, we will learn all about how an EDR works.
09h45 - 10h30
Duration 45m
Duration 45m
Ante Gojsalić
CTO and Co-Founder- SplxAIEvading GenAI Application Defenses
This session provides an in-depth look at Generative AI (GenAI) red teaming, including its unique challenges and risks. We’ll explore the new attack surface GenAI creates, common security mistakes, and key areas to focus on during risk assessments.
10h30 - 11h15
Duration 45m
Duration 45m
Thiago Bordini
Head Cyber Threat IntelligenceAdvanced Persistent Threats: How to Stay Effective for a Decade?
In this groundbreaking presentation, we will delve into a series of case studies spanning 10 years of incident response in Brazil, where highly sophisticated cyberattacks used custom physical implants to infiltrate the network infrastructure of various companies. We will explore the timeline of these cases, highlighting both the evolution of defenses and attack tactics, and uncover a startling fact: how is it possible that cyberattacks known for a decade are still so effective? What are the critical failures companies are still making? This session is a call to rethink cybersecurity strategies, providing deep insights into where we are failing and how we can improve to face the advanced persistent threats of today and tomorrow.
12h - 13h
Duration 1h
Duration 1h
Lunch break
Eat something!Lunch break 1h
Lunch break - might or not be included at the venue
13h - 13h45
Duration 45m
Duration 45m
Andy Hoernecke
Security Engineer at NetflixJulia Kim (Jules)
Application Security Software Engineer at NetflixMeasuring and Driving Security Posture at Scale
Join Netflix engineers Andy Hoernecke and Julia Kim (Jules) as they present an approach to quantifying and measuring security posture at the speed and scale of Netflix, where the show must go on. They will discuss the overall framework, and apply it to the Application Security domain. We will talk through identifying and presenting the right metrics, measuring security posture, and finding the right balance of security control, friction and business enablement.
13h45 - 14h30
Duration 45m
Duration 45m
Jefferson Macedo
PurpleBird Security, Founder and Technical DirectorInside a $15M Cyber Heist: From Home Router Intrusions to Social Engineering
n this session, we’ll dive into a multi-stage attack campaign that resulted in a major financial fraud in Brazil, where a threat group escalated from rudimentary network intrusions - leveraging compromised home and small business routers - to a highly effective social engineering operation targeting contact center operators.
14h30 - 15h15
Duration 45m
Duration 45m
John Strand
Owner at Black Hills InfoSec15h15 - 16h
Duration 45m
Duration 45m
Kev Milne
Cyber Threat Intelligence Manager and Cyber Mentor at NatWest BankHacking Mainframes - How To Become SPECIAL...
Mainframes are definitely not relics of the past—they’re still the digital backbone of banks, governments, and Fortune 500s. In this talk, I’ll crack open the world of mainframe hacking, starting with targeted OSINT techniques and pivoting straight into terminal access. I'll demosntrate the scripts, REXX routines, and JCL tools used to gain access, plus demo my newly developed EBCDIC password capture tool.
16h - 16h45
Duration 45m
Duration 45m
Chen Shiri
yber Security Researcher, Accenture SecurityThe Multiverse of Madness Adversarial Attacks on AI
This presentation delves into my new research and methodologies for attacking Deep Neural Networks (DNNs) and AI models in black-box environments (without access to internal parameters.).
16h45 - 17h30
Duration 45m
Duration 45m
Julia Zduńczyk
SecuRingBehind Closed Doors - Hacking RFID Readers
Join me to watch attacks on physical access control systems, showcased during multiple live demos alongside interesting stories from real-life physical Red Team assessments. As a Red Teamer I did a lot of engagements requiring me to break into buildings protected by RFID Access Control Systems. Normally I would start with access card cloning... but what if it's not an option? What are the other ways in which one could bypass these systems?
17h30 - 18h
Duration 30m
Duration 30m
BSides Kraków Founder
Thank you & spoilersThe big closing
Here some spoilers of BSides Kraków 2026 will be provided, surprises announced and maybe something more. And the after party place reveled.
08h - 08h45
Duration 45m
Duration 45m
Registration
Bring your QR CodeRegistration process
This is the moment to arrive and check-in to the conference. Get your badge, bag and all the gadgets available and prepare to the busy day ahead.
08h45 - 09h
Duration 15m
Duration 15m
BSides Kraków Founder
BSides Kraków 2025 & 2026The big opening
Here an overview of the conference will be provided, surprises announced and of course the next year plan already. Be prepare to meet new people at this moment.
09h - 09h45
Duration 45m
Duration 45m
Reworr
AI Security & Safety Researcher at Palisade ResearchOffensive Use of LLMs: Current Capabilities & Risks
I'll talk about the current state of LLM capabilities in offensive security, including their practical skills across various domains, benchmarks used for evaluation and how they work, and how these models can be misused by attackers. We'll examine the current offensive use of LLMs, including misuse by threat actors and specific real-world examples, and walk through concrete implementations of AI hacking agents and related misuse/abuse workflows. Finally, I'll discuss existing limitations, emerging threats, and future potential and directions of offensive AI capabilities.
10h - 10h45
Duration 45m
Duration 45m
Wesley Silva
Brazil X-Force Incident Response Leader at IBMDiego Matos Martins
Brazil X-Force Incident Response at IBMYour Data is Gone and the Extortion Just Began
Based on real cases of incident response and crisis management in companies worldwide, we will explore what it's like to face an already established threat within a corporate environment. When an organization's data has already been exfiltrated by an attacker, the challenge goes beyond incident containment and eradication: extortion enters the scene at different levels, with high financial demands in exchange for operational recovery, the cessation of attacks, and the return (or non-exposure) of compromised data.
11h - 11h45
Duration 45m
Duration 45m
Dorota Kozlowska aka Woman in Red
Woman in RedSocial Engineering for Covert Access Assignments
This presentation will explore the strategic use of social engineering in penetration testing, focusing on gaining covert access to a client's server room. I will outline how to perform reconnaissance, gather intelligence on company structure, employee behavior, and security vulnerabilities. Attendees will learn effective social engineering tactics such as pretexting, tailgating, baiting, and phishing, all designed to manipulate human behavior and bypass physical security.
12h - 13h
Duration 1h
Duration 1h
Lunch break
Eat something!Lunch break 1h
Lunch break - might or not be included at the venue
13h - 13h45
Duration 45m
Duration 45m
Rishabh Gupta
Opitv Security, Senior Security ConsultantSecuring the Cloud: Unveiling Vulnerabilities with AzurEye
Join me for an engaging session on AzurEye, a new tool I’ve developed to enhance security in Azure environments by scanning for vulnerabilities across various services. This session will provide a comprehensive look at AzurEye, its capabilities, and its potential to transform how Azure administrators and security professionals manage cloud security.
14h - 14h45
Duration 45m
Duration 45m
Ruslan Kiyanchuk
Information Security Research EngineerMFA in Practice: Security trade-offs and engineering realities
Every company is responsible for securing customer logins, yet there’s no standard approach to implementing effective and reliable authentication. Despite broad adoption, MFA quality varies widely — and poor choices can undermine its benefits.
14h45 - 15h
Duration 45m
Duration 45m
Coffee break
Everybody likes coffee!Coffee break - 15m
Coffee break - might or not be included at the venue
15h - 15h45
Duration 45m
Duration 45m
Aivars Kalvāns
Eat, sleep, code, repeat.Talking to payment cards over NFC
Contactless payments by tapping your card are becoming widely accepted. Mobile phones were taught to emulate contactless payment cards by using HCE technology and now we are tapping our phones everywhere.
16h - 16h45
Duration 45m
Duration 45m
Vlastimil Sindelar
Security Engineer | Cybersecurity & RiskRetrofitting Security: A Survival Guide for Legacy Systems
We rarely get to build from scratch. Many of us inherit legacy systems that were never designed for today’s threats — but still run critical operations. Securing them is not just a technical challenge; it is political, architectural, and deeply operational.
17h00 - 17h45
Duration 45m
Duration 45m
Bodhisattva Das
Cloud Engineer - Nextuple IncEnhancing open-source IDS & SIEM solutions into AI-enabled XDR & SOAR Solutions in Cloud Environment
The high cost associated with enterprise Cybersecurity Solutions often mean that small and Medium Organisations are increasingly rely on open-source tools like Snort and Wazuh to detect and manage cyber threats, but these solutions often struggle with high false positives, limited automation, and manual response overhead. This not only is a pain point for the security teams, but also reduce the effectiveness of these solutions compared to the industry leading ones.
17h45 - 18h
Duration 15m
Duration 15m
BSides Kraków Founder
Thank you & spoilersThe big closing
Here some spoilers of BSides Kraków 2026 will be provided, surprises announced and maybe something more.
08h - 08h45
Duration 45m
Duration 45m
Registration
Bring your QR CodeRegistration process
This is the moment to arrive and check-in to the conference. Get your badge, bag and all the gadgets available and prepare to the busy day ahead.
08h45 - 09h
Duration 45m
Duration 45m
BSides Kraków Founder
BSides Kraków 2025 & 2026The big opening
Here an overview of the conference will be provided, surprises announced and of course the next year plan already. Be prepare to meet new people at this moment.
09h - 09h45
Duration 15m
Duration 15m
Noah Jelich
Security Researcher & Software ArchitectKilling with Keyboards – How Your Digital Footprint Can Be Weaponized
In an era where information is power, the wrong keystroke can mean the difference between security and catastrophe. Killing with Keyboards explores real-world scenarios where digital traces—social media posts, blockchain transactions, leaked metadata—become vulnerabilities exploited by hackers, corporations, and state actors.
10h - 10h45
Duration 45m
Duration 45m
Adrien Lasalle aka @AlrikRr
Offensive Security AdvisorHardware Hacking Curiosity
In this talk, I will explore the fascinating world of hardware hacking, a domain that remains underappreciated by both security professionals and organizations when assessing their attack surface. My objective is to demystify hardware hacking techniques and demonstrate their significance in modern cybersecurity.
11h - 11h45
Duration 45m
Duration 45m
Antonio Cortés aka @hackychucky
Cyber Security AnalystClearing the Waters: DeOtter's Battle Against Obfuscated Phishing
In this talk, we’ll take a deep dive into the world of phishing malware and the obfuscation techniques used to hide malicious JavaScript code. We'll explore how these techniques work and the countermeasures you can use to deobfuscate and expose the hidden threats in real time.
12h - 13h
Duration 1h
Duration 1h
Lunch break
Eat something!Lunch break 1h
Lunch break - might or not be included at the venue
13h - 14h45
Duration 45m
Duration 45m
Małgorzata Grabiec - Bąk
Chapter Lead Security - HeinekenAgata Łabęcka
Security Awareness Specialist
WORKSHOP
Building Cyber resilient culture with interactive crisis simulation
In this workshop, you will have a chance to participate an interactive crisis simulation, where you’ll need to make fast and difficult decisions in the heart of a cyber crisis. Powered by AI, this real-life incident simulation was created to give leaders firsthand experience of what it’s like to navigate a cyber attack - showing them why their decisions matter and how they can drive real change. Now you can experience this as well!
14h45 - 15h
Duration 45m
Duration 45m
Coffee break
Everybody likes coffee!Coffee break - 15m
Coffee break - might or not be included at the venue
15h - 15h45
Duration 45m
Duration 45m
Łukasz Pastuszak
Penetration Tester at Velite.ioSecure by Design or Secure by Luck? Rebuilding AppSec for AI-Era Development
AI-assisted coding and loosely structured workflows have changed how software gets built. But most security practices, especially penetration testing, haven’t evolved to meet that shift. Traditional testing still happens too late, while vulnerabilities introduced early go unaddressed. Even with tools like SAST, DAST, and IAST in the pipeline, the attacker’s perspective often comes after critical design choices are made. This talk explores how to bring adversarial thinking earlier into the development process and adapt AppSec to match the speed and style of AI-driven engineering.
16h - 16h45
Duration 45m
Duration 45m
Aadesh Shinde
Threat Researcher at BforeAIIntel in the Wild: Advanced Campaigns & Infostealer Distribution
Phishing remains one of the most effective tools for cybercriminals, leading to large-scale credential theft, malware infections, and data exfiltration. This workshop provides a hands-on approach to tracking phishing campaigns, analyzing malware distribution networks, and leveraging Threat Intelligence to uncover attacker infrastructure.
17h - 17h45
Duration 45m
Duration 45m
Roald Nefs
Chief Technology Officer at WarpnetPython on Wheels: Hacking Automotive Systems
As modern vehicles evolve into complex networks of software and hardware, they become increasingly susceptible to cyber threats. This presentation delves into how Python can be utilized to both identify vulnerabilities and enhance the security of automotive systems. We will explore real-world scenarios where Python tools and techniques are applied to penetrate vehicle networks, analyze security flaws, and develop robust defenses against potential attacks.
17h45 - 18h
Duration 15m
Duration 15m
BSides Kraków Founder
Thank you & spoilersThe big closing
Here some spoilers of BSides Kraków 2026 will be provided, surprises announced and maybe something more.
08h - 08h45
Duration 45m
Duration 45m
Registration
Bring your QR CodeRegistration process
This is the moment to arrive and check-in to the conference. Get your badge, bag and all the gadgets available and prepare to the busy day ahead.
08h45 - 09h
Duration 15m
Duration 15m
BSides Kraków Founder
BSides Kraków 2025 & 2026The big opening
Here an overview of the conference will be provided, surprises announced and of course the next year plan already. Be prepare to meet new people at this moment.
09h - 09h45
Duration 45m
Duration 45m
Spyros Gasteratos
Security Engineer & ArchitectA completely pluggable DevSecOps programme, for free, using community resources
Despite our collective efforts, we haven’t managed to harmonize tools and processes. Several projects like ASVS, SAMM and others have attempted information harmony but only the now defunct Glue has attempted tool orchestration harmonization and for good reason, it is a hard problem to solve, almost impossible by volunteers alone.
10h - 10h45
Duration 45m
Duration 45m
Sam Stepanyan
OWASP London Chapter LeaderUsing OWASP Nettacker For Recon and Vulnerability Scanning
OWASP Nettacker project (a portmanteau of "Network Attacker") was created to automate the information gathering, vulnerability scanning and in general to aid the penetration testing engagements. Nettacker recently gained a lot of interest from the European and Asian penetration testing communities and was even included in the specialist Linux distribution for penetration testers and security researchers. Nettacker is able to run various recon and vulnerability detection scans using a variety of methods and generate scan reports for applications and networks, including open ports, services, vulnerabilities, misconfigurations, default credentials and many other cool features - for example an ability to chain different scan methods. This talk will feature a live demo and several practical usage examples of how organisations can benefit from this OWASP project for automated security testing
11h - 11h45
Duration 45m
Duration 45m
Luigi Gubello
Security Engineer @ Pitchapp.alert(1) is the new alert(1)
PDFs - rise, decline, and revival: a journey across how we have changed our way of viewing and editing PDF files by moving from offline clients to online services, and how this is changing the role of PDF files as attack vectors.
12h - 13h
Duration 1h
Duration 1h
Lunch break
Eat something!Lunch break 1h
Lunch break - might or not be included at the venue
13h - 13h45
Duration 45m
Duration 45m
Tony UV
VerSprite, CEO, AuthorPASTA-Driven AI Red Teaming: Securing Agentive Systems Through Structured Threat Modeling
As AI agents increase in capability and autonomy, they introduce novel attack surfaces and threat vectors that traditional security approaches may miss. This presentation introduces a specialized adaptation of the Process for Attack Simulation & Threat Analysis (PASTA) methodology for AI red teaming, specifically tailored for development teams building agentive solutions.
14h - 14h45
Duration 45m
Duration 45m
August Joseph
Chief Technology OfficerThe Birthplace of Lies: Hacking Analytics SDKs
Apps run on ads. Ad networks and analytics companies require an SDK to be installed in the app to run. These SDKs are riddled with exploits, vulnerabilities, unsolicitated tracking, and disgusting behaviours. In this talk, we'll go through some of those techniques and explain how everyone in this industry does not care about you: the actual users.
14h45 - 15h
Duration 45m
Duration 45m
Coffee break
Everybody likes coffee!Coffee break - 15m
Coffee break - might or not be included at the venue
15h - 15h45
Duration 45m
Duration 45m
Krystian Działowy
Security consultant at SecuritumBeyond 22 and 445: Hacking lesser-known ports and protocols
Most pentesters and defenders focus on the usual suspects: SSH, HTTP(S), and SMB. But what about the overlooked and obscure? In this talk, we’ll explore how unusual or “boring” ports can become goldmines for attackers. From printers exposing raw port 9100, to UPnP and IPMI exposing full control, to database services with weak auth on non-default ports — attackers are actively scanning beyond the top 10. We’ll walk through real-life examples and live-style demos of exploits against protocols like mDNS, WS-Discovery, VNC, Telnet, and even management ports hiding behind non-standard numbers. This talk is built for defenders and pentesters who want to think outside the port-scan box and understand what really happens when you look past the defaults.
16h - 16h45
Duration 45m
Duration 45m
Robert Shala aka zizkill
Co-Founder, SentryRole Injection - Hijacking ChatML Compatible Agents
The Chat Completions (ChatML) message schema [{role, content}, …] has become the lingua‑franca of large‑language‑model APIs. DeepSeek, xAI Grok, GroqCloud, NVIDIA NIM, and many self‑hosted gateways expose endpoints that promise “drop‑in OpenAI compatibility.” That convenience ships with a hidden threat: any client that can smuggle a message labelled role:"developer" or role:"system" silently outranks the end‑user and can re‑program the agent, invoke privileged tools, or drain tokens.
17h - 17h45
Duration 45m
Duration 45m
Pedro Dallegrave
EM - Cloud & SecurityShifting left isn’t enough: time to shift mindset
This talk explores the shift from traditional, prevention-focused security to a (maybe) more realistic and sustainable approach: cyber resilience. Based on hands-on experience, let’s talk about real challenges and how to create systems that can take a hit and keep running.
17h45 - 18h
Duration 15m
Duration 15m
BSides Kraków Founder
Thank you & spoilersThe big closing
Here some spoilers of BSides Kraków 2026 will be provided, surprises announced and maybe something more.
08h - 08h45
Duration 45m
Duration 45m
Registration
Bring your QR CodeRegistration process
This is the moment to arrive and check-in to the conference. Get your badge, bag and all the gadgets available and prepare to the busy day ahead.
08h45 - 09h
Duration 15m
Duration 15m
BSides Kraków Founder
BSides Kraków 2025 & 2026The big opening
Here an overview of the conference will be provided, surprises announced and of course the next year plan already. Be prepare to meet new people at this moment.
09h - 17h
Duration all day long.
Duration all day long.
Jon Traveler
DirectorTable tops
Play table-top exercises with groups of fellow security enthusiasts with Black Hills InfoSec to level up with real-world scenarios of security breaches and incidents. We will be providing D20 dice to enhance your experience. Free Backdoor & Breaches decks will also be provided! Games will be played at various intervals during the day.
10h - 17h
Duration all day long.
Duration all day long.
MetaCTF
The Modern Cyber Skills PlatformCTF
The team at MetaCTF is excited to run the Capture the Flag competition at Krakow! Our Jeopardy-style CTF will have plenty of challenges for participants at all skill levels, so whether you’re a seasoned CTF player or a beginner, there will be something for you! CTFs are a great way to learn, and our goal is for you to walk away with some new tools, techniques, and skills. You’ll need a laptop to participate. Teams can have up to 4 people, or you may compete as an individual. For practice challenges and solutions from previous competitions, check out https://mctf.io/practice
12h - 13h
Duration 1h
Duration 1h
Lunch break
Eat something!Lunch break 1h
Lunch break - might or not be included at the venue
14h - 14h45
Duration 45m
Duration 45m
Jon Traveler
DirectorHacker Trivia
In the afternoon, stop by the game room for Hacker Trivia. It is a 60 minute session, full of great hacker topics and history. You'll need a smart phone to participate in this game, as you submit your answers through the phone. Let's see if you know your history!
14h45 - 15h
Duration 15m
Duration 15m
Coffee break
Everybody likes coffee!Coffee break - 15m
Coffee break - might or not be included at the venue
17h
Jon Traveler
DirectorCTF End
CTF Prizes - Awarded for the top individual players and the top teams!
16h45 - 17h
Duration 15m
Duration 15m
BSides Kraków Founder
Thank you & spoilersThe big closing
Here some spoilers of BSides Kraków 2026 will be provided, surprises announced and maybe something more.
tickets
Choose a Ticket
General Admission
Free ticket pass
zł 0,00
- Full conference access
- Lunch / coffee break* (If provided)
- Exclusive badge
- After party (If provided)
- Experts Contacts
Recommend
General Admission
T-Shirt ticket
zł 100,00
- Full conference access
- Lunch / coffee break* (If provided)
- Exclusive badge & T-Shirt
- After party (If provided)
- Experts Contacts
General Admission
Online conference ticket
zł 49,99
- Online conference access only
- Lunch / coffee break* (If provided)
- Exclusive badge & T-Shirt
- After party (If provided)
- Experts Contacts
General Admission
AGH Student pass
zł 0,00
- Full conference access
- Lunch / coffee break* (If provided)
- Exclusive badge
- After party (If provided)
- Experts Contacts
General Admission
Sponsor pass
zł 0,00
- Full conference access
- Lunch / coffee break* (If provided)
- Exclusive sponsor badge
- After party (If provided)
- Experts Contacts
General Admission
Donation pass
zł 1,00
- Full conference access
- Lunch / coffee break* (If provided)
- Exclusive donator badge
- After party (If provided)
- Experts Contacts
sponsors
Official Sponsors
BSides Nerd Sponsor (Host & Co-organizer)
BSides Nerd Sponsor (Live conference host / organizer)
Badge Sponsor
Leash Sponsor
Bag Sponsor
Leading Sponsor
Contributing Sponsor
Supporting Sponsor
Notable Sponsor
Supporter Sponsor
Community Partner
Collaborator
engage
Engage with us
Let's Connect!
Have questions, suggestions, or requests? I'm here to help! Feel free to reach out, and let's discuss how we can work together to improve application security.
📩 Get in Touch – Your insights and inquiries are always welcome!
You can send us an email that we will get back to you as soon as possible.
contact@bsideskrakow.plGet your ticket right now before they are sold out!
