BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.hackfest.ca//hf2026//speaker//BZB9FN
BEGIN:VTIMEZONE
TZID:EST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T070000Z
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T080000Z
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-hf2026-RSXKYR@cfp.hackfest.ca
DTSTART;TZID=EST:20261030T094000
DTEND;TZID=EST:20261030T114000
DESCRIPTION:JS-Tap v3 moves beyond exploiting web applications to targeting
  the user’s endpoint itself. JavaScript is used heavily on desktops and 
 in this hands-on workshop you'll deploy three new JS-Tap implant types aga
 inst a Windows workstation on a simulated corporate network.\n\nStart by i
 nstalling a malicious browser extension that harvests sessions from every 
 site the victim visits and injects payloads into specific application doma
 ins on command. We'll then add optional features that escape the browser s
 andbox for filesystem and shell access.\n\nNext we'll patch a local Electr
 on app for screenshots\, keylogging\, network interception\, and message s
 poofing in a corporate chat platform. Then we'll instrument a Node.js CLI 
 tool with a single environment variable to intercept its traffic and keyst
 rokes.\n\nYour operator system can't reach the internal corporate web appl
 ications directly. You'll use JS-Tap Conductor to pivot through an implant
 \, demonstrating the full attack chain from session theft to authenticated
  access on an internal network.\n\nAll infrastructure is provided. Each pa
 rticipant gets a dedicated Windows victim machine and Linux operator box a
 ccessible via noVNC. Just bring a laptop with a browser and an ethernet ad
 apter.\n\nYou'll leave with firsthand experience operating all three beaco
 n types.
DTSTAMP:20261014T080333Z
LOCATION:Track 4 (207)
SUMMARY:Post-Exploitation of the Desktop with JS-Tap - hoodoer
URL:https://cfp.hackfest.ca/hf2026/talk/RSXKYR/
END:VEVENT
END:VCALENDAR