https://hdm.io/

1<!doctype html><html lang=en><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=color-scheme content="light dark">

1<script src=/js/theme.js></script>

1<title>hdm.io</title><link rel=canonical href=https://hdm.io/><link rel=preconnect href=https://fonts.googleapis.com><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@300;400;500&family=Inter:wght@400;500;600&family=Space+Grotesk:wght@400;500;600;700&display=swap" rel=stylesheet><link rel=stylesheet href=https://hdm.io/css/main.css><body><button class=theme-toggle type=button aria-label="Switch theme" title="Switch theme" hidden>
2<svg class="theme-icon-sun" width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/></svg>
3<svg class="theme-icon-moon" width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><path d="M12 3a6 6 0 009 9 9 9 0 11-9-9z"/></svg></button><div id=content><div class=bg-ambient></div><main><header class=site-header><div class=identity><img src=/hdm.png alt="HD Moore" class=avatar><div class=identity-text><span class=name>HD Moore</span>
4<span class=role>Chief Research Officer, <a href=https://www.dragos.com>Dragos</a></span></div></div><nav class=site-nav><a href=#about>About</a>
5<a href=#contact>Contact</a>
6<a href=#talks>Talks</a>
7<a href=#papers>Papers</a></nav></header><section id=about><h2>About</h2><div class=lede><p>HD Moore is Chief Research Officer at <a href=https://www.dragos.com>Dragos</a>, creator of
8<a href=https://www.metasploit.com>Metasploit</a>, and founder of <a href=https://www.runzero.com>runZero</a>.
9His work has focused on vulnerability research and network discovery since the 1990s. He previously held
10leadership roles at Atredis Partners, Rapid7, and BreakingPoint.</p><p>His early work included telephone network research, exploit development for the Department of Defense,
11and authorized security testing for financial institutions. He advocates for open-source software and
12vulnerability disclosure. Outside work, he enjoys Go programming, electronics, running, and single-player RPGs.</p></div></section><section id=contact><h2>Contact</h2><p class=warning-text>These are my only communication accounts. Unlisted accounts may be impersonators. Treat offers of
13cryptocurrency recovery, unauthorized system access, or commercial services from those accounts as scams.</p><dl class="bio-list contact-grid"><div class=bio-item><dt>email (personal)</dt><dd>x<span class=e-at></span>hdm<span class=e-dot></span>io</dd></div><div class=bio-item><dt>mastodon</dt><dd><a rel=me href=https://infosec.exchange/@hdm>@[email protected]</a> <a href=/posts/>[mirror]</a></dd></div><div class=bio-item><dt>bluesky</dt><dd><a rel=me href=https://bsky.app/profile/hdm.io>@hdm.io</a></dd></div><div class=bio-item><dt>twitter</dt><dd><a rel=me href=https://twitter.com/hdmoore>@hdmoore</a></dd></div><div class=bio-item><dt>github</dt><dd><a rel=me href=https://github.com/hdm>@hdm</a></dd></div><div class=bio-item><dt>linkedin</dt><dd><a rel=me href=http://linkedin.com/in/hdmoore>@hdmoore</a></dd></div></dl></section><section id=talks><h2>Talks</h2><dl class="bio-list presentation-list"><div class=bio-item><dt><a href=/decks/DEFCON34-LightsOut.pdf>Lights Out: Out-of-Band, Out of Mind, Out of Control</a></dt><dd>DEFCON 34 - August 2026</dd></div><div class=bio-item><dt><a href=/decks/BlackHat2026-LightsOut.pdf>Lights Out: BMCs Are Still Broken and Now We Have the Receipts</a></dt><dd>Black Hat USA - August 2026</dd></div><div class=bio-item><dt><a href=/decks/BSidesLV-2026-Mind-The-Gap.pdf>Mind the Gap: Bridges, Backplanes, and BloodHound</a></dt><dd>BSides Las Vegas - August 2026</dd></div><div class=bio-item><dt><a href=#>Preparing for AI Vulnerability Exploitation: Preventing Cataclysm</a></dt><dd>with Gadi Evron & Heather Adkins at RSAC - March 2026</dd></div><div class=bio-item><dt>

13<a href=/decks/Sector-25-Moore-TheOnceAndFutureRules.pdf>The Once and Future Rules of Cybersecurity</a></dt><dd>SecTor - October 2025</dd></div><div class=bio-item><dt>The Death and Rebirth of Vulnerability Management</dt><dd>Blue Team Con 2025 - September 2025</dd></div><div class=bio-item><dt><a href="/decks/MOORE - Shaking Out Shells With SSHamble.pdf">Shaking Out Shells With SSHamble</a></dt><dd>DEF CON 33 - August 2025</dd></div><div class=bio-item><dt><a href="/decks/TDI - Forging Strong Cyber Communities in Uncertain Times.pdf">Forging Strong Communities In Uncertain Times</a></dt><dd>The Diana Initiative - August 2025</dd></div><div class=bio-item><dt><a href="/decks/Turbo Tactical Exploitation_ 22 Tips for Tricky Targets.pdf">Turbo Tactical Exploitation: 22 Tips for Tricky Targets</a></dt><dd>BSides Las Vegas - August 2025</dd></div><div class=bio-item><dt><a href="/decks/NorthSec 2025 - A Pirates Guide to Snake Oil And Security.pdf">A Pirate's Guide to Snake Oil & Security</a></dt><dd>NorthSec - May 2025</dd></div><div class=bio-item><dt><a href=/decks/Charting_The_SSH_Multiverse.pdf>Charting the SSH Multiverse</a></dt><dd>BSides San Francisco - April 2025</dd></div><div class=bio-item><dt><a href=https://www.runzero.com/omdia-webcast-registration/>Vulnerability Management Is Broken: What's The Fix?</a></dt><dd>Omdia Webcast - April 2025</dd></div><div class=bio-item><dt><a href=https://www.runzero.com/resources/your-next-incident-wont-have-a-cve/>Your Next Incident Won't Have a CVE</a></dt><dd>Attack Surface Cybersecurity Summit - March 2025</dd></div><div class=bio-item><dt><a href=/decks/2025-Kybertuska-Numbers-of-the-Beast/>Numbers of the Beast</a></dt><dd>Kybertuska - March 2025</dd></div><div class=bio-item><dt><a href=/decks/SnowFROC_2025_Building_Security_Communities_Final.pdf>Building Open Source Security Communities</a></dt><dd>SnowFROC `25 - March 2025</dd></div><div class=bio-item><dt><a href="https://www.youtube.com/watch?v=QyK_-elLjL8">The Unreasonable Effectiveness of Inside Out Attack Surface Management</a></dt><dd>DarkReading - December 2024</dd></div><div class=bio-item><dt>Big MAC Attack</dt><dd>Hacker Hoedown - November 2024</dd></div><div class=bio-item><dt><a href=/decks/2024-RowdyCon-Numerology/>Hacker Numerology</a></dt><dd>RowdyCon - October 2024</dd></div><div class=bio-item><dt><a href=/decks/2024-LASCON-Numerology/>Hacker Numerology</a></dt><dd>LASCON - October 2024</dd></div><div class=bio-item><dt><a href=/decks/JCPEBB~1.pdf>A Pebble Down the Well: Network Exploration</a></dt><dd>JawnCon 0x1 - October 2024</dd></div><div class=bio-item><dt><a href=/decks/DEF%20CON%2032%20-%20HD%20Moore%20Rob%20King%20-%20Sshamble%20Unexpected%20Exposures%20in%20the%20Secure%20Shell.pdf>SSHamble: Unexpected Exposures in the Secure Shell</a></dt><dd>DEF CON 32 - August 2024</dd></div><div class=bio-item><dt><a href=/decks/REVISED02-US24_Moore_Secure_Shells_in_Shambles_Wednesday.pdf>Secure Shells in Shambles</a></dt><dd>Black Hat USA - August 2024</dd></div><div class=bio-item><dt><a href=/decks/2024-CypherCon-25YearsVM.pdf>25 Years of Vulnerability Mismanagement</a></dt><dd>CypherCon - April 2024</dd></div><div class=bio-item><dt><a href=/decks/WiresAndOutliers.pdf>Wires & Outliers</a></dt><dd>Texas Cyber Summit - September 2023</dd></div><div class=bio-item><dt><a href=/decks/Duo_Tech_Talks_-_Modern_Network_Discovery.pdf>Modern Network Discovery</a></dt><dd>Duo Tech Talks - December 2019</dd></div><div class=bio-item><dt><a href=/decks/Modern_Internet_Scale_Reconnaisance.pdf>Modern Internet Scale Reconnaissance</a></dt><dd>BSides Las Vegas 2017</dd></div><div class=bio-item><dt><a href=/decks/UNITED_2015_Internet_of_Threats_A.pdf>Internet of Threats</a></dt><dd>United Summit 2015</dd></div><div class=bio-item><dt><a href=/decks/HouSecCon_2013.pdf>The Security Space Age</a></dt><dd>HouSecCon 2013</dd></div><div class=bio-item><dt><a href=/decks/DerbyCon_2013.pdf>Scanning Darkly</a></dt><dd>DerbyCon 2013</dd></div><div class=bio-item><dt>The Threat Landscape</dt><dd>United Summit 2013</dd></div><div class=bio-item><dt><a href=/decks/2013_OWASP_Austin_June_Web_Services.pdf>Untangling Windows 8 Web Services</a></dt><dd>OWASP Austin 2013</dd></div><div class=bio-item><dt>Serial Offenders</dt><dd>InfoSecSouthwest 2013</dd></div><div class=bio-item><dt>Serial Offenders</dt><dd>AusCERT 2013 SCADA Forum</dd></div><div class=bio-item><dt><a href=/decks/2013_AusCERT.pdf>Global Network Security</a></dt><dd>AusCERT 2013</dd></div><div class=bio-item><dt>Global Vulnerability Analysis</dt><dd>Queensland Police Workshop 2013</dd></div><div class=bio-item><dt><a href=/decks/Serial_Offenders.pdf>Serial Offenders</a></dt><dd>AISA 2013</dd></div><div class=bio-item><dt>Using Metasploit on Kali Linux</dt><dd>Rapid7 Webcast 2013</dd></div><div class=bio-item><dt>Global Vulnerability Analysis</dt><dd>RSA USA 2013</dd></div><div class=bio-item><dt>Security Flaws in Universal Plug and Play</dt><dd>Rapid7 Webcast 2013</dd></div><div class=bio-item><dt><a href=/decks/The%20Wild%20West%20Public.pdf>The Wild West</a></dt><dd>DerbyCon 2012</dd></div><div class=bio-item><dt>Validating Risks in Your Security Program</dt><dd>Rapid7 Webcast 2012</dd></div><div class=bio-item><dt>Empirical Exploitation</dt><dd>SANS Pen-test Summit 2012</dd></div><div class=bio-item><dt>The Root Shell Index</dt><dd>OWASP Austin 2012</dd></div><div class=bio-item><dt>Terrible Things in Network Security</dt><dd>Secure360 2012</dd></div><div class=bio-item><dt>Easy Network Intrusion with Java</dt><dd>Rapid7 Webcast 2012</dd></div><div class=bio-item><dt>How Automated Security Assessments Stop Untargeted Attacks</dt><dd>Rapid7 Webcast 2012</dd></div><div class=bio-item><dt>Identifying IPv6 Security Risks in IPv4 Networks</dt><dd>Rapid7 Webcast 2012</dd></div><div class=bio-item><dt>Effective Password Testing using Metasploit</dt><dd>Rapid7 Webcast 2012</dd></div><div class=bio-item><dt>Metasploit Community Edition</dt><dd>Rapid7 Webcast 2011</dd></div><div class=bio-item><dt><a href=/decks/AcousticIntrusions.pdf>Acoustic Intrusions</a></dt><dd>DerbyCon 2011</dd></div><div class=bio-item><dt>Something Awesome (WarVOX)</dt><dd>BSides Las Vegas 2011</dd></div><div class=bio-item><dt>Fixing the Right Vulnerabilities</dt><dd>Rapid7 Webcast 2011</dd></div><div class=bio-item><dt>Metasploit 4.0</dt><dd>Rapid7 Webcast 2011</dd></div><div class=bio-item><dt>Oil Fields, Quake Live, and Metasploit</dt><dd>BSides Austin 2011</dd></div><div class=bio-item><dt><a href=/decks/When_CSOs_Attack.pdf>When CSOs Attack</a></dt><dd>BSides San Francisco 2011</dd></div><div class=bio-item><dt>Board Room Spy Cams</dt><dd>Rapid7 Webcast 2011</dd></div><div class=bio-item><dt>Beyond Exploits</dt><dd>Secure360 2010</dd></div><div class=bio-item><dt>Cyber Weaponry</dt><dd>MIL-OSS 2010</dd></div><div class=bio-item><dt><a href=/decks/FunWithVxWorks.pdf>Fun with VxWorks</a></dt><dd>DEF CON SkyTalks 2010</dd></div><div class=bio-item><dt>Metasploit 3.4 and Beyond</dt><dd>Rapid7 Webcast 2010</dd></div><div class=bio-item><dt>Network Time Bandits</dt><dd>BSides San Francisco 2010</dd></div><div class=bio-item><dt>Metasploit and Money</dt><dd>Black Hat DC 2010</dd></div><div class=bio-item><dt><a href=/decks/SOURCE_D32.pdf>Death by 32 Bits</a></dt><dd>SOURCE Boston 2010</dd></div><div class=bio-item><dt>WarVOX</dt><dd>DEF CON 2009</dd></div><div class=bio-item><dt>Metasploit Evolved</dt><dd>DEF CON 2009</dd></div><div class=bio-item><dt>WarVOX</dt><dd>BSides Las Vegas 2009</dd></div><div class=bio-item><dt>The Future of Metasploit</dt><dd>SANS Pen-test Summit 2009</dd></div><div class=bio-item><dt>Exploiting IPv6</dt><dd>SecTor 2008</dd></div><div class=bio-item><dt>Metasploit Prime</dt><dd>SecTor 2008</dd></div><div class=bio-item><dt>Keynote</dt><dd>SANS Penetration Testing Summit 2008</dd></div><div class=bio-item><dt>Tactical Exploitation</dt><dd>DEF CON 2007</dd></div><div class=bio-item><dt><a href=/decks/tactical.pdf>Tactical Exploitation</a></dt><dd>Black Hat Briefings 2007</dd></div><div class=bio-item><dt>Live Free or Hack Hard: Metasploit 2007</dt><dd>CanSecWest 2007</dd></div><div class=bio-item><dt>Metasploit</dt><dd>FOSDEM 2007</dd></div><div class=bio-item><dt>Metasploit 3</dt><dd>IT-ISAC October 2006</dd></div><div class=bio-item><dt>Metasploit Reloaded</dt><dd>Black Hat Briefings 2006</dd></div><div class=bio-item><dt><a href=/decks/bh06_thermoptic.pdf>Thermoptic Camouflage</a></dt><dd>Black Hat Briefings 2006</dd></div><div class=bio-item><dt>Six Degrees of XSSPloitation</dt><dd>Black Hat Briefings 2006</dd></div><div class=bio-item><dt>Metasploitation</dt><dd>Cansecwest 2006</dd></div><div class=bio-item><dt><a href=/decks/metasploit3.pdf>Metasploit v3.0</a></dt><dd>Microsoft Blue Hat 2006</dd></div><div class=bio-item><dt><a href=/decks/bluehat06_aspnet.pdf>Bitten on the ASP</a></dt><dd>Microsoft Blue Hat 2006</dd></div><div class=bio-item><dt>Abusing Disaster Recovery Systems</dt><dd>InterzoneWest 2005</dd></div><div class=bio-item><dt><a href=/decks/first05_reprint.pdf>Abusing Disaster Recovery Systems</a></dt><dd>FIRST 2005</dd></div><div class=bio-item><dt>The Art of Blue Teaming</dt><dd>UTSA CIAS 2005</dd></div><div class=bio-item><dt><a href=/decks/metasploit_bluehat2005.pdf>We Have the Technology</a></dt><dd>Microsoft Blue Hat 2005</dd></div><div class=bio-item><dt>Advances in Exploit Technology</dt><dd>Cansecwest 2005</dd></div><div class=bio-item><dt><a href=/decks/defcon.pdf>Hacking Like in the Movies</a></dt><dd>DEF CON 2004</dd></div><div class=bio-item><dt>Hacking Like in the Movies</dt><dd>Black Hat Briefings 2004</dd></div><div class=bio-item><dt>Modern ASP.NET Caveats</dt><dd>Cansecwest 2004</dd></div><div class=bio-item><dt>Exploiting the Metasploit Framework</dt><dd>Cansecwest 2004</dd></div><div class=bio-item><dt>Advanced Exploit Development</dt><dd>Hack-in-the-Box 2003</dd></div><div class=bio-item><dt>Breaking ASP.NET</dt><dd>Cansecwest 2002</dd></div><div class=bio-item><dt>SQL Injection</dt><dd>SANS Bootcamp 2002</dd></div><div class=bio-item><dt>Smashing Windows</dt><dd>SANS Bootcamp 2002</dd></div><div class=bio-item><dt>Making NT Bleed</dt><dd>SANS I/O Wargames 2001</dd></div><div class=bio-item><dt>Making NT Bleed</dt><dd>Cansecwest 2001</dd></div></dl></section><section id=papers><h2>Papers</h2><dl class="bio-list presentation-list"><div class=bio-item><dt><a href=https://www.runzero.com/research-report/>runZero Research Report: Volume 1</a></dt><dd>with Rob King & Tom Sellers at RSAC 2024</dd></div><div class=bio-item><dt><a href=/writing/login_aug15_14_geer.pdf>Balkanization from Above</a></dt><dd>with Dan Geer in <a href=https://www.usenix.org/system/files/login/articles/login_aug15_14_geer.pdf>USENIX ;login: (August 2015)</a></dd></div><div class=bio-item><dt><a href=/writing/TheSecuritySetup_HDM.pdf>The Security Setup: HD Moore</a></dt><dd><a href=http://www.thesecuritysetup.com/home/2014/10/1/hd-moore>TheSecuritySetup.com</a></dd></div><div class=bio-item><dt><a href=/writing/Mitigating%20Service%20Account%20Credential%20Theft%20on%20Windows.pdf>Mitigating Service Account Credential Theft on Windows</a></dt><dd>with Joe Bialek & Ashwath Murthy</dd></div><div class=bio-item><dt><a href=/writing/SecurityFlawsUPnP.pdf>Security Flaws in Universal Plug and Play: Unplug, Don&#8217;t Play</a></dt><dd>Rapid7 Research</dd></div><div class=bio-item><dt><a href=/writing/TacticalExploitation.pdf>Tactical Exploitation</a></dt><dd>with Valsmith at Black Hat USA 2010</dd></div><div class=bio-item><dt><a href=/writing/BlackHat-DC-2010-Moore-Metasploit-and-Money-wp.pdf>Metasploit and Money</a></dt><dd><a href=https://www.blackhat.com/presentations/bh-dc-10/Moore_HD/BlackHat-DC-2010-Moore-Metasploit-and-Money-wp.pdf>Black Hat DC 2010</a></dd></div><div class=bio-item><dt><a href=/writing/uninformed_46_pentesting_ipv6.txt>Exploiting Tomorrow&#8217;s Internet Today: Penetration testing with IPv6</a></dt><dd><a href="http://www.uninformed.org/?v=all&amp;a=46&amp;t=sumry">Uninformed Journal v10</a></dd></div><div class=bio-item><dt><a href=/writing/uninformed_29_exploiting_80211_drivers.txt>Exploiting 802.11 Wireless Driver Vulnerabilities on Windows</a></dt><dd><a href="http://www.uninformed.org/?v=all&amp;a=29&amp;t=sumry">Uninformed Journal v6</a></dd></div><div class=bio-item><dt>

13<a href=writing/uninformed_1_macosx_ppc_shellcode.txt>Mac OS X PPC Shellcode Tricks</a></dt><dd><a href="http://www.uninformed.org/?v=all&amp;a=1&amp;t=sumry">Uninformed Journal v1</a></dd></div><div class=bio-item><dt><a href=/writing/termulation.txt>Terminal Emulation Security Issues</a></dt><dd><a href="http://marc.info/?l=bugtraq&amp;m=104612710031920&amp;w=1">Bugtraq</a></dd></div></dl></section></main></div><p class=footer>Copyright 1998-2026 HD Moore</p></body></html>