**Scamtopia** is an amusement park with an eccentric host, the mystical Max. Visitors will enjoy amusement rides and a circus show program, but be careful: the park is full of bluff. Don't fall for scams in Scamtopia!

small_Лохотрон600.jpg

thumbnail_Лохотрон600.jpg

Лохотрон600.jpg

Scamtopia

A cyberhobo used to be a cool corporate manager, but one phishing email robbed him of everything. He now wanders the cybercity streets trying not to become the victim of scammers again. Help him to overcome the misfortune!

small_маски2_600.jpg

thumbnail_маски2_600.jpg

маски2_600.jpg

Masks

On the Positive Hack Days main stage, we will discuss the latest cybersecurity and IT topics. The PopScience tent is open to ethical hackers, CEOs, and representatives of popular services, as well as bloggers and influencers. The co-host of the program is AI-created V. Mayakovsky.

On May 20 at 6:00 p.m., **Mayakfest** will be held—a concert dedicated to the 130th anniversary of Vladimir Mayakovsky. The visitors will enjoy songs inspired by Mayakovsky's poetry and accompanied by a symphony orchestra, as well as poems by contemporary poets.

small_Сцена2_600.jpg

thumbnail_Сцена2_600.jpg

Сцена2_600.jpg

Trust in tech

**Cyberenthusiast highway** is one of the busiest streets in the virtual city. A smart crossroad fully controlled the traffic, but a few hours ago cunning hackers seized control of the system, causing a major accident...

small_Перекресток600.jpg

thumbnail_Перекресток600.jpg

Перекресток600.jpg

Cyber­enthusiast highway

The **Trojan vs Cybergeorge** monument is dedicated to an important historical event: the great battle between the main digital defender Cybergeorge and the Trojan horse. At the foot of the monument, there is the Cybermonster Vault museum where you'll learn a lot about phishing campaigns, as well as traps in social networks and dating apps.

small_Конь2_600.jpg

thumbnail_Конь2_600.jpg

Конь2_600.jpg

Trojan vs Cybergeorge

**Infosec specialists can reduce the risks of hacks as early as at the development stage.**

Speakers will talk about approaches in development that can make products more reliable and secure. They will also share recommendations on how to reduce the cost of service architecture and protect against sanctions of open-source GitHub projects.

small_3_Конструкторское-бюро600.jpg

thumbnail_3_Конструкторское-бюро600.jpg

3_Конструкторское-бюро600.jpg

Design studio

**Python is one of the most famous and fastest growing programming languages of the last decade.** 

More than 500 Python developers from all over Russia and representatives of major companies will gather at the Moscow Python Conf++ conference to exchange their expertise and ideas on the use of Python. After the conference, a fun after-party will be held for all the participants, which they'll definitely never forget.

small_6_Python-Moscow600.jpg

thumbnail_6_Python-Moscow600.jpg

6_Python-Moscow600.jpg

Moscow Python Conf++

**The Standoff cyberbattle will demonstrate how hackers can cause irreparable damage to citizens, companies, and entire industries.**

22 red teams of ethical hackers will be looking for ways to disrupt the infrastructure of the virtual State F, while seven blue teams of defenders will try to counter the attacks. Winners among the attackers will receive a cash prize, branded souvenirs, and a unique trophy—a red and blue cup.

small_Крепость600.jpg

thumbnail_Крепость600.jpg

Крепость600.jpg

Standoff

**IPv5. Made in Russia. Information security innovation technologies**

Most foreign companies left the Russian information security market, giving their customers a difficult choice: look for a replacement for those who left or reconsider the way they choose cybersecurity solutions to develop new approaches to protecting their assets. Russian companies will present their developments, which will form the foundation of the technological sovereignty in the field of information security in the coming years.

small_8_БизнесШатер2_600.jpg

thumbnail_8_БизнесШатер2_600.jpg

8_БизнесШатер2_600.jpg

Cyber­fortress

**The most interesting thing at information security conferences is the experience of customers who share problems they face and ways to solve them.**

Russian businessmen will share their experience in building results-oriented cybersecurity in their organizations, including private and public, large and small companies, both at the level of top management and information security employees. CEOs will share how their companies perceive information security and describe the skills their CISOs need. Information security employees will share some life hacks of how to communicate the importance of information security to their management and describe what they expect from the players of the information security market. Regulators will answer any questions visitors may have, and an invited information security futurologist will make a cyberthreat forecast for the next decade. Other burning information security topics will not be forgotten: data leaks, information security visualization, practical training of infosec specialists within short timeframes, open source, and more. 

The tent will also host the Investor Day, where everyone will be able to learn about promising technology companies, get to know Positive Technologies better, and learn about the company's plans.

small_7_БизнесШатер1_600.jpg

thumbnail_7_БизнесШатер1_600.jpg

7_БизнесШатер1_600.jpg

Cybertower

**Offensive security is a branch of information security that, among other things, tests the security of systems based on real-life examples or in simulations and looks for vulnerabilities. **

Experts will share their research findings in offensive security and reveal methods they use to test the security of systems, including Open Source Intelligence (OSINT), Geospatial Intelligence (GEOINT), and new types of phishing attacks.

small_4_Зал-боевых-искусств-(offense)600.jpg

thumbnail_4_Зал-боевых-искусств-(offense)600.jpg

4_Зал-боевых-искусств-(offense)600.jpg

Martial arts

**Defensive security is a branch of information security that, among other things, investigates security incidents and protects systems with the help of special software and security rules.**

Hackers can find vulnerabilities in any system, even in macOS, which has long been considered unbreakable. Speakers will share their ideas and tools to protect against bad actors. In particular, experts will talk about unusual vulnerabilities, data collection points, and the existing protection methods, including the use of machine learning (ML).


small_5_Школа-самообороны-(defense)600.jpg

thumbnail_5_Школа-самообороны-(defense)600.jpg

5_Школа-самообороны-(defense)600.jpg

Self-defense training

**Fast Track: short presentations of up to 15 minutes**

In Technotent, speakers will share their expertise on a wide range of issues: VPN security, whaling, protection against web shells, the usefulness of the open VSCode-XP plugin, fake leaks, and more. Security Experts Community will also hold workshops and presentations in the tent.

small_1_Техношатер-(Воркшопы)600.jpg

thumbnail_1_Техношатер-(Воркшопы)600.jpg

1_Техношатер-(Воркшопы)600.jpg

Technotent

**AI, ML, and blockchain: topics that have been on the agenda for years.**

Speakers will talk about the use of AI and ML in information security and the security of blockchain. On the evening of May 20, the tent will host Fast Track with short presentations.

small_2_Будущее-уже-здесь600.jpg

thumbnail_2_Будущее-уже-здесь600.jpg

2_Будущее-уже-здесь600.jpg

The future is already here

**There is a shortage of more than 750 thousand information security specialists in the world, and the demand is only growing.**

A special student contest area will help beginners to prove themselves, get valuable prizes, and even find an employer.

small_ШатерКрепость600.jpg

thumbnail_ШатерКрепость600.jpg

ШатерКрепость600.jpg

Learn more about partners and sponsors of our festival.

small_партнеры2_600.jpg

thumbnail_партнеры2_600.jpg

партнеры2_600.jpg

Partner booths

large_scam.jpg

medium_scam.jpg

small_scam.jpg

thumbnail_scam.jpg

scam.jpg

large_mask.jpg

medium_mask.jpg

small_mask.jpg

thumbnail_mask.jpg

mask.jpg

large_Scene.jpg

medium_Scene.jpg

small_Scene.jpg

thumbnail_Scene.jpg

Scene.jpg

Is there such a thing as secure VPN?

Can an electric scooter steal your identity?

Password: N4G0R5HK3S!D1TK0R0L. What do hackers know about passwords?

Stay home: the security of marketplaces and home delivery

Happy digital world: to be handled with caution

What alphas will wear: the fashion of the future

Cybersecurity labor market. How do you explain what you do to your grandmother?

Real art in the digital age

Diving into WEB3.0: the next generation Internet to replace the real world

How to protect your money online

Digital technologies are building a green future

Identity attacks in social networks. Theft of accounts

My home is smarter than me: smart home ecosystem trends and risks

How do you secure a service with a multimillion audience?

We know what you did last summer: how to learn EVERYTHING about a person from open sources?

Vivaldi vs VivaldAI: music of the future

Cyberpunk through the eyes of infosec pros: breaking popular myths

Cyberslam

Music concert Mayakfest

The very same ChatGPT

Cyberfest opening

CyberQuestKids

large_crossroad.png

medium_crossroad.png

small_crossroad.png

thumbnail_crossroad.png

crossroad.png

large_Troyan.jpg

medium_Troyan.jpg

small_Troyan.jpg

thumbnail_Troyan.jpg

Troyan.jpg

large_constructor.jpg

medium_constructor.jpg

small_constructor.jpg

thumbnail_constructor.jpg

constructor.jpg

I see it as a reverse engineer

Opening speech by the organizers 

Code query language... is not needed?

How the developers of a source code analyzer struggled with an exponent

Supply chain security

DAF: the way of the samurai in secure development

SCA implementation

Business logic critical vulnerabilities 

Brave Docker security master's guide

How we implement ML at Positive Technologies

Development of information security expertise for ICSs in Positive Technologies

SIEM correlation rules and expert knowledge 

How to protect your open-source projects on GitHub from sanctions

A story about one vulnerability

How to apply Zero Trust approaches when building a secure development process

CTF for development teams: how to find and train security champions

Service architecture: reducing labor costs and improving the security level

Testing and verifying Linux kernel

large_python.jpg

medium_python.jpg

small_python.jpg

thumbnail_python.jpg

python.jpg

How to make architectural decisions when refactoring a legacy project backend

So, what's up with logs?

Types beyond Any

Trunk-Based Development in an enterprise

EQATOR: a comprehensive test automation solution

Linux perf: works for penguin, but what about Python?

Inner workings of CPython and JIT compilers

Static (and lexical) analyzers in modern development

Technical interview without parentheses balancing

Extracting metrics from news, or how we automated the work of information security analysts

MapReduce 2023: benchmarking and optimization

Improving fault tolerance of HTTP integrations without changing Python code

Pitfalls of working with asyncio

(Un)secure development: faking Python project rankings

Large language models: vocabulary descriptions as a way to encode words and idioms

Knowledge management with Python: tools, approaches, examples

From manual machine learning to automation with Python libraries

Challenge yourself to&nbsp;attack a&nbsp;web application protected by&nbsp;a&nbsp;security filter. The application contains a&nbsp;bunch of&nbsp;vulnerabilities, which, if&nbsp;exploited properly, will allow execution of&nbsp;OS commands, among other things. Now, we&nbsp;all know very well that hacking applications is&nbsp;a&nbsp;serious matter and should be&nbsp;approached with a&nbsp;sober and responsible mindset. So, to&nbsp;spice up&nbsp;the challenge, each 5&nbsp;minutes we&nbsp;will slightly (by&nbsp;50&nbsp;ml) complicate the work of&nbsp;those participants whose actions the WAF most often reacts&nbsp;to. The winner is&nbsp;the player who earns the most points during the competition. And there will be&nbsp;valuable prizes at&nbsp;stake!

Please note that all participants must be&nbsp;of&nbsp;legal age and must sign an&nbsp;agreement before the game to&nbsp;accept responsibility for the consequences of&nbsp;participating in&nbsp;the competition.

You will need a&nbsp;laptop (any software is&nbsp;allowed), and we&nbsp;will provide a&nbsp;wired connection to&nbsp;the contest segment.

2drunk2hack

Welcome to&nbsp;the $natch contest!

Your task is&nbsp;to&nbsp;hack a&nbsp;bank, an&nbsp;ATM, a&nbsp;mobile bank, and a&nbsp;cash register. 

Contest tasks

1. ATM. You will be&nbsp;given an&nbsp;image of&nbsp;an&nbsp;ATM, in&nbsp;which you must complete a&nbsp;variety of&nbsp;creative tasks (ranging from very easy to&nbsp;incredibly difficult) and earn flags. There will be&nbsp;traditional tasks, such as&nbsp;bypassing the kiosk, bypassing AppLocker, and obtaining maximum privileges, as&nbsp;well as&nbsp;completely new and original ones. 

2. Web banking, mobile banking, and cash register. Here the goal is&nbsp;to&nbsp;simply find as&nbsp;many vulnerabilities as&nbsp;possible. All the vulnerabilities that you will encounter have been previously discovered by&nbsp;researchers.

This year, the results will be&nbsp;displayed on&nbsp;an&nbsp;online scoreboard.

Our experts will be&nbsp;available at&nbsp;the stand to&nbsp;give you hints on&nbsp;which direction to&nbsp;move&nbsp;in, if&nbsp;you&rsquo;re not sure where to&nbsp;start.

We&nbsp;have a&nbsp;prize fund for each track of&nbsp;this contest. Find vulnerabilities, write and submit reports, win prizes, and most importantly&mdash;enjoy your hacking!

$natch

The **IDS Bypass** contest is&nbsp;held for the fourth time. This competition is&nbsp;for those who want to&nbsp;test the strength of&nbsp;network protection systems. Participants must hack six hosts and steal the flags. They are opposed by&nbsp;an&nbsp;intrusion detection system (IDS), which checks traffic and blocks attack attempts using network rules and complex modules. If&nbsp;you get caught, the Telegram bot will notify you and tell you the name of&nbsp;the triggered rule. 

Vulnerable services are selected so&nbsp;that competitors focus their efforts on&nbsp;bypassing the IDS, and the number of&nbsp;possible solutions is&nbsp;unlimited. You will need a&nbsp;computer with an&nbsp;Internet connection. You can access the contest network via VPN and get the configuration files from the Telegram bot. There will be&nbsp;a&nbsp;network switch and cables at&nbsp;the stand for a&nbsp;faster connection.

You can get acquainted with the analysis of&nbsp;the competition of&nbsp;the previous year on&nbsp;Habr: [https://habr.com/ru/company/pt/blog/669068/](https://habr.com/ru/company/pt/blog/669068/).

IDS Bypass

The future is&nbsp;already here. Not too long ago, money transfers had to&nbsp;be&nbsp;arranged through a&nbsp;bank. Today, you can send your funds directly and without intermediaries&mdash;just connect to&nbsp;the blockchain!
Smart contracts are the decentralized blockchain analogs of&nbsp;banks, insurance companies, and electronic voting systems.

You&rsquo;re going to&nbsp;face a&nbsp;series of&nbsp;challenges around hacking smart contracts on&nbsp;the Polygon Mumbai testnet: you must either withdraw all the funds from a&nbsp;smart contract or&nbsp;set its flag (the value of&nbsp;the contract&rsquo;s Boolean state variable) to&nbsp;true, depending on&nbsp;the given challenge.

To&nbsp;participate in&nbsp;the contest, you&rsquo;ll need a&nbsp;computer or&nbsp;laptop connected to&nbsp;the Internet with a&nbsp;crypto wallet installed (preferably Metamask) to&nbsp;sign smart contract transactions, as&nbsp;well as&nbsp;some MATIC test tokens to&nbsp;pay for the transactions.

MATIC for participation in the competition can be obtained through the official facet: [mumbaifaucet.com]( https://mumbaifaucet.com/)

The number of&nbsp;points awarded depends on&nbsp;the number of&nbsp;challenges you solve and how fast you solve them.
Link to [online platform](https://blockchain-ctf.ptsecurity.com/)

ETHical Hacking

We&nbsp;welcome all tech enthusiasts to&nbsp;the Wireless Fuzzy Frenzy Contest!

In&nbsp;today&rsquo;s world, we&rsquo;re constantly swimming in&nbsp;an&nbsp;invisible information stream. Hundreds of&nbsp;different devices create electromagnetic pulses, constantly transmitting and receiving data at&nbsp;incredible speeds. But what could this alien, otherworldly dimension hide?

This competition is&nbsp;for those who want to&nbsp;test their skills in&nbsp;the field of&nbsp;wireless networks. 
Grab your (Wi-Fi-enabled) laptop and get ready for an&nbsp;exciting adventure. You&rsquo;ll have to&nbsp;listen to&nbsp;the airwaves and scope out the location in&nbsp;search of&nbsp;secrets. 

To&nbsp;participate in&nbsp;the competition, you need to&nbsp;be&nbsp;present on-site, but that gives you a&nbsp;chance to&nbsp;work freely and privately. Don&rsquo;t miss this opportunity to&nbsp;put your skills to&nbsp;the test and best the other participants!

Join our [Telegram group](https://t.me/WiFuzzyFrenz)

Wireless Fuzzy Frenzy

Every day we&nbsp;leave informational traces about ourselves all over the place, whether it&rsquo;s just open data or&nbsp;leaks of&nbsp;private data. 
Can this information be&nbsp;used by&nbsp;cybercriminals to&nbsp;reveal our secrets?

You&rsquo;re invited to&nbsp;take part in&nbsp;a&nbsp;heist competition. Participants must form teams of&nbsp;three people with the goal of&nbsp;hacking a&nbsp;safe and stealing the owner&rsquo;s secrets. The key here is&nbsp;to&nbsp;be&nbsp;faster than the other competitors. After breaking into the office, you&rsquo;ll get only 300 seconds before being discovered. In&nbsp;that time, you must solve a&nbsp;series of&nbsp;logic puzzles while avoiding booby traps. Bear in&nbsp;mind that the safe is&nbsp;protected by&nbsp;three layers of&nbsp;security.

Some of&nbsp;the competition&rsquo;s tasks are provided online.
[competition entry point](https://databreakout.phdays.fun/)

AI Track: Data Breakout

large_Standoff.jpg

medium_Standoff.jpg

small_Standoff.jpg

thumbnail_Standoff.jpg

Standoff.jpg

Results of previous days of Standoff

PHDays 12 opening. Words of welcome

Tour of the global Innostage SOC

Tour of the festival

Paying hackers ethically, or how white hackers and bug bounty hunters increase business resilience

PHDays 12 schedule

Secure software development: new challenges in 2023

Ideal cyberexercises: what a proper cyberrange should be like

Are SOCs ready to protect corporate clouds?

Security of the automotive IoT mobile applications

Secure development in the cloud

Who lives in an ICS and how do we find them?

Serial defenders: why the major industry integrator regularly participates in cyberexercises