Defense Against the Dark Arts
October 29 @ 5:30 pm - 8:00 pm
Featured Panel Demos
(Growing list)
- AI/MCP Defenses – Your AI Has Root: Pentesting Agentic AI and MCP, By B.Bagby @VWCC
This demo will show how an attacker can poison, inject and exploit AI chatbot Model Context Protocol (MCP) tools, and show how untrusted tool descriptions or outputs can influence agent behavior across trust boundaries. Then, I will apply defenses and rerun the same attacks to show the difference between asking an AI to behave safely and technically preventing it from doing something unsafe.
- Web App/APIs – “Finding IDORs Before Attackers Do”, By Brandon Lester, @CDW
Insecure Direct Object References (IDOR) are a common vulnerability in web applications/API’s ranging from benign impact to critical exposures of sensitive information. This talk will examine how the vulnerability is introduced, how attackers find+exploit IDORs, and how you can find/prevent them before attackers do.
- Whitebox CVE Pentesting – “Kali w/Vulnerable Targets”, By T.Weeks @VACyberRange
This workshop will walk you through getting logged into Cyber Range in our dedicated “vulnerabilities lab” network filled with documented CVE vulnerable targets that we will step you though to pop-root on. Just bring your laptop and from there we’ll step you through the basics of Linux-based nmap recon scans, and jump right into intermediate level network penetration testing against several classic CVEs (vulnerabilities).
Speakers
Professor B. Bagby
Professor B.Bagby is an Associate Professor of Information Technology and Computer Science with a background in instructional design, information systems, and cybersecurity education. His work focuses on making complex technical topics practical and understandable, with particular interests in cybersecurity, artificial intelligence, and hands-on computing. He teaches at the community college level and has a particular fondness for turning intimidating subjects into things that feel a little less like dark magic.
Public email: bbagby@virginiawestern.edu
Brandon Lester
Brandon has over 5 years of experience in offensive security. He works as a full time penetration testing/red team consultant at CDW co-leading the Application Security (AppSec) Team. Beyond AppSec, Brandon has experience in a number of different areas, including IoT, internal/AD networks, and more.
Public email: haicenhack@proton.me
Thomas “Tweeks” Weeks
Thomas “Tweeks” Weeks is a published Linux author, and has 30 years of IT/Engineering experience. Tweeks is an IT director with Virginia Tech IT, but most of his time is spent working as a Lead Engineer with the Virginia Cyber Range, helping develop security courseware, design lab-VM images, and write CTF challenges for the Range. Tweeks also sits as the technical lead for the Roanoke Blacksburg regional technology council’s IT-Security Forum and leads homeschool cybersecurity teams in Virginia.
Public email: tweeks@VirginiaCyberRange.org
Check Last Year’s DADA Event
2025 DADA Overview – https://go.vacr.io/2025-dark-arts-overview
2025 DADA Photos – https://go.vacr.io//2025-dark-arts-photos
Interested in Presenting at DADA 2026?
If you think you might like to present at the 2026 DADA, submit to our CFP here:
https://go.vacr.io/2026-dark-arts-cfp
And we’ll reach out to you!
The IT Security Forum is dedicated to professionals engaged in IT and cybersecurity related fields of work, the IT Security Forum is focused on exploring best practices and sharing insights in the always-evolving landscape of organizational IT.