Skip to main content
Hakan Eren San

Hakan Eren San

Sr. Offsec Engineer
Turkcell
Hakan Eren Şan is a Red Team Operator and cybersecurity professional with more than 15 years of experience across IT infrastructure and cybersecurity, including nearly 8 years of professional security experience. With a background spanning security consulting, penetration testing, and nearly four years of dedicated Red Team operations, he focuses primarily on infrastructure security, internal networks, Active Directory, and web application security. His approach is rooted in understanding how real-world attacks unfold rather than relying solely on automated scanners or checklist-driven assessments. He has extensive experience identifying and chaining attack paths in complex enterprise environments.

Speaker sessions

Briefings and Arsenals | Confirmed Speakers | No Session Assigned

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
  • 07:30
  • Tue
  • 01 Dec
Stage: Briefing Stage 2
Sessions Type: Keynote

MC2P: Turning Approved MCP Processes into Command-and-Control Sessions

Modern AI hosts treat an approved MCP server as a tool provider, but approval also starts an executable with process lifetime and network authority. MC2P—Model Command and Control Protocol—investigates whether that approved process can become a beacon-like command-and-control session without relying on malicious prompts, poisoned tool descriptions, or a new wire protocol.

The session introduces a dual-role MCP process: a local stdio server for Claude Code, Visual Studio Code, or another host, and an outbound Streamable HTTP client to a private laboratory controller. A live Windows demonstration shows visible installation, automatic enrollment, heartbeat-based presence, controller-assigned tasking, typed results, parent-bound shutdown, and linked reconnect when the host starts the process again.

The public research build deliberately excludes arbitrary shell execution, credential collection, persistence, stealth, unrestricted file transfer, and public callbacks. Five fixed laboratory operations and tamper-evident evidence make every claim reproducible. Attendees will see both the offensive security implication of MCP executable trust and the concrete host, process, network, and lifecycle signals defenders can monitor.
  • 13:00
  • Thu
  • 03 Dec
Stage: Arsenal 1
Sessions Type: Demo