Peru's offensive security conference. Always free, independent, 100% technical and built for the community.
A community that has been breaking things since 2013.// PERÚHACK 2025 · UPC Monterrico · group photo
We bring together professionals, researchers and students to show real adversary techniques, vulnerabilities and strategies, with the free and ethical spirit of hacker culture we inherited from LimaHack.
Exploits, attack techniques and live demos from the adversary's perspective. No sales pitches from the stage.
Guided offensive labs running in parallel: bring your laptop and leave knowing how to exploit something new.
Web, mobile, reversing, crypto and AI challenges. Prizes at closing.
Networking, guest communities and a space for new voices. Past editions also had lightning talks.
What has held PERÚHACK up since 2013, and is not up for negotiation.
We put deep, up-to-date technical knowledge ahead of any personal or institutional interest. Every talk and workshop exposes real vulnerabilities, advanced offensive techniques and relevant tools, with no filters and no sales talk. Content is the center. There's no stage for ego, only for learning.
The conference and workshops exist thanks to people who give their time and expertise without seeking the spotlight or payment. The organization runs on collaboration, humility and a passion for the craft: the true values of hacker culture.
A direct, free and open contribution to the security ecosystem. We aim to raise technical standards, share knowledge freely and drive creativity and critical thinking in new generations of specialists across the region.
Share, train and inspire
Preliminary agenda: seven talks, one single stage, from 08:15 to 18:15 (Lima time, UTC−5), in one-hour blocks: 50 minutes of talk and 10 of Q&A. No keynotes, no hierarchy: every talk gets the same time and the same weight. All of them are offensive security: attack, exploitation and post-exploitation from the adversary's side. Talks are published as CFP speakers are confirmed.
After lunch comes the Crossover: a representative of a community from another technical world takes the stage and presents it in 5 minutes: who they are, what they do and how to join. The community is picked at random. The idea is simple: let the ecosystem get to know itself.
// confirmed:
Nominate my community →Each profile will include a photo, short bio, talk title and abstract. To see the talk, you have to be there.
—
—
—
We only accept offensive security talks: original research, with verifiable evidence and no commercial purpose. Technical merit is the main selection criterion: you don't need to represent a well-known company or have a public track record. 2026 format: 50-min talks + 10 of Q&A.
// heads-up: the submission form is in Spanish.
root@peruhack:~$ cat ctf/2026.txt # format jeopardy · teams of up to 4 # duration 09:30 → 17:00 # categories web · mobile · reversing · crypto forensics · ai/llm · osint # prizes top 3 + best writeup root@peruhack:~$ nc ctf.peruhack.org 1337 [*] registration opens with the agenda_
The CTF runs alongside the talks, for beginners and veterans alike. We'll publish the challenges and writeups in the community repository after the event.
Objects that only exist because someone was there. They are PERÚHACK's memory.
Our icon is born from the tumi, the ceremonial knife of ancient Peru: Peruvian identity from day one.
In 2022 we reimagined it: the Tumi Hack was born, the same one you saw turned into a statuette in 2025. The icon is just its face under the helmet: the essentials, no ornaments.
// any resemblance to anything else is purely coincidental.
tumi2012–2021
tumi hack2022 → today
iconthe face
PERÚHACK 2026
>> Hola mundo. Every signature is a way of saying I was here, in the language we understand best.
Starts blank.Stickers, badges and keepsakes the community collects year after year. Talks are never recorded: what happens at PERÚHACK is lived at PERÚHACK.
In 2013, talking about offensive security in an auditorium in Lima was almost unheard of. We started anyway: free, no sales pitch, and with the spirit LimaHack had sparked in 2011.
Today the Peruvian scene has plenty of conferences, communities and CTFs. In many of them there's someone who first stepped on a stage, won their first CTF or gave their first talk here.
We don't aim to be the only ones.
It's enough to have inspired the ones who came after.
// six logos. one idea.
Thirteen editions, two of them online, and one single rule: share, train and inspire.
online edition · [ONLINE]
online edition · [ONLINE]
logo of the era
No Gold, Silver or Bronze tiers: each partner donates something concrete and is recognized for exactly that, edition by edition.
Infrastructure and services for the event.
Vouchers and stickers for the community, handed out in open activities.
Water for our community.
Food during the day.
Snacks for attendees and crew.
// rule: recognition = what you make possible, not the size of your brand. Rather stay out of sight? See shadow sponsors.
Their logos would go here. They chose not to appear.
PERÚHACK runs on collaboration: everything that makes it possible is donated. Some contribute as supporting partners, recognized for their role. Others, the shadow sponsors, choose anonymity. And a whole community donates its share:
No logo on the banner, no booth, no minute on stage and no attendee mailing list. In return, a stronger community: more than 1337 hackers trained since 2013 and an impact that goes far beyond the auditorium, with knowledge shared face to face and new communities inspired every edition. And since nobody knows who donates, nobody can influence a talk: content is decided by the technical committee alone.
Can you donate a bigger venue? The auditorium fills up every edition: the limit is capacity, not interest. That would be the most impactful donation of all.
Like any good finding:
the impact matters, not the signature.
root@peruhack:~$ cat shadow_sponsor.policy # what a shadow sponsor donates donations = [space, materials, time] # what they get in return logo_on_site = 0 agenda_minutes = 0 attendee_data = 0 identity_published = false # what the community gets hackers_trained = 1337+ # since 2013 · leet auditorium = full impacto = 0xFFFFFFFF root@peruhack:~$ whois sponsors [redacted]
// how many there are is classified too.
Offensive security, exclusively. Every talk shows security from the attacker's perspective: vulnerability research and exploitation, reversing and malware, low-level, web, cloud and infrastructure, hardware and firmware, AI and new attack surfaces, with evidence and demos where it makes sense. No product talks, no sales, no purely defensive talks: that has been PERÚHACK's identity since 2013.
On Saturday, November 21, 2026 at UPC Monterrico, Lima. Check-in starts at 08:15 (Lima time, UTC−5). The auditorium fills up every year: register as soon as registration opens, and follow @peruhackcon to hear about it first.
Talks, stickers, badges and knowledge. All free. Always. It has been that way since 2013. One thing, though: venue capacity is limited and every edition fills up, so registration is required and it's best to do it as soon as it opens.
No. Some talks are advanced, but all of them are explained from the attacker's side, with demos, and each one leaves 10 minutes for your questions. No question is too basic. (Past editions had workshops, lightning talks and a CTF; in 2026 the format is talks only, 50 + 10.)
No. Talks are neither recorded nor streamed. Only two editions were streamed, Kernel Panic! (2020) and Recovery Mode (2021), because the pandemic left no other option. Nothing beats meeting in person: what happens at PERÚHACK is lived in the auditorium.
Because knowledge takes center stage. Nobody buys minutes on stage or space on the agenda: talks are chosen by the technical committee alone. Those who contribute do so by role (supporting partners) or anonymously (shadow sponsors), and none of them gets a say in what is presented. If a partner donates vouchers or materials, they are handed out in open activities, never in exchange for your data. That independence is the reason PERÚHACK exists.
Yes. PERÚHACK teaches you to understand security from the attacker's point of view so you can defend better. Every talk comes with a disclaimer under Peruvian law, in particular Peru's Computer Crimes Law (Ley N.° 30096): what is shown is for educational and research purposes and must not be used against systems without authorization. Demos run in the speaker's own environments, in labs or with permission, and real findings are presented after responsible disclosure. No brands are attacked and no crime is glorified. Hacker is not a synonym for cybercriminal: here we celebrate curiosity, not damage.
It means “hackers training hackers”: knowledge is passed from hand to hand. Whoever is in the audience today can be on stage tomorrow, and many of our speakers started out as attendees. It's hacker culture in its original sense: curiosity, ethics and the urge to share what you learn.
First, it has to be offensive security. Then: technical rigor, originality, evidence, relevance, clarity and independence (no commercial goals). Commercial or promotional talks, management or compliance talks, and theory without technical depth are not accepted. The full guidelines are in the CFP.
A 5-minute slot right after lunch, where a representative of a community from another technical world (Rust or Android, for example) takes the stage to present it. The community is picked at random. The goal: let the ecosystem get to know itself. If your community wants to take part, write to us at info@peruhack.org.
PERÚHACK runs on donations only: space, materials and time. Supporting partners contribute by role (hydration, food, snacks and infrastructure) and are recognized for what they make possible. Shadow sponsors donate anonymously, with no logo and no agenda slot, and speakers, staff and committee donate their time as volunteers. That anonymity protects the event's technical independence. If you want to join, write to us; your identity won't be published.
Yes: the Participation Code. It requires respect toward everyone; harassment, threats, discrimination and any behavior that endangers people or the event's infrastructure are not tolerated. For speakers it also sets out commercial independence and responsible disclosure. You can report any incident to the staff or by email.
No. The offensive stuff stays on stage, within authorized scope and without touching anyone else's systems. Hacking ethically is part of the culture we stand for.
Every hacker knows rubber duck debugging: explain the problem to a rubber duck until the bug reveals itself.
Ours wears sunglasses and floats calmly among sharks. Because in offensive security the sea is always rough, and calm is part of the method.
Keep calm and hack with the duck.
// rumor has it the duck is hiding something on this page.