Common Webapp Vulnerabilities and What to Do About Them
summary
OWASP Top 10 2017 uses telemetry from 114,000 applications and still finds injection as the top failure since 2003; common failures include SQL injection, credential stuffing, insecure deserialization and XML external entity attacks. Demonstrations use SQLMap extracting credit card table against a deliberately vulnerable app (MatildaDie), plus tools like Burp Suite, OWASP ZAP and Metasploit. Practical fixes focus on input validation, hardened parsers, rotating/monitoring sessions, inventorying third‑party components and improving logging to detect industrialized automated attacks.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:40Introductions
- 3:08Web Security Threats
- 13:10How was the 2017 List Produced?
- 19:18What Changed from 2013 to 2017?
- 22:22#1 Injection Attacks
- 26:53Broken Authentication
- 30:33Sensitive Data Exposure
- 32:08XML External Entities (XXE)
- 33:27Broken Access Control
- 41:22Security Misconfiguration
- 47:04#7 Cross Site Scripting
- 48:09#8 Insecure Deserialisation
- 53:00known Vulnerable Components
- 58:33Insufficient Logging and Monitoring
related talks
53mOWASP Top 10: What are them and how to prevent them
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
59mPractical Security for Web Applications
47mOWASP Top 10
23mWeb Application Security - owasp top 10 vulnerabilities
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities
55mBreaking and Fixing Web Application Security
26mStop Hitting Yourself: How to Prevent Common Attacks to your Application