new framewords old problems

on YouTube ↗44m

" summary

Newer frameworks like Play and Node based Geddy reproduce long‑known flaws rather than fix them: demoed exploitation uses Burp and sqlite to show client-side sessions holding cleartext values and a working session fixation exploit that keeps attacker access, Showdan finds about 4,600 Play apps, Geddy ships secrets in application files, mass assignment and open redirects are present, and CSRF requires manual wiring instead of being on by default. Proposed fix is an open source framework security cheat sheet to bake safer defaults in.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 13:37Insecure Default
3. 14:20Client Side Session Clear text - signed not encrypted
4. 22:19Open Redirect An issue in most frameworks

" related talks

• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 59mDon't Get Burned! Secure Coding Essentials to Protect Your ApplicationBrian Vermeer · IntelliJ IDEA Conf 2024
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 50mModern WebApp VulnerabilitiesErlend Oftedal · Øredev 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 59mWeb Application Security TrendsChristian Wentz · NDC Oslo 2018