I abuse your production live with 15 security flaws
summary
Demonstrates 15 real security vulnerabilities by actively finding and exploiting them in a live, existing web application to show how developer code often introduces risks. Covers developers’ responsibilities for application security and outlines concrete best practices to adopt so developers can identify and fix such flaws.
AI-written summary · about
chapters (24)
- 0:00Security intro for devs
- 1:07Ajax security discovery
- 3:17App flaws and CWE
- 5:42Sensitive info leaked
- 7:28SQL injection 2024
- 9:13Prepared SQL queries
- 10:41Source code changes
- 11:26CSRF and bad requests
- 13:53User data access
- 15:38Client-side validation fails
- 17:10Cookies and secrets
- 20:18Mass assignment flaws
- 22:09XSS and script runs
- 24:00Password reset issues
- 25:51Production exception handling
- 26:57Weak random generators
- 29:08Vulnerable dependencies
- 29:28Weak JWT tokens
- 31:14Execution workflow
- 33:28Exposed admin pages
- 36:47SSRF and URL recall
- 38:37Critical event logging
- 39:19Devs' security role
- 40:44Inclusive security
related talks
44mI hack your production live with 15 security flaws
40mI Break Your Prod Live with 15 Security Flaws
55mBreaking and Fixing Web Application Security
38mFinding Security Issues in Open Source
45mOverview of Interesting Vulnerabilities in Web Applications - Live Demos
52mHow to Get Properly Hacked
46mLive hacking: Breaking into your Java web app
41mLive Hacking: Breaking into Your Web App