Detect and Track the Zergs in Your Dependencies!
summary
Scans project dependencies using two tools (punks ciçek and peines y traque), integrates results with Jenkins and Maven, and queries the National Vulnerability Database (CVE) to generate dashboards and audit reports. Demonstrates finding a real Jackson dataformat-xml XXE vulnerability (CVSS 9.8), identifies the fixed Jackson release (7.4), and shows a Jenkins pipeline that uploads reports, upgrades the library, and verifies the exploit is no longer effective.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:03OWASP security tools
- 2:27Dependency-Track demo
- 6:21XML external attack demo
- 8:07Fixing vulnerabilities
- 10:41Dependency-Track technique
- 11:43Dependency-Track setup
- 12:47Jenkins CI/CD integration
- 13:49Conclusion
related talks
20mDetect and track the aliens hiding in your dependencies
27mFind and Track the hidden vulnerabilities inside your dependencies
17mDetect and Track the Vulnerabilities Hiding in Your Dependencies
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
54mSupply Chain Sec /w Dependency Track
43mSteel for Vulnerabilities, Silver for Zombies: Hunting Java's Unseen Monsters
42mIt's a trap; we are vulnerable
33mFrogs and Ducks, Your Sentinels for Open Source Security