Live hacking: Breaking into your Java web app

on YouTube ↗46m

" summary

Live demos exploit real flaws: a crafted content-type uses Apache Struts RCE and OGNL to run /bin/bash on Heroku, a zip upload triggers zip slip to overwrite JDK binaries, and a long input triggers ReDoS against a regex-based router. Scanning examples use curl and the http CLI; Docker Hub’s Node image shows 567 vulnerabilities. Presenter cites Equifax’s 143 million records, a typical 16-day patch turnaround and ~2.5 years average disclosure, and urges left-shifted CI/local scanning and dependency tooling to prevent these exact failures.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 2:37What are the Problems?
3. 7:39Spring Serverless Example
4. 39:50Tooling

" related talks

• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 50mStranger Danger: Your Java Attack Surface Just Got BiggerBrian Vermeer · Voxxed Days Cluj 2023
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021