CYBERSECURITY!, The good, the bad, and the hacked
summary
Focuses on real file‑upload failures and fixes: no validation uploads let attackers drop shells; MIME type spoofing via Burp and getimagesize‑embedded PHP bypass checks; blacklisting extensions and colocating .htaccess with uploads both fail; client‑side only checks are trivially intercepted. Concrete mitigations: enforce server‑side validation, store uploads outside web root or on Cloudinary, give uploaded files random names with safe extensions, require HTTPS for API traffic, and assume decompilation and interception are possible when designing defenses.
AI-written summary · about
chapters (18)
- 0:00Introduction to cybersecurity
- 1:37What is cybersecurity
- 2:41File upload vulnerabilities overview
- 4:30Simple file upload without validation
- 5:54MIME type validation flaws
- 12:24Image size validation bypass
- 14:09Blacklisting extension types issues
- 15:11HTAccess script execution bypass
- 15:32Client-side validation limitations
- 16:35Mitigating file upload risks
- 19:29Q&A session begins
- 20:15Motivation for cybersecurity
- 21:17Protecting mobile apps from attacks
- 22:43Biggest Android vulnerabilities
- 24:08File extension copy trade-offs
- 25:31Securing game servers
- 27:18Android API security recommendations
- 28:22Preventing APK decompilation
related talks
58mHackers vs Developers: Mobile Applications
35mCYBERSECURITY! The good, the bad, and the hacked
50mAttack Your Apps Before the Bad Guys Do
45mTop 10 That Actually Matter: Web, API, Mobile and LLM
01h 03mTen Key Steps for Enhanced Web App Security
51m10 things developers need to know about web application security
23mWeb Application Security - owasp top 10 vulnerabilities
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time