OpenSec and Why WebAppSec Matters
summary
Gives a practical OWASP-centered playbook: treat security as people+process+technology, aim for ~95% hardening by code review, config checks and testing, and avoid relying solely on closed automated scanners. Demonstrates manual tools like an intercepting proxy (Burp-style), Nmap, dirb/dns discovery, and practice targets DVWA and bWAPP; points to exploit-db and Rapid7 for active vuln checks and cites a reported $40,000 RCE bounty on HackerOne. Also recommends the Mozilla Observatory and OWASP resources for developer-facing scans and fixes.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 1:11Importance of web security
- 2:47Understanding security mindset
- 5:27Best practices for security
- 7:09Common vulnerabilities
- 8:18Tools for security testing
- 12:43Finding exploit information
- 15:24Careers in security research
- 18:02Mozilla Observatory tool
- 20:24Conclusion and Q&A
related talks
08mRunning an Appsec Program with Open Source Projects"
27mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
28mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time
01h 03mTen Key Steps for Enhanced Web App Security
53mPractical tips for web application security in the age of agile and DevOps
15mInterview with
37mDeploying Security Testing Practice in Your Team and Company