An overview of available opensource tools to secure your Java code
summary
Quick survey of practical open‑source Java security tools with live demos: shows Gitleaks and truffleHog finding committed AWS keys, runs OWASP Dependency‑Check (demo stalls updating but usually flags vulnerable Jackson databind), uses SpotBugs to surface a Java deserialization gadget, and demonstrates an OpenRASP agent instrumenting Tomcat to block path‑traversal and remote command exploits (requests get redirected/blocked). Also mentions PMD, Error‑Prone, Burp/ZAP for DAST, and that RASP is powerful but harder to set up and less mature in open source.
AI-written summary · about
chapters (7)
- 0:00Introduction and motivation
- 8:29Sensitive information scanners
- 15:50Software composition analysis
- 25:02Static code analysis tools
- 38:00Dynamic application testing
- 40:12Runtime application protection
- 47:01Q&A and closing
related talks
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
48mThe Hidden Security Hazards in Your Java Stack
49mOpen-source vulnerability management? Use the source, Luke!
01h 06mLive hacking: Breaking into your Java web app
56mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
02h 38mJava application security the hard way - a workshop for the serious developer
43mLive hacking: Breaking into your Java web app