5 AppSec Stories, And What We Can Learn From Them
summary
Five concrete failures and fixes: a Spring databin ding RCE that used a module.classloader bypass to drop a shell.jsp via Apache Tomcat logging; a Jakarta multipart parsing error that leaked executable OGNL-like content (linked to late Equifax-style exposure); a Next.js JSON-LD path letting Google Maps comments create reflected/stored XSS in search snippets; an open-redirect phishing URL found via LaPost QR; and auto-generated CRUD endpoints in frameworks missing access control.
AI-written summary · about
chapters (11)
- 0:00AppSec stories matter
- 2:15Security storytelling journey
- 4:25Flaws as security lessons
- 7:40Deserialization exploit explained
- 14:12Stories to resolve debates
- 19:20Code review vulnerabilities
- 22:17Optimism bias in dependencies
- 25:21Newsletters for security lessons
- 29:16Personal stories resonate
- 34:03Stories improve AppSec
- 36:36Q&A
related talks
28mLearning from High Profile Failures
46mLive hacking: Breaking into your Java web app
50mStranger Danger: Your Java Attack Surface Just Got Bigger
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
52mDevSecOps
19mCritical Security Mistakes in Frontend Applications
41mLive Hacking: Breaking into Your Web App
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application