Live hacking: Breaking into your Java web app
summary
Live demos exploit real Java apps: a crafted Content-Type abuses Apache Struts OGNL RCE to spawn ProcessBuilder on Heroku, a PATCH to a Spring Data REST endpoint uses Spring Expression Language RCE to run arbitrary commands, a prepared ZIP performs zip slip overwrite of native2ascii inside the JDK, and a Node static server shows URL‑encoded path traversal. Shows curl payloads, Heroku and local servers, quantifies dependency bloat (19 lines → ~200k, 222 → ~400k), notes median vulnerability discovery ~2.5 years, and integrates Snyk CLI + GitHub Action to scan and block high‑severity issues.
AI-written summary · about
chapters (8)
- 0:00Start
- 6:37What are the Problems?
- 21:10Spring Serverless Example
- 26:26Who is responsible for security?
- 54:10What's the Solution?
- 54:36Team Culture
- 55:47Process
- 56:24Tooling
related talks
43mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
46mLive hacking: Breaking into your Java web app
01h 02mLive Hacking: Breaking into your Web App
41mLive Hacking: Breaking into Your Web App
18mLive Exploiting Your Open Source Dependencies
52mDevSecOps
48mCommon vulnerabilities you wish your Java app didn't have!