Standard Classification: Back to Basics: Looking for subtle bugs in beginne...
summary
Shows concrete failures: an authentication bypass via fail-open logic where a constructor defaults a flag to false and five authentication methods let requests through, an XML billion laughs expansion that causes DoS, missing rate limits and unbounded loops that exhaust resources, and overcomplex regexes and Yoda-style conditionals that hide flaws. Recommends front‑loading validation and notes static analysis lacks the context to catch these mistakes, with real Azure management interface misconfigurations cited as working exploits.
AI-written summary · about
chapters (9)
- 0:00Intro
- 2:07Overview
- 2:32Clarity
- 3:06Inscrutable
- 3:21Expressions
- 5:30Lesson 1 Clarity
- 6:15Lesson 2 Inversion Selection
- 7:39Lesson 3 Selection
- 10:54Summary
related talks
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
41mVulnerabilities that Hide from your Tools
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
17mEmbedded Security's Weakest Link: Lessons From Simple Mistakes
01h 01mThe Code Behind The Vulnerability
47mThreat Modelling Stories From The Trenches
34mWeb security explored through horror movies
43m50 Shades of AppSec