Taking on the King: Killing Injection Vulnerabilities

on YouTube ↗54m

" summary

Injection stays number one because web apps treat untrusted values as strings and hand them to interpreters; SQL injection is about 20 years old yet still causes high-impact bugs (book report: 63% of P1s are SQLi, average bounty ≈ $2,000). Concrete fixes: remove raw execute this query APIs, stop string APIs for libraries, introduce a query-parameter type that throws on concatenation, and ship context-aware escaping in every template engine; examples include Brakeman, secure-handlebars, Go/C templating and libnacl-style secure defaults.

AI-written summary · about

" chapters (40)

1. 0:00Introduction
2. 0:50Vacation pictures
3. 1:16About me
4. 1:46Survey Monkey
5. 2:16Sequel Injection
6. 2:57Top 10
7. 3:47Top 10 2017
8. 4:56Prevalence vs Impact
9. 5:53CrowdStrike 2017 Report
10. 6:50Injection Vulnerabilities
11. 8:58Injection Example
12. 11:01Command Injection Example
13. 11:59Crosssite Scripting
14. 13:20Thesis
15. 15:11Compiler Construction
16. 17:20String Manipulation
17. 18:15ORM
18. 19:56Suggestions
19. 20:08Stop providing unsafe interfaces
20. 20:45Examples of unsafe interfaces
21. 22:12Using untrusted libraries
22. 23:23Rails example
23. 23:57Not just developers
24. 24:21Query Parameters
25. 25:39Why the Lucky Stiff
26. 27:02Accepting Code
27. 27:29Restrictions
28. 29:35Building Strings
29. 30:25C Templates
30. 32:00Parsers
31. 33:33Shell contextaware auto escaping
32. 34:18Frameworks
33. 38:56Lang SEC
34. 44:19Security Professional
35. 45:19Parameter Statements
36. 46:49OverTrusting Input
37. 47:39Example
38. 49:19Static Analysis
39. 50:49Libraries
40. 52:09Building new frameworks

" related talks

• 41mSecurity Vulnerabilities Decomposition: Another Way To Look At VulnerabilitiesKaty Anton · OWASP Global AppSec Amsterdam 2019
• 38mInjections - 4 Ways of PenetrationEvgeniy Tolchinskiy · QA Fest 2019
• 44mEnding Injection VulnerabilitiesCraig Francis · PHP UK Conference 2025
• 48mEnding Injection VulnerabilitiesCraig Francis · Global AppSec US 2021 Virtual
• 01h 30mCommon Webapp Vulnerabilities and What to Do About ThemEoin Woods · ACCU 2018
• 33mWill It Inject? A Look at SQL injections and ActiveRecordJessica Rudder · RailsConf 2016
• 41mSQL Injection Isn't Dead: Smuggling Queries at the Protocol LevelPaul Gerste · RuhrSec 2025
• 53mOWASP Top 10: What are them and how to prevent themAyesh Karunaratne · DrupalCon Amsterdam 2019