Live Hacking: Breaking into Your Web App • Brian Vermeer • GOTO 2022
This presentation was recorded at GOTO Amsterdam 2022. #GOTOcon #GOTOams
Brian Vermeer - Java Champion & Senior Developer Advocate at Snyk
ABSTRACT
Join us for a captivating live hacking session with Brian Vermeer.
In Brian’s opinion, open source modules are undoubtedly impressive. However, they also represent an undeniable and massive risk.
Within open source modules you are introducing someone else’s code into your system, often with little or no scrutiny. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user’s data.
This talk will use a sample application, Goof, which uses various vulnerable dependencies, which together with Brian, you’ll exploit as an attacker would. For each issue, Brian will explain why it happened, show its impact, and – most importantly – see how to avoid or fix it. Brian will live hack exploits like the classic struts vulnerability that recently made it famous, along with Spring Break and several others.
In this talk, you’ll learn:
• That security is important. Not only for your own code but also the frameworks and libraries you depend on
• What might happen when using outdated libraries with known vulnerabilities [...]
TIMECODES
00:00 Intro
00:25 DevSecOps
03:13 What are the problems?
05:22 How bad is the situation?
07:41 Demo
11:05 Your app’s code
13:02 Serverless example
14:36 Spring serverless example
15:54 Open source usage has exploded
19:56 Live hacking/Demo
31:21 Docker
35:57 What’s the solution?
38:35 DveSecOps in your SDLC
40:25 Recources
40:47 Outro
Download slides and read the full abstract here:
RECOMMENDED BOOKS
Jim Manico & August Detlefsen • Iron-Clad Java •
Liz Rice • Container Security •
Liz Rice • Kubernetes Security •
Aaron Parecki • OAuth 2.0 Simplified •
Aaron Parecki • OAuth 2.0 Servers •
Aaron Parecki • The Little Book of OAuth 2.0 RFCs •
Erdal Ozkaya • Cybersecurity: The Beginner’s Guide •
Richer & Sanso • OAuth 2 in Action •
Wilson & Hingnikar • Demystifying OAuth 2.0, OpenID Connect, and SAML 2.0 •
#Security #DevSecOps #Risk #OpenSource #OpenSourceModules #Vulnerable #Dependencies #VulnerableDependencies #Privacy #Programming #SoftwareEngineering #SoftwareDevelopment #Serverless #Java #Spring #Log4j #Docker
Looking for a unique learning experience?
Attend the next GOTO conference near you! Get your ticket at
Sign up for updates and specials at
SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
1 view
0
0
10 months ago 00:00:33 1
Лайфхак как завязать бант.
10 months ago 00:06:10 1
5 Секретов Общения с ChatGPT (PRO-лайфхаки 🚀)
10 months ago 00:21:52 1
Бизнес с Китаем 2023. 1688 подробный гайд и лайфхаки!
10 months ago 00:20:12 1
REDACTED 01: Featuring @hacker_
10 months ago 01:00:31 1
ЛАЙФХАКИ ДЛЯ КУХНИ И КУЛИНАРНЫЕ СОВЕТЫ, КОТОРЫЕ ВЫ ХОТЕЛИ БЫ ЗНАТЬ РАНЬШЕ
10 months ago 00:09:56 1
Musicheads Лайфхак: разбор базового темплейта
10 months ago 00:04:35 1
Лайфхак чтоб нива меньше грелась
10 months ago 00:06:03 1
❤️ ТИПИЧНЫЙ ТИМСПИК DYSI НА ТУРНИРЕ! ОТПРОВЛЯЕМ СОПЕРНИКОВ ДОМОЙ!
10 months ago 00:37:07 1
Носки в технике Свинг. Авторский способ и лайфхаки. Зеркальное отражение.
10 months ago 00:18:09 1
9 ОШИБОК на ОВЕРЛОКЕ 🎯, которые его ломают. ✅ ЛАЙФХАКИ, ✅ НАСТРОЙКИ, ✅ ОБЗОР оверлока Necchi L234D
10 months ago 01:51:11 1
Парень и девушка смеются деньги успех заработок лайфхаки
10 months ago 00:01:15 1
Cheating Against Pro players (Rez ,L3kr0) | AIMWARE Ruined my Media
10 months ago 00:27:42 1
ЛАЙФХАКИ ЯПОНСКОГО ДОМА: разбор умных покупок MUJI✨ (+ осенние рецепты🌰)
10 months ago 00:02:07 1
Лайфхак для хозяек! Ваши шторы теперь будут сиять: вот, как убрать плесень - уникальный способ, вау!
10 months ago 00:24:16 1
ВЫВОРОТНОСТЬ. Как развить выворотность. Лайфхаки от балерины Михайловского театра Натальи Тарасовой
10 months ago 00:08:43 1
Лайфхаки для учителей
10 months ago 00:04:29 1
Лайфхак как сохранить осенние листья
10 months ago 00:14:27 1
ШВЕЙНЫЕ ЛАЙФХАКИ ✅ Подборка 2021 лучших советов для шитья от Папа Швей
10 months ago 00:11:41 1
БОЯЛИСЬ ЛИ ВИРУСОВ НА РУСИ ? КАК НЕ БОЛЕТЬ ДО КОНЦА ЖИЗНИ - ЛАЙФХАКИ ОТ ПРЕДКОВ
10 months ago 00:16:24 1
С чего начать поднимать гири? Лайфхак от Ивана Денисова.
10 months ago 00:01:17 1
Cs2 Сheating / Streamsnipe of famous streamers (Recrent) :/ for Cs2
10 months ago 00:03:05 1
Лайфхак | Как убедить соседа выключить музыку | Анимация