Sinking Your Hooks in Applications
summary
Claims automatic runtime hardening works without source changes and shows it with code: a Java agent with Javassist that rewrites bytecode to block script tags, .NET Profiling API IL patching that flips a branch to change behavior, servlet filters and HTTP modules that inject headers and CSRF tokens, and cross‑framework hooks to catch every SQL call. Demos run, performance cost stays low in production when hooks are minimal, and careful wrapping avoids breaking apps.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:42attackers know this too
- 2:43current strategies
- 5:35stop gap
- 6:38Middleware
- 8:45Use Cases
- 10:19Java
- 12:49Wrapping
- 15:00HTTP Modules
- 21:03Network Requests
- 22:03Finding Hooks
- 23:26Trampoline Use
- 24:08Kali and Method Replacement
- 25:24Efficiency
- 29:35Demo
- 34:49Profiling API
- 36:09Demonstration
- 42:24Wrapup
related talks
46mPopular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
44mSecuring the JVM
16mI don’t always do AppSec testing, but when I do, it’s in production
49mFixing the Unfixable: Solving Pervasive Vulnerabilities with RASP
39mThe Java Agent: Modifying Bytecode at Runtime to Protect Against Log4J
53mAndroid: He protec, but he also attac
43mDon't hack the JVM? ☠️💣💥
43mLive hacking: Breaking into your Java web app