Using language-theoretics and runtime visibility to align AppSec with DevOps
summary
Claims a workable RASP built on LANGSEC that parses inputs with antler-generated lexer/parsers, runs inside Java as a shim or agent, and exposes SQL trees, columns, returned-row counts and stack-frame locations for forensics. Demo builds a minimalist ksql, adds delete support live, and grows unit tests from 13 to 14 with zero failures in minutes. Implementation uses Java 1.8, JUnit and ASM techniques and shows grammar-based detection of SQL toies working at runtime.
AI-written summary · about
chapters (18)
- 0:00About
- 1:41Methodologies
- 3:32Signatures
- 4:00Example XSS Regex
- 4:48Fuzzed Input
- 6:30Database Regexes
- 7:30Tautologies
- 8:41What is LANGSEC?
- 9:39Practical Applications
- 10:44Computation 1. LEXER - Generate a series of takens
- 12:07Example Toolchain
- 13:10Code & Walkthrough
- 16:43Grammar Definition
- 25:17SQLi Tautology Detection
- 25:45Unit Testing
- 31:57Expansions
- 38:39Get Involved
- 46:23SQL Analysis @ Runtime
related talks
43mJumpstarting Your DevSecOps Pipeline with IAST and RASP
16mI don’t always do AppSec testing, but when I do, it’s in production
28mApplication Security: Inside Out
48mThe Hidden Security Hazards in Your Java Stack
57mVariant analysis
34mLow-level RASP: Protecting Applications Implemented in High-level Programming Languages
51mSecurity Observability 101: Thinking Inside the Box!
49mAn overview of available opensource tools to secure your Java code