Live Exploiting Your Open Source Dependencies

on YouTube ↗18m

" summary

Shows a runnable sample app (Goof) on Heroku and demonstrates an Apache Struts OGNL RCE that runs arbitrary bash, plus a zip‑slip overwrite that replaces the JDK native2ascii binary. Quantifies supply‑chain risk with a 19‑line serverless JS function pulling 19 deps that become ~200,000 LOC and cites Equifax’s ~143 million records breach. Uses real headers and URL‑encoding tricks to exploit st path‑traversal, recommends shifting left with Snyk‑style dependency scanning integrated into editor, CI and daily monitoring.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 0:16Devsecops
3. 6:28Equifax
4. 6:41Apache Struts Library
5. 11:26Path Reversal
6. 12:13Url Encoding
7. 13:55Zip Files
8. 16:20Tooling

" related talks

• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019