Live hacking: Breaking into your web app

on YouTube ↗40m

" summary

Live demos exploit an outdated Apache Struts header using OGNL to invoke Java ProcessBuilder via curl and execute arbitrary shell commands on a Heroku instance revealing environment variables and the JDK path, show a zip slip vulnerability that overwrites /app/jdk/bin/native2ascii from an uploaded zip, and trigger a regular expression denial of service by sending long nonmatching strings. Evidence includes Equifax 143 million records, a Node Docker image with 567 known vulnerabilities, and dependency trees ballooning to ~200k lines of code requiring CI scans and automated PR fixes.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 2:57What are the Problems?
3. 11:15Serverless Example: Fetch file & store in s3
4. 12:00Spring Serverless Example
5. 32:07Team Culture
6. 33:06Process
7. 33:54Tooling

" related talks

• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 18mLive Exploiting Your Open Source DependenciesBrian Vermeer · CodeLand 2020
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019