OWASP for Developers
summary
Overview of OWASP projects and practical fixes for common web vulnerabilities: describes OWASP resources (Testing Guide, Proactive Controls, ASVS) and tools ZAP and sqlmap for finding issues (sqlmap can dump a database quickly). Covers demonstrations of XSS and SQL injection, argues that large software will have vulnerabilities and testing must be paired with fixes, and recommends prepared statements, strict input whitelists, output encoding (ESAPI/HTML sanitizer) and mandatory rechecks after fixes.
AI-written summary · about
chapters (14)
- 0:00OWASP introduction
- 3:15Secure software: myth or fact?
- 6:47Software security principles
- 8:07What is OWASP and projects
- 13:47Structured vs unstructured
- 20:37SQL injection example
- 23:02Preventing SQL injection
- 25:53Cross-site scripting (XSS)
- 27:40Preventing XSS
- 31:11DOM-based XSS
- 34:43Input validation sanitization
- 37:56Structured OWASP approach
- 40:21OWASP tools and resources
- 42:33Conclusion next events
related talks
23mWeb Application Security - owasp top 10 vulnerabilities
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
46mThe Path of Secure Software
14mDeveloper Guide
58m: The OWASP Top Ten Proactive Controls 2018
38mFree security resources that your competitors use!
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time