Live hacking: Breaking into your Java web app

on YouTube ↗43m

" summary

Live demos exploit Apache Struts RCE to run arbitrary OS commands on a Heroku instance (curl shows environment vars, /etc/passwd), a zip slip overwrite native2ascii attack that replaces the JDK binary to tamper uploaded titles, and a Spring Data REST expression injection that executes commands via PATCH. Examples run successfully against real libraries, cite Equifax’s 145+ million records, show typical apps pulling 400k+ lines of transitive code, note median 2.5 years to discover bugs, and finish with Snyk tooling (CLI and IntelliJ plugin) to detect and fix dependencies.

AI-written summary · about

" chapters (11)

1. 0:00DevSecOps and security mindset
2. 3:00Siloed security in DevOps
3. 5:23Security failures like Equifax
4. 10:17Third-party dependencies risks in Java
5. 17:40Path traversal in Node.js demo
6. 22:11Zip slip file overwrite in Java
7. 27:23Spring Boot SPEL vulnerability
8. 33:18Security solutions: Culture, process, tooling
9. 36:53Automating security with Snyk
10. 40:25Shift-left security in development
11. 42:52Secure Java development resources

" related talks

• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 18mLive Exploiting Your Open Source DependenciesBrian Vermeer · CodeLand 2020
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019