Live Hacking: Breaking into your Web App

on YouTube ↗01h 02m

" summary

A deliberately vulnerable sample app called Goof uses real-world modules and the demo exploits them live: an Apache Struts OGNL RCE lets curl-triggered commands run on Heroku, a 19-line Node app with 19 direct deps pulls in ~200k LOC, a Java jar with five deps becomes ~460k lines of transitive code, path-traversal and zip-slip attacks overwrite JDK files (zip-slip overwrites JDK binary), regex ReDoS blocks Node threads, and SPEL and OGNL remote command execution show how these vulnerabilities are chained and actually work.

AI-written summary · about

" chapters (8)

1. 0:00Introduction to DevSecOps
2. 12:20Apache Struts vulnerability demo
3. 25:01Node.js path traversal exploit
4. 31:50Regex denial of service attack
5. 39:14Java zip slip and file overwrite
6. 45:11Spring Boot arbitrary command execution
7. 53:01Solutions culture process tooling
8. 57:50Q&A session

" related talks

• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 18mLive Exploiting Your Open Source DependenciesBrian Vermeer · CodeLand 2020
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 35mInside a hacker’s mindMaria Shoaib · Øredev 2019