DevSecOps

on YouTube ↗52m

" summary

Live demos show an RCE via an Apache Struts OGNL header against a Heroku app, a zip path traversal overwrite of native2ascii, and a Tomcat 8.5.21 base-image exploit that uploads a JSP web shell and yields root inside the container. Scan findings: a 222-line demo pulls 54 transitive deps out of a 460k‑line codebase, log4j appears transitively in ~60% of scans, and Equifax‑style breaches took 75 days to detect and cost ~$2.2B. Tooling used: Snyk scans, ncat for reverse shells, custom LDAP/HTTP exploit servers, and shows IDE plugin XSS alerts.

AI-written summary · about

" chapters (14)

1. 0:00Introduction to DevSecOps
2. 1:48What is DevSecOps?
3. 3:58Security as part of DevOps
4. 7:25IDE integration for security
5. 10:35Open source dependencies risks
6. 15:49Dependency updates and pipelines
7. 20:29Log4j vulnerability demo
8. 28:40Deserialization gadget chains
9. 34:40Docker container vulnerabilities
10. 39:13Tomcat misconfiguration exploit
11. 43:34Kubernetes and infrastructure security
12. 44:58Culture and responsibility in DevSecOps
13. 48:10Tooling and process integration
14. 50:57Summary and closing

" related talks

• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 18mLive Exploiting Your Open Source DependenciesBrian Vermeer · CodeLand 2020
• 50mStranger Danger: Your Java Attack Surface Just Got BiggerBrian Vermeer · Voxxed Days Cluj 2023
• 35mInside a hacker’s mindMaria Shoaib · Øredev 2019