Java application security the hard way - a workshop for the serious developer
summary
Live demo of Log4Shell RCE via JNDI/LDAP shows how a logged string can trigger remote classloads, gadget chains and full command execution; setup uses Quarkus+Java17+Docker so the exploit runs on modern stacks. Coverage includes supply‑chain failures (typo‑squatting, dependency confusion), practical fixes: dependency scans, Maven dependency checks, Dependabot, minimal container images, and SBoM expectations — note the uploader’s statistic that 42% of downloads still target vulnerable versions. Watch if you want hands‑on exploits and concrete remediation steps.
AI-written summary · about
chapters (11)
- 0:00Start
- 13:39Fake Packages and Repos
- 14:31Build Processors
- 17:45The Supply Chain
- 21:20Dependency Confusion and Typo Squatting
- 56:43Reference Object
- 1:00:22Gadget Chain
- 1:00:39Gadget Chains
- 1:10:14Prevention
- 1:34:29Build Your Docker Container from Scratch
- 2:04:07How Do You Deal with Errors
related talks
48mThe Hidden Security Hazards in Your Java Stack
46mLive hacking: Breaking into your Java web app
01h 06mLive hacking: Breaking into your Java web app
50mStranger Danger: Your Java Attack Surface Just Got Bigger
43mLive hacking: Breaking into your Java web app
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
56mThe Anatomy of Java Vulnerabilities
50mJava and Ransomware - what’s in it for you