Stranger Danger: Your Attack Surface Just Got Bigger
summary
Java examples demonstrate concrete failures: unsanitized request parameters cause cross-site scripting, file uploads allow path traversal to escape an upload dir, and dependencies make up only 10–20% of a production binary (80–90% is pulled libraries). Live exploitation uses curl and Burp Suite, an exploit-db Python script uploads a JSP webshell to Tomcat 8.5.2 inside a Docker image running as Docker default user root, yielding remote code execution; Equifax-style timelines and Log4Shell saw hundreds of thousands of automated attacks within days.
AI-written summary · about
chapters (8)
- 0:00Security in DevOps
- 1:59Security overlooked in dev
- 3:03Code vulnerabilities impact
- 8:26Open-source dependency risks
- 13:26Shared security responsibility
- 19:32Cultural shift for security
- 24:05Container security risks
- 25:09Security tooling and monitoring
related talks
50mStranger Danger: Your Java Attack Surface Just Got Bigger
46mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
01h 06mLive hacking: Breaking into your Java web app
48mThe Hidden Security Hazards in Your Java Stack
43mLive hacking: Breaking into your Java web app
46mStranger Danger: Securing Your Java Containers by Breaking In
56mThe Anatomy of Java Vulnerabilities