Unique ways to Hack into a Python Web Service
summary
Shows live exploits: JWTs accepted after username changes until tokens are revoked, and demoed a live JWT swap; demonstrates YAML deserialization leading to reverse shells using yaml.load and mitigates with yaml.load vs yaml.safe_load, containerize parsing as nonroot and monitor network I/O. Recommends short JWT lifetimes (6–8 hours) and binding tokens to immutable IDs, and automates checks with bandit + ZAP in CI plus safety/source-composition scans; example repo and robot scripts available.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:37Unique Way To Hack into a Python Web Services
- 1:11Threat Modeling
- 1:37Agenda
- 1:49Common Vulnerabilities
- 2:25What Is Web Services
- 3:24What Are the Types of Web Services Are Available
- 4:18What Are Common Vulnerabilities Are in Rest Framework
- 4:47Django Prevents Sql Injection
- 8:41Jwt Is Not an Authentication Mechanism
- 9:26Json Web Token
- 10:44Signature
- 18:04Insecure Dc Realization Flaw
- 28:39Monitor Incoming and Outgoing Outputs
- 37:20Include Security Testing in a Devops Pipeline
