Beating the pentester
summary
Shows concrete ways to stop a late-stage pentest: scan dependencies with CVE Details and Exploit-DB, avoid relying on Metasploit-only fixes, and patch continuously — note 40% of Docker Hub images contain known vulnerabilities. Demonstrates a real template injection exploit (breaking out of JSON into JavaScript and HTML) and the fix: contextual encoding (URL-encode, then JSON-encode, then HTML-encode) plus immutable value objects and PDO prepared statements. Recommends STRIDE threat modeling and OWASP ASVS checks.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:47Finding known vulnerabilities
- 13:07PHP Injection
- 19:00Validation
- 22:56Application Security
- 24:17Pre deprecated attacks
- 25:23Improved features
- 27:55Threat Modeling
- 28:21Data Flow Diagram
- 32:14Security holistically
- 32:35Operations
related talks
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
39mInsecure Containers? Continuous Defense Against Open Source Exploits
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
35mInside a hacker’s mind
41mLive Hacking: Breaking into Your Web App
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
57mEnterprise Ethical Hacking Cloud Applications
37mSecuring Containers by Breaking In