Don't Get Burned! Secure Coding Essentials to Protect Your Application
summary
Live demo shows SQL injection via concatenation that fixed only when using prepared statements plus parameterized queries, a file upload exploit where a crafted filename causes path traversal from uploaded filename to overwrite system files (tested with Burp Suite), an XXE leaking /etc/passwd via default XML parser settings, and unsafe YAML deserialization that runs a gadget to open the calculator. Replaces PBKDF2 with Argon2id (≈15 MB, 2 iterations) and moves symmetric encryption to AES‑GCM; Snyk scan finds 60+ vulnerabilities and recommends Spring Boot and dependency upgrades.
AI-written summary · about
chapters (8)
- 0:00App security introduction
- 3:59Speaker and shortcuts
- 14:46SQL injection vulnerabilities
- 24:24File upload and path traversal
- 31:16Hashing vs encryption
- 45:11YAML deserialization risks
- 50:49Updating dependencies
- 56:25Q&A
related talks
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.
50mStranger Danger: Your Java Attack Surface Just Got Bigger
58mModern web application bugs
52mHow to get properly hacked!
47mThe Hidden Security Hazards in Your Java Stack
46mLive hacking: Breaking into your Java web app