Don't Get Burned! Secure Coding Essentials to Protect Your Application
summary
A demo Spring Boot app shows real exploits that work: SQL injection: concatenated query allows an attacker to run "UPDATE products SET price=0" and zero out prices, Burp Suite manipulates the multipart POST to prove file upload path traversal saved an uploaded file outside the upload folder into the system root, and a SAX XML import leaks /etc/passwd via XXE. Remedies shown: parameterized prepared statements (JPA/Hibernate), normalize filenames, disable DTD/external entities, use Argon2id for hashing, AES-GCM for encryption, and scan deps with Sneak/IDE/CLI.
AI-written summary · about
chapters (10)
- 0:00Introduction and setup
- 5:11Why secure coding matters
- 9:24SQL injection vulnerabilities
- 16:50File upload security risks
- 23:11XML parsing and XXE attacks
- 28:12Hashing and encryption standards
- 36:02Library and framework risks
- 39:12Protecting sensitive data
- 43:47How to get started with security
- 46:34Q&A and closing
related talks
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
47mThe Hidden Security Hazards in Your Java Stack
43mLive hacking: Breaking into your Java web app
24mSecurity – only developers can make it proactive
52mHow to get properly hacked!
01h 06mLive hacking: Breaking into your Java web app