Modern web application bugs

on YouTube ↗42m

" summary

Live demos show concrete exploit patterns and fixes: reading local files and internal services via blind XXE exfiltration and XSLT document(), spawning shells and running commands via gadget chains for insecure deserialization (Java/.NET examples), turning URL parsing oddities into SSRF for 169.254 metadata access, taking over forgotten CNAMES to perform subdomain takeover through abandoned CNAMEs, and poisoning cached pages by manipulating host headers for web cache poisoning via X-Forwarded-Host. Demos use ysoserial-style payloads, Burp extensions to discover cache keys, and a public Docker demo app.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 2:18XML
3. 7:17Insecure serialization
4. 11:16Serverside request forgery
5. 16:21Template injection
6. 21:53Insecure resource sharing
7. 25:13DNS squatting
8. 29:11Web cache poisoning
9. 35:36Cache headers
10. 36:26URL parameters
11. 37:26How to stop it
12. 39:36Resources

" related talks

• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 50mModern WebApp VulnerabilitiesErlend Oftedal · Øredev 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 53mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2024
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020