Tutorial: Yes, Your Applications are Under Attack - Struts2 Vulnerability Workshop
summary
Reproduces the Equifax Struts2 RCE exploit against a Tomcat 7 container built with Maven and Docker, using Python 3 virtualenv and a python exploit.py payload to open a root shell in the running app. Cites Sonatype data: ~90% of apps use OSS, 1 in 10 components have known vulnerabilities, 650% YoY rise in supply chain attacks and 1 in 5 orgs breached. Shows prevention: free OSS Index scans and the ahab scanner that fails Docker builds when OS or component CVEs appear.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:30Why are we building software
- 1:05Large change in the way we develop
- 1:40Agile to DevOps
- 2:05Open Source
- 3:57Disadvantages of Open Source
- 5:13Software Supply Chain Attacks
- 7:25Confluence Server Attack
- 8:04PipeI Package Attack
- 8:44Biden Executive Order
- 9:21Evil Hackers
- 12:14Workshop Walkthrough
- 12:38Requirements
- 13:21Setup
- 13:50Instructions
- 22:10OS Index
- 23:42OS Index Overview
- 24:17Supported Languages
- 24:59AHAB
- 28:53How popular is that package
- 29:36Integrations
- 30:27Questions
related talks
01h 32mYour Applications are Under Attack: Protecting each step of the development lifecycle
50mStranger Danger: Your Java Attack Surface Just Got Bigger
52mDevSecOps
26mStranger Danger: Your Attack Surface Just Got Bigger
46mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
46mStranger Danger: Securing Your Java Containers by Breaking In
39mWe Are All Equifax: The Data Behind DevSecOps