Inside a hacker’s mind
summary
Covers concrete exploits: OGNL expression injection in Apache Struts (the Equifax-style remote code execution), live demos that show arbitrary Java execution, and a Stored XSS zero-day (70,000 sites, March 2019) with payloads that steal cookies and hijack admin sessions. Shows pitfalls in serverless attack surface—misconfigured functions, increased input vectors, and missing monitoring—then demonstrates fixes: upgrade to patched Struts, map data flows, apply least privilege to functions, add logging/alerts, and enforce dependency and peer code reviews.
AI-written summary · about
chapters (10)
- 0:00INSIDE A HACKER'S MIND: APACHE STRUTS, SERVERLESS, AND, STORED XSS ZERO-DAY
- 5:22Ideally, everyone gets this...
- 6:52OGNL Expression Injection
- 7:58Example
- 10:56Going Serverless
- 13:50New attack vectors introduced in serverless
- 17:03What to do?
- 24:03What can the hacker do?
- 31:35Key Takeaways
- 34:20A few resources
related talks
46mLive hacking: Breaking into your Java web app
43mLive hacking: Breaking into your Java web app
01h 06mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
41mLive Hacking: Breaking into Your Web App
01h 02mLive Hacking: Breaking into your Web App
47mLive Hacking: Breaking into Your Web App
52mDevSecOps