OWASP AppSec Europe 2018
2018-07-02..2018-07-06
London, United Kingdom
| title | author | length |
|---|---|---|
| Winning - the future perspective in the next 20 years! | Andrew van der Stock | 49m |
Claims that current practice fails and prescribes concrete changes: stop PDF pen‑test dumps and DefectDojo backlog hoarding, push vulnerability tests into… | ||
| AppSec EU 2018 Opening Remarks | Martin Von Knobloch | 04m |
Conference announces three board seats opening with elections starting Monday after the event, and voting limited to members; applications open then. Member… | ||
| Serverless Infections - Malware Just Found a New Home | Amit Ashbel | 30m |
A live RCE proof of concept targets AWS Lambda by injecting evalable JavaScript that zips and exfiltrates the function code, revealing secrets and using the… | ||
| OWASP AppSec EU 2018 Leaders Meeting | Dawn Aiken | 01h 34m |
Updates on OWASP governance and operations focus on measurable changes: US chapters are cleaned up, Europe is in progress, 220 chapters exist while only about… | ||
| The Perimeter Has Been Shattered | Georgia Weidman | 49m |
Claim: the enterprise perimeter no longer blocks attacks because employee phones, IoT and cloud services communicate outside firewalls. Demonstrations show… | ||
| Detecting and Preventing Malicious Domain Registrations in the .eu TLD | Lieven Desmet | 43m |
Fourteen months of .eu registrations yield 824,121 registrations with 2.53% flagged by blacklists and at least 80.04% of short‑lived malicious names grouping… | ||
| Attacking Modern Web Technologies | Frans Rosén | 43m |
Shows concrete exploits and tools: a live postMessage tracker extension that logs cross-frame listeners and finds anonymous handlers, demos extracting CSRF and… | ||
| Testing iOS Apps without Jailbreak in 2018 | Wojciech Reguła | 36m |
Claims a jailbreak-free workflow that actually injects a dynamic library into an app, demonstrates Frida gadget + PassionFruit for live inspection, and uses… | ||
| The Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years | Jim Manico | 41m |
XSS remains pervasive and hard to fix; defense shifts from vague advice to concrete tactics: use DomPurify to wrap dangerous innerHTML (one auditor locks down… | ||
| Secure Messengers and Man in The Contacts | Laureline David, Jeremy Matos | 37m |
Implementation of Man in The Contacts claims full remote control of a handset address book via a Play Store Android game (a social Rock-Paper-Scissors game)… | ||
| Passive Fingerprinting of HTTP/2 Clients | Elad Shuster | 44m |
Claims passive client fingerprinting works by extracting deterministic patterns from the early HTTP/2 exchange and builds a compact fingerprint from… | ||
| Mr Sandman: Time Lock Puzzles for Good and Evil | Matt Wixey | 43m |
Concrete constructions and demos decide whether to watch: several timelock puzzle types are implemented and shown working — proof‑of‑work executable stub that… | ||
| Docker 201 Security | Dirk Wetter | 47m |
Provides a concrete Docker Top 10 checklist of explicit do's and don'ts and demonstrates audit scripts and commands to inspect container images, runtimes and… | ||
| How Leading Companies Are Scaling Their Security | Clint Gibler | 45m |
Companies describe concrete measures and results: automated scrapers of Slack and JIRA to surface security-relevant work, internal threat‑model webapps that… | ||
| Don't Feed the Hippos | Martin Von Knobloch | 42m |
Argues that security wins when it listens and embeds with dev teams and shows concrete fixes not fear: replaces remote checklists with two-hour team intakes… | ||
| Continuous Kubernetes Security | Andrew Martin | 46m |
Explains concrete failures and fixes: require mutual TLS across the control plane (use TLS bootstrap so keys are not baked into images), lock down etcd and… | ||
| Making Continuous Security a Reality with OWASP’s AppSec Pipeline | Matt Tesauro, Aaron Weaver | 42m |
Practical demonstration of an implemented pipeline that runs prebuilt docker containers for static and dynamic checks, pushes normalized results into OWASP… | ||
| OAuth is DAC. What do you do for MAC? | Johan Peeters | 43m |
OWASP AppSec EU 2018 Developer Track - Day 1, talk 4
Such is the frustration of the development community with SAML, that most new projects requiring access… | ||
| Secure Software Development Framework: Towards an SDL for all SDLCs | Damilare D. Fagbemi | 38m |
OWASP AppSec EU 2018 Developer Track - Day 1, talk 3
The Security Development Life-cycle (SDL) is a process that helps developers to build more secure… | ||
| Remediate The Flag - Practical AppSec Training Platform | Andrea Scaduto | 35m |
Open source platform Remediate The Flag provisions disposable browser-accessible development environments on demand and claims 100% hands-on remediation… | ||
| Unicode: The hero or villain? | Paweł Krawczyk | 40m |
Claims that Unicode need not wreck validation and shows concrete fixes: use Unicode data in Python to inspect categories and scripts, apply NFC normalization… | ||
| Building an AppSec Program with a Budget of $0: Beyond the OWASP Top 10 | Chris Romeo | 42m |
Claims that a complete AppSec program can be built with zero budget using OWASP projects and a small staff; concrete components and steps matter. Use ASVS and… | ||
| Building a Valid Threat Library for Cloud Based Applications | Tony UcedaVelez | 41m |
Claims a working, evidence-driven threat library that pulls cloud monitoring via Azure Hybrid security dashboard and AWS APIs to correlate attack patterns to… | ||
| Gamifying Developer Education with CTFs | Max Feldman, John Sonnenschein | 41m |
Organizers run a week-long internal CTF during security awareness month to teach real failure modes: web flags, forensics captures and Slack-specific puzzles… | ||
| From Rogue One to Rebel Alliance: Building Developers into Security Champions | Peter Chestna | 44m |
Nails a concrete solution: recruit two champions per team, train them with checklists, static analysis, guided secure code reviews and CTF practice, and… | ||
| XSS is dead. We just don't get it. | Mario Heiderich | 47m |
Claim: XSS is technically solvable — specific defenses exist and catch most cases — yet it persists because of implementation gaps and incentives. Concrete… | ||
| Jumpstarting Your DevSecOps Pipeline with IAST and RASP | Jeff Williams | 43m |
Claims a working pipeline using free Community Edition IAST and RASP, where an IAST agent jar added to the app instruments code at runtime and reports real… | ||
| Securing Containers on the High Seas | Jack Mannino, Abdullah Munawar | 40m |
Argues for an enterprise container security strategy that hardens every lifecycle phase and gives concrete controls: use Claire and Dependency-Check in CI to… | ||
| Perimeter-less: Engineering the future of Defense | Allison Miller | 50m |
Claims that the castle‑and‑moat perimeter is dead and defences must be built into products and platforms, with three concrete model types offered: threat… | ||
| WAF Bypass Techniques Using HTTP Standard and Web Servers’ Behavior | Soroush Dalili | 43m |
Shows concrete WAF bypasses: use HTTP/0.9 delivered via HTTP pipelining, exploit differing server parsing (Apache Tomcat quirks, header folding, semicolon… | ||
| Exploiting Unknown Browsers and Objects | Gareth Heyes | 39m |
A tool called Hackability inspector enumerates hidden JavaScript objects in embedded browsers and runs concrete tests it finds cross-domain window detection… | ||
| FIESTA: an HTTPS side-channel party | Jose Selvi | 42m |
Claims a new HTTPS side channel and ships a Python tool called FIESTA that turns observed byte counts and connection counts into oracles, extracting phone… | ||
| Prepare(): Introducing Novel Exploitation Techniques in Wordpress | Robin Peraglie | 34m |
WordPress powers ~30% of sites and WooCommerce has ~2.3M installs so a core design choice matters: a custom prepared-statement layer enables a double prepare… | ||
| Outsmarting Smart Contracts | Damian Rusinek | 43m |
Shows concrete failures: default-visibility functions let anyone seize wallets, default-public functions; arithmetic errors let balances wrap to zero, integer… | ||
| nothing matches | ||