OWASP AppSec Research (AppSecEU) 2015
2015-05-19..2015-05-22
Amsterdam, Netherlands
| title | author | length |
|---|---|---|
| Opening ceremony | Martin Von Knobloch | 03m |
Brief sequence of logistics and conference housekeeping: announcement of toy rocket fight props, on‑site lockpicking village and massage table with request to… | ||
| Continuous Acceleration: Why Continuous Everything Requires A Suppl... | Joshua Corman | 47m |
Argues that continuous delivery plus DevOps forces a software supply chain mindset: countable failures (Heartbleed is one of 31 CVEs that year, 600,000… | ||
| Security Touchpoints When Acquiring Soft... | Carsten Huth, Nadim Barsoum, Dawid Sroka | 41m |
Maps concrete security checks to acquisition phases: planning requires threat-driven requirements using the SQUARE requirements method and an assurance case… | ||
| Security DevOps - Staying Secure In Agile Projects | Christian Nils Schneider | 46m |
Claims a reproducible CI pattern that finds low‑ and mid‑hanging security bugs automatically while freeing manual pentests for deep work, using OWASP ZAP… | ||
| PDF - Mess With The Web | Alex Infuhr | 33m |
Demonstrates concrete, working attacks: goToE JavaScript open action and URI actions execute script in the embedding page; FormCalc GET function issues… | ||
| Women... | Tobias Gondrom, Jaya Baloo, Dr. Melanie Rieback, Dhillon Andrew Kannabhiran | 46m |
Discussion centers on concrete fixes and outcomes: a double-blind CFP noticeably raises female acceptance rates, outreach and direct invitations boost… | ||
| Copy Pest - A Case Study On The ClipBoard, Blind Trust And Invis... | Mario Heiderich | 45m |
Demonstrates concrete clipboard XSS: document apps create multiple clipboard “buckets” (HTML/RTF/text), attackers modify styles.xml or document.xml (rename… | ||
| Opening ceremony | Martin Von Knobloch, Tobias Gondrom | 19m |
Conference opens with concrete logistics and community metrics: two days of training certifies 127 people trained, a university challenge fields 11 teams from… | ||
| Client-Side Protection Against DOM-Base... | Martin Johns, Sebastian Lekies, Ben Stock | 40m |
A practical evaluation finds the built-in XSS auditor misses many DOM XSS cases: a taint-tracking crawler and automated exploit generator targets the Alexa top… | ||
| Server-Side Browsing Considered Harmful | Nicolas Gregoire | 01h 04m |
Shows concrete SSRF attack chains: using dotless decimal and octal IP encodings, DNS rebinding and a dynamic HTTP redirect endpoint to bypass blacklists… | ||
| Rise Of The Machines - How Automated Processes Overtook the Web | Yossi Daya | 38m |
Akamai research presents concrete findings: a one‑day sample shows 85 billion requests with 8 billion bot requests (~9.5%), and a found mega‑scraper uses 3,000… | ||
| Lessons From DevOps: Taking DevOps Practices Into Your AppSec Life | Matt Tesauro | 45m |
Claims a DevOps-style appsec pipeline is practical not just aspirational it wires repo commits, unit tests, scanners and manual work into an automated flow… | ||
| From Zero To Hero - Or How OWASP Saved My Holiday | Tobias Gondrom | 38m |
A concrete checklist helps decide: use OpenSAMM for a one‑day self‑assessment (12 domains), run the OWASP Top Ten 90‑minute awareness slide deck, deploy the… | ||
| HTTPS Is Better than Ever Before. Now Its Your Turn. | Jim Manico | 37m |
Claim: HTTPS now gives confidentiality integrity and authenticity when configured correctly. Actionable specifics: update OS and OpenSSL patch Heartbleed and… | ||
| Hard Knock Lessons On Bug Bounties | Jonathan Cran | 43m |
Data shows 30,000 submissions with 765 high/critical reports and 222 criticals, 30,000 submissions leading to an average payout per valid issue near $200 and a… | ||
| Preserving Arcade Games | Ange Albertini | 01h 02m |
From AppSecEU 2015 in Amsterdam
https://2015.appsec.eu/
Ange Albertini
Preserving Arcade Games
You can download all Videos… | ||
| XSS Horror Show | Gareth Heyes | 41m |
Dives into concrete browser bugs and working exploits: demonstrates Relative Path Overwrite (RPO) where a single slash or pretty-URL rewrite causes a… | ||
| The Top 10 Web Hacks of 2014 | Matt Johansen, Johnathan Kuskos | 45m |
Ten ranked exploits with concrete takeaways: heartbleed leaks TLS keys via a malformed heartbeat so operators must rotate certs; shellshock lets an… | ||
| 50 Shades of AppSec | Troy Hunt | 43m |
A rapid tour of concrete failures and exploits: easy tools like Bishop browser plug-in and copy‑paste tutorials enable child hackers and phishing; marketplaces… | ||
| The API Assessment Primer | Greg Patton | 39m |
APIs routinely expose concrete failures not concepts: mobile backends return full user lists or password hashes, login requests go over plain HTTP, and an IoT… | ||
| Abusing JSONP With Rosetta Flash | Michele Spagnuolo | 39m |
Rosetta Flash converts arbitrary SWF to an alphanumeric SWF converter that fits into JSONP callbacks, uses an object tag to force… | ||
| Red Team, Blue Team Or White Cell? Trends In IT | Frank Breedijk | 29m |
Argument that security must behave like an immune system with fast feedback loops not hard shells backed by examples and a working pipeline: an automatic image… | ||
| Web Service Workers - Breaking The Web Because It Would Be A Sh... | Eduardo Vela Nava | 30m |
Explains concrete security impacts of service workers with live demos and bug findings rather than theory: claims that service workers read POST bodies, can… | ||
| OWASP ZAP: More Advanced Features | Simon Bennetts | 47m |
Version 2.4.0 for OWASP ZAP claims concrete wins: 32,000 downloads in one month, translations into 31 languages and 130 translators, and a codebase now ~20%… | ||
| If 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot! | Matias Madou, Daan Raman | 42m |
Scans 30k–50k apks and finds ~6,000 malicious samples, using a mix of static analysis (dex2jar plus jd gui) and an enhanced dynamic system built from a… | ||
| Bringing Security Testing To Development: How To Enable Developers To Act As Security Experts | Achim D Brucker | 45m |
A concrete program integrates static + dynamic tooling into development: IDE quick checks, CI scans, and periodic full validation and penetration tests in… | ||
| Dark Fairytales From A Phisherman | Michele Orru | 54m |
Automated phishing pipeline that boots an Amazon EC2 Debian image, deploys a fishing frenzy web UI, wires in BeEF integration and SendGrid SMTP, and drives… | ||
| Collective Detection Of Harmful Requests | Marek Zachara | 34m |
Uses a compact behavior graph of URL transitions (edge weights decay over time) to flag rare traversals, shares MD5 hashes of stripped URLs across servers for… | ||
| Maliciously Monetizing AppSec Feature. Its All About The Money. | Or Katz, Ezra Caltum | 36m |
Akamai traffic analysis claims open redirects are being weaponized for SEO at scale, not phishing, revealing 1,000 IPs that abuse 4,000 vulnerable apps to push… | ||
| Security Policy Management: Easy as PIE | Ian Haken | 40m |
Claims that security managers and CSP are widely neglected despite low performance cost; a scan finds 2.7% of top 500 sites send CSP (mostly weak). Built a… | ||
| The Node.js Highway: Attacks Are At Full Throttle | Maty Siman | 42m |
Node.js is single‑threaded so CPU‑heavy code creates trivial DoS; a demo runs a 100‑million loop and ties up one core. V8’s Math.random plus MD5 password… | ||
| Closing ceremony | 20m | |
Event closes after four days that hit 583 registrations (goal 500) and agonizingly successful chapter collaboration across Belgium Netherlands Luxemburg, with… | ||
| Building An AppSec Pipeline: Keeping Your Program, And Your Life, Sane | Aaron Weaver | 46m |
Case study of an AppSec pipeline that actually ships: a three‑month MVP called Bag of Holding (Python/Django) holds inventory and engagements, orchestrates… | ||
| So, You Want To Use A WebView? [BAD AUDIO] | Andrew Lee-Thorp | 40m |
Android WebView exposes concrete, exploitable behaviors: JavaScript interface reflection allows arbitrary Java access even when no interface is explicitly… | ||
| Security and Insecurity of HTTP Headers | Dirk Wetter | 49m |
Survey of concrete header failures shows servers and proxies leak version and topology data so an attacker can fingerprint infrastructure; a live test across… | ||
| WebRTC, Or How Secure Is P2P Browser Communication? [BAD AUDIO] | L. Desmet, M. Johns | 50m |
From AppSecEU 2015 in Amsterdam
https://2015.appsec.eu/
Lieven Desmet, Martin Johns
WebRTC, Or How Secure Is P2P Browser Communication?
You can download… | ||
| Security And Modern Software Deployment | Rory McCune | 38m |
Shows that piping a fetched shell script into sh (so‑called curl bashing) actually hands root or install‑time power to many parties; package managers run… | ||
| Implementing A User-Centric Datastore | Paul Malone | 35m |
Claims a user-centric personal cloudlet that gives consumers object-level permissions and logs access while developers use a reusable type system; implemented… | ||
| Can Saas Ever Be Secure? | Helen McLaughlin | 39m |
SaaS adoption accelerates and the real questions are concrete: who can access which data from where, how often a provider has had breaches, and whether… | ||
| Agile Security Testing - Lessons Learned | David Vaartjes | 45m |
Claim: reshaping waterfall pen‑testing into embedded sprint work yields secure releases and lower cost. Pilot runs for about a year, joins grooming and spends… | ||
| E-Banking Transaction Authorization - Common Vulnerabilities, ... | Wojtek Dworakowski | 32m |
Reviews over 50 penetration tests and live deployments and finds concrete failures: transaction details are not bound to authorizations so SMS codes and… | ||
| Security is Part Of The DNA Of A Defense Organization | Hans Folmer | 41m |
Defense organization security presents concrete practices and constraints: four assigned roles — protection, intelligence, law enforcement, and military… | ||
| Securing The Internet Of Things | Steve Lord | 48m |
List of concrete failures and fixes not slogans: a fart-measuring device and a two-hundred-dollar cup expose trivial data collection; sensors behave as… | ||
| Mobile Application Assessments By The Numbers: A Whole-istic View | Dan Cornell | 52m |
Sixty-one assessments across twenty apps yield 957 recorded issues and a clear claim: most serious flaws live on corporate web services not the device — about… | ||
| Naxsi, A Web Application Firewall for NGINX | Thibault Koechlin | 41m |
Naxsi is a ruleset‑light WAF for NGINX that scores small tokens (quotes, brackets, dashes) instead of huge regex signatures, integrates libinjection for… | ||
| Using A JavaScript CDN That Can Not XSS You - With Subresource Int... | Frederik Braun | 35m |
Proposes using subresource integrity to stop compromised CDNs from injecting XSS by verifying exact hash digests (sha256/384/512) before execution, shows the… | ||
| Issues And Limitations Of Third Party Security Seals | Tom Van Goethem | 40m |
Scanning of the seal ecosystem finds more than 8,000 sites using third‑party security seals, often e‑commerce, with prices from $84 to over $2,000 a year… | ||
| Finding Bad Needles On A Worldwide Scale | Dmitry Savintsev | 42m |
Claims that accurate reflected XSS detection is unsolved but improvable; shows a concrete stack: web lab test suit of real and false‑positive cases, a go-based… | ||
| The Software Not the Human Is the Weakest Link | Brenno De Winter | 26m |
The talk argues that software, not users, is the weakest link in security by presenting incidents and measurements: manipulating a public-transport ticket… | ||
| Windows Phone App Security For Builders And Breakers | Luca De Fulgentis | 44m |
Results from 160 apps surveyed show repetitive, verifiable failures: credentials and tokens saved in clear text in app settings and SQLite files, HTTP… | ||
| nothing matches | ||