Modern Web Application Defense with OWASP Tools
summary
Live demos show OWASP tools stopping real attacks: reflected XSS is blocked by a strict Content Security Policy header and verified in ZAP traffic; output encoding options compared are ESAPI versus the focused OWASP Java Encoder; HTTPOnly cookies and HSTS reduce session hijack and SSL strip risks; a vulnerable demo app (OneLiner) is exploited with JSON CSRF and then neutralized by CSRFGuard’s token injection (automatic XHR hook and JSP tags) showing the protections actually work.
AI-written summary · about
chapters (16)
- 0:00Cross-Site Scripting (XSS)
- 2:22Contextual Output Encoding
- 6:03Content Security Policy
- 7:11CSP Requirements
- 8:04CSP Directives
- 8:22CSP Examples
- 16:00Strict-Transport-Security
- 17:33X-Frame-Options
- 19:24Using Secure Headers
- 21:55Cross-Site Request Forgery (CSRF)
- 26:34OWASP 1-Liner
- 29:47Normal JSON Message
- 30:18CSRF Attack Form
- 31:28Forged JSON Message
- 32:52CSRFGuard JSP Tags
- 33:57CSRFGuard DOM Manipulation
related talks
55mWeb Application Security: Browsers Fight Back!
18mWriting an (in)secure webapp
42mModern web application bugs
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
37mFront-end Security
50mModern WebApp Vulnerabilities
29mIntroduction to Web Security
30mWeb Security Engineering - Protect all layers of your project