OWASP BeNeLux Day 2017
2017-11-24..2017-11-25
Leuven, Belgium
who it's for
application security engineers, security researchers, web developers, devops engineers, site reliability engineers, incident responders, security architects
topics
parameterized SQL queries; static application security testing; dynamic web testing with Selenium; browser extension abuse; malicious domain registration analysis; .eu domain prediction service; script gadget XSS bypasses; Trusted Types mitigation prototype; REST API authorization pitfalls; JWT signature and verification mistakes; containerised AppSec pipeline with Jenkins; docker-bench container hardening
| title | author | length |
|---|---|---|
| How to spend $3.6mil on one coding mistake | Matias Madou | 44m |
Average breach cost is $3.62M so a choice is clear: pay remediation or spend that on prevention — $3.6M buys ~3,600 code fixes or many training seats, static… | ||
| The evil friend in your browser | Achim D Brucker | 45m |
A crawler and instrumented runtime inspect ~60,000 Chrome extensions and find concrete abuses: 60% request all-URLs/webRequest rights, a small tail of… | ||
| Exploring the ecosystem of malicious domain registrations in the .eu TLD | Lieven Desmet | 46m |
Analysis covers 14 months and 824,121 registrations and finds 2.53% flagged by Spamhaus Google Safe Browsing and SURBL using ~700,000 DNS queries and MaxMind… | ||
| Don't trust the DOM: Bypassing XSS mitigations via script gadgets | S. Lekies | 42m |
Claims that script gadgets — legitimate JS that upgrades benign DOM nodes into code — let attackers bypass most XSS mitigations. Research analyzes 16 popular… | ||
| A Series of Unfortunate Events: Where Malware Meets Murphy | M. van Ommeren | 27m |
Hundreds of gigabytes of files end up encrypted, AV/firewall/SIEM all fail, and nightly backup exists but is one day out of date; a one terabyte backup… | ||
| Common REST API security pitfalls | Philippe De Ryck | 37m |
Checklist style evaluation says whether to watch: the session names specific failures and fixes — missing authorization on ID-based endpoints, client-side… | ||
| Creating an AppSec Pipeline with Containers in a Week | Jeroen Willemsen | 36m |
A working AppSec pipeline appears in one week that actually scans builds, stores artifacts and creates tickets while staying usable for development teams. It… | ||
| nothing matches | ||