Understanding the OWASP Top 10
summary
A straight run through the OWASP Top 10 with concrete examples: a demo site shows unvalidated redirects and the simple fix of whitelist redirects; composer dependencies bite projects and a composer advisory package is suggested; a CSRF image triggers a payroll transfer; XSS leaks PHPSESSID to an attacker site; SQL injection drops tables and the remedy is parameterized queries (PDO); session hardening, HTTPS everywhere and tools like Zap Attack Proxy and Nikto are mentioned.
AI-written summary · about
chapters (19)
- 0:00Start
- 1:5410 Is Unvalidated Redirects and Forwards
- 7:42You Should Whitelist every Page on Your Website
- 13:24Recommendation for Versioning Your Dependencies in Your Composer File
- 15:55Eight Is Cross-Site Request Forgery Csrf
- 17:52Eos Csrf Attack
- 19:37Require and User Interaction
- 22:49Missing Function Level Access Control and Unsecure Direct Object References
- 23:24Secure Direct Object References
- 28:36Personal Information
- 31:37Questions on Sensitive Data Exposure
- 31:51Security Mis Configuration
- 34:44Cross-Site Scripting
- 45:16Session Regeneration
- 49:29Injection Attack
- 53:22Use Parameterize Queries
- 55:04Filter Libraries
- 56:22Modsecurity
- 58:53Is There any Automated Way To Test against these Vulnerabilities
related talks
53mOWASP Top 10: What are them and how to prevent them
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
29mFlagship Projects: Top 10 "Intro of Top 10"
58m: The OWASP Top Ten Proactive Controls 2018
24mFrom the crypt to the code: Web security explored through horror movies
51mHarmonizing the OWASP API and Application Top 10 Lists
32mOWASP Top 10 Vulnerabilities in Node.js