Python common security mistakes in 2022
summary
Live demos reproduce real CYE pen tests showing parameter tampering that lets one user read and edit another’s account, classic SQL injection that pulls credit card rows (Heartland: ~130 million cards historically), and persistent XSS that defaces pages and steals sessions. Code samples use vulnerable string concatenation; fixes require the Python DB API or ORM parameter binding, centralized authorization checks, strict whitelist input validation and HTML output encoding in templates.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:53Security in agile development
- 10:01Top 10 vulnerabilities
- 13:12Parameter tampering demo
- 17:04SQL injection explained
- 21:52SQL injection demo
- 27:52Cross-site scripting demo
- 35:41Mitigation strategies
- 41:19Business impact analysis
- 43:48Q&A
related talks
59mCommon Python Coding Mistakes
32mWeb Security for Newcomers: how to avoid getting hacked as a software developer
26mTesting Python Security
54mPython Security Best Practices Against Vulnerabilities
58mModern web application bugs
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
52mHow to get properly hacked!
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders