Web Application Security: Winning When The Odds Are Against You
summary
Live demos run on PHP apps inside Vagrant VMs show concrete failures and fixes: a registration form allows created admin via SQL injection by inserting quote and comment markers; reflected XSS injects JS that stole session cookie by sending it to evildogcto/collect.php and then hijacks the session in another browser; a CSRF attack adds products and changes shipping by loading image requests; a naive “remember me” cookie uses predictable user ID so setting remember=2 logs in as admin. Lessons: use parameterized queries, output escaping, CSRF tokens, and opaque remember tokens.
AI-written summary · about
chapters (10)
- 0:00Introduction and thanks
- 1:38OWASP Top 10 overview
- 2:41Live demo setup and SQL injection
- 10:05SQL injection prevention
- 10:50Cross-site scripting attacks
- 20:43Weak authentication and session management
- 25:02Insecure direct object reference
- 26:25Cross-site request forgery demo
- 30:24Solutions and best practices
- 43:40Q&A session
related talks
02h 14mWeb application security (Part 1)
01h 04mWeb Security And You
02h 18mWeb application security (Part 2)
43mSecuring Your Rails App
01h 02mCode Review For Security
51m10 things developers need to know about web application security
52mHow to get properly hacked!
32mWeb Security for Newcomers: how to avoid getting hacked as a software developer