Stranger Danger: Your Java Attack Surface Just Got Bigger
summary
Live demos show how small coding shortcuts and stale dependencies lead to full takeover: an unchecked response writer enables reflective XSS, a naive multipart filename allows path traversal exploitable via Burp Suite, and an outdated Apache Struts 2 install mirrors the Equifax disaster (76 days, ~140 million records, ~$2B). Log4Shell contaminates ~177,000 packages and prompts ~800,000 automated attacks in 72 hours; an exploit takes ~35–40 minutes to craft. Scanning finds Tomcat-based images with 735 vulnerabilities reduced to 37 by a minor update; use CI/IDE scans, Dependabot and runtime monitoring.
AI-written summary · about
chapters (25)
- 0:00DevSecOps mindset
- 2:29Security afterthought in development
- 5:42Code vs attack surface
- 8:29Reflective XSS demo
- 9:15File upload path traversal
- 13:54Dependencies as attack vectors
- 14:37Equifax breach and Struts 2
- 16:23Struts 2 exploit demo
- 20:16Outdated dependencies risk
- 23:05Dependencies pull millions lines
- 25:15Open source libraries targeted
- 26:17Log4Shell vulnerability
- 29:06Log4Shell exploit demo
- 31:33Maintainers' security confidence
- 33:19Containers as dependencies
- 34:02Base image vulnerabilities
- 35:45Outdated Tomcat exploit
- 39:40Container vs code security
- 41:25Security everyone's responsibility
- 43:08Breach aftermath and failures
- 44:54Tooling for developers
- 45:37Security scans in dev
- 46:41Monitoring dependencies
- 47:45Security in SDLC
- 49:10Q&A
related talks
26mStranger Danger: Your Attack Surface Just Got Bigger
46mLive hacking: Breaking into your Java web app
48mThe Hidden Security Hazards in Your Java Stack
01h 06mLive hacking: Breaking into your Java web app
56mThe Anatomy of Java Vulnerabilities
40mLive hacking: Breaking into your web app
52mDevSecOps
43mLive hacking: Breaking into your Java web app