The Anatomy of Java Vulnerabilities
summary
Java vulnerabilities often boil down to tiny bugs that become huge in practice: a malformed floating-point value causing an double-to-infinite-loop DoS that affected many web servers, an Apache Struts content-type error that triggers Struts OGNL remote code execution (Equifax breach), and widespread deserialization gadget chains in libraries like Apache Commons. The talk demonstrates using public resources and tools—CVE/NVD, Shodan, Exploit-DB, GitHub searches and Wappalyzer-like plugins—to find exploits, shows time-to-exploit shrinking to days, and urges keeping JVMs and dependencies patched and validating all untrusted data.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:40Steves background
- 2:33Double pals
- 4:28Floating numbers
- 5:42Missing error code
- 8:46Deserialization
- 11:36Exploit
- 12:42Vulnerabilities
- 14:50CVA
- 17:23Assessment
- 20:27Assess
- 23:05Attack vectors
- 24:59Un untrusted code
- 26:10Cryptography
- 32:38Social engineering
- 34:54How to trust
- 37:13Why should you care
- 39:42Drug trade vs cybercrime
- 41:29Finding a server with a vulnerability
- 45:40The tools
- 47:13Its getting worse
- 50:23What else can you do
- 51:48Summary
related talks
49mThe Anatomy of Java Vulnerabilities
46mThe Anatomy of Java Vulnerabilities
46mLive hacking: Breaking into your Java web app
50mStranger Danger: Your Java Attack Surface Just Got Bigger
19mHow a vulnerability hack may happen and how to prevent it
01h 06mLive hacking: Breaking into your Java web app
48mCommon vulnerabilities you wish your Java app didn't have!
43mLive hacking: Breaking into your Java web app