Secure Your Code — Injections and Logging
summary
Shows a deliberately vulnerable web app and proves classic SQL injection works by logging in with "' OR 1=1 --", then uses sqlmap to enumerate columns and run stacked queries that insert rows. Adds central Elastic Stack logging to live‑stream attacks and notes average breach detection is ~200 days. Deploys mod_security WAF in front, which returns 403 for blocked payloads and logs matching rule IDs in JSON for easier alerting and analysis.
AI-written summary · about
chapters (9)
- 0:00Security is everyone's problem
- 1:48Introducing the demo app
- 3:18SQL injection explained
- 5:26Exploiting the vulnerable app
- 8:59Client-side XSS risks
- 9:41Logging and monitoring basics
- 12:14Protecting with ModSecurity
- 16:53ModSecurity log analysis
- 19:05Key takeaways and fixes
related talks
50mHands-On ModSecurity and Logging
35mHands-On ModSecurity and Logging
22mIntegrating Security Measures Throughout Development
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
22mLive Hacking Session Part 2
55mWeb Application Security: Winning When The Odds Are Against You
52mHow to get properly hacked!
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application