Hacking Like a FED

on YouTube ↗25m

" summary

Automated CI hooks run end-to-end tests through a proxy and three scanners so code changes fail the build when vulnerabilities appear. Scanning a vulnerable Juice Shop instance finds a persistent XSS via a compromised sanitize package that Snyk flags and fixes with a Snyk auto-fix PR. Dynamic testing exposes a CSRF that silently changes usernames and static analysis flags a NoSQL injection in track order code. Fixes include SameSite cookies or anti CSRF tokens input sanitization and upgrading vulnerable dependencies.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 5:42Dynamic Analysis Security Testing
3. 10:43Cross Site Request Forgery (CSRF)
4. 13:29Static Analysis Security Testing

" related talks

• 40mSecuring your dependenciesNina Juliadotter · NDC Sydney 2018
• 58mOpen Source Pentesting and Security Analysis Tools: the DevOps wayChristian Nils Schneider · DevOpsCon Spring 2019
• 39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...Marine Du Mesnil · Devoxx France 2024
• 21mHow to hack an Angular app?Asim Hussain · NGConf 2018
• 23mStopping vulnerabilities at the sourcePavel Avgustinov, Grey Baker · GitHub Satellite Virtual 2020
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 24mFlagship Projects: Juice ShopBjörn Kimminich · OWASP 20th Anniversary 2021