Application Security: What you don't know can hurt you - PrairieDevCon 2015

Application Security What you don't know can hurt you Joe
Kuemerle www.kuemerle.com @jkuemerle

@jkuemerle / www.kuemerle.com Joe Kuemerle • Over 15 years of
development experience with a broad range of technologies • Focused on application and data security, coding best practices and regulatory compliance • Presenter at community, regional and national events.

@jkuemerle / www.kuemerle.com Source: Web Hacking Incident Database http://tinyurl.com/AppAttackStats

@jkuemerle / www.kuemerle.com How did Mr. Boddy get hacked?

@jkuemerle / www.kuemerle.com http://www.veracode.com/resources/state-of-software-security

@jkuemerle / www.kuemerle.com

@jkuemerle / www.kuemerle.com db.myCollection.find( { $where: function() { return obj.credits
- obj.debits < 0; } } ); db.myCollection.find( { active: true, $where: function() { return obj.credits - obj.debits < $userInput; } } );;

@jkuemerle / www.kuemerle.com https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet http://wpl.codeplex.com

@jkuemerle / www.kuemerle.com http://www.itnews.com.au/News/398892,delta-site-flaw-lets-passengers-access-other-boarding-passes.aspx

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/kidicarus222/213956096

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/somegeekintn/3709203268

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/kmagoon/3793038515

@jkuemerle / www.kuemerle.com Injection https://www.owasp.org/index.php/Top_10_2013-Top_10 Broken Authentication and Session Management
Cross Site Scripting (XSS) Insecure Direct Object Reference Security Misconfiguration Sensitive Data Exposure Missing Function Level Access Control Cross-Site Request Forgery Components With Known Vulnerabilities Unvalidated Redirects And Forwards

@jkuemerle / www.kuemerle.com https://www.owasp.org/index.php/OWASP_Mobile_Security_Project

@jkuemerle / www.kuemerle.com https://github.com/skylot/jadx

@jkuemerle / www.kuemerle.com Spoofing Tampering Repudiation Information Disclosure Denial of
Service Elevation of Privilege

@jkuemerle / www.kuemerle.com Photo Credits • http://www.flickr.com/photos/pcoin/4629410478 • http://www.flickr.com/photos/ekreitschmann/3296628124 •
http://www.flickr.com/photos/quinnanya/3333961881 • http://www.flickr.com/photos/pcambra/3347911070 • http://www.flickr.com/photos/superamit/2491512156 • http://www.flickr.com/photos/terrio/5710831966 • http://www.flickr.com/photos/cliffnordman/6131349171 • http://www.flickr.com/photos/suckamc/4075609940 • http://www.flickr.com/photos/alan-light/211186811 • http://www.flickr.com/photos/marksteele/3766525250 • http://www.flickr.com/photos/petithiboux/4062233946 • http://www.flickr.com/photos/theevilmightyf/1496413769 • http://www.flickr.com/photos/cookylamoo/5059188603 • http://www.flickr.com/photos/phploveme/2911722148

@jkuemerle / www.kuemerle.com http://speakerrate.com/jkuemerle

@jkuemerle / www.kuemerle.com References • http://www.troyhunt.com o http://www.troyhunt.com/2011/12/free-ebook-owasp-top-10-for-net.html • http://www.owasp.org
o http://www.youtube.com/user/AppsecTutorialSeries?feature=watch • http://www.microsoft.com/security/sdl/default.aspx • http://blogs.msdn.com/b/sdl • http://bsimm.com • http://www.amazon.com/Writing-Secure-Second- Michael-Howard/dp/0735617228 • http://www.nosqlmap.net/index.html • http://www.veracode.com/resources/state-of- software-security

@jkuemerle / www.kuemerle.com Tools • http://wpl.codeplex.com • https://www.kali.org/ • http://blogs.microsoft.com/cybertrust/2014/04/15/in
troducing-microsoft-threat-modeling-tool-2014/ (Threat Model designer) • http://www.microsoft.com/download/en/details.as px?displaylang=en&id=21769 (File fuzzer) • WebGoat.NET o https://github.com/sempf/WebGoat.NET o https://github.com/jkuemerle/WebGoat.NET

Application Security: What you don't know can h...

Application Security: What you don't know can hurt you - PrairieDevCon 2015

More Decks by Joe Kuemerle

Other Decks in Programming

Featured

Transcript