OWASP for dummies

In this presentation, we are going to dig into the inner workings of the most common 3 OWASP web vulnerabilities. We are going to see attack vectors such as XSS, exploiting components with known vulnerabilities and silly security misconfigurations.

Transcript

1. OWASP FOR DUMMIES
2. Lucian Petri
6. Hacking ( Shhh… )
8. Disclaimer •Prezentarea va fi foarte serioasă cu 0 sarcasm și ironie •Nu vă voi arăta live hacking •Nici un calculator nu va fi rănit în procesul acestei demonstrări •Eu nu sunt responsabil pentru orice vei face cu ce ai învățat aici și… blablabla •Limba pe care o voi folosi în prezentare va fi faimoasa Romengleza ( I’m lying ) ( I’m not lying ) ( hope so... )
10. SQL Injection Broken Authentication Sensitive Data Exposure XML External Entities Broken Access Control Security Misconfiguration Cross-Site Scripting Using Components With Known Vulnerabilities Insufficient Logging And Monitoring
11. Javascript won!
15. Back in the old days VS Today’s days Code is vulnerable? Your fault. You could have air tight security More effort = More readable code App vulnerable? Check yo modules! You can never know quickly enough Frameworks do your job
16. LET’S START H4CK1NG! <3
17. Q & A Time!
18. Links for help •https://github.com/LucianPetri/goof •http://dreamerslab.com/blog/en/write-a-todo-list-with-express-and- mongodb/ •https://snyk.io/vuln/npm:mongoose:20160116 •https://snyk.io/vuln/npm:st:20140206 •https://snyk.io/vuln/npm:marked:20150520