Web Framework Vulnerabilties - Abraham Kang

[Nytro]

[h=1]Web Framework Vulnerabilties - Abraham Kang[/h]

from OWASP AppSec USA PRO 8 months ago not yet rated

Title: Web Framework Vulnerabilities

Abstract

This talk will give participants an opportunity to practically code review Web Application Framework based applications for security vulnerabilities. The material in this talk covers the common vulnerability anti-patterns which show up in applications built on the most popular enterprise web application frameworks (Struts 2, Spring MVC, Ruby on Rails, and .NET MVC). Sample applications are provided with guided tasks to ease participants into understanding the vulnerabilities in each framework and the overall steps a code reviewer should follow to identify these vulnerabilities. This talk is trimmed down version of the 3 hour workshop given at Blackhat. This is an advanced talk and an understand of the application frameworks is a prerequisite to get the most out of this talk.

*****

Speaker: Abraham Kang, Principal Security Researcher, HP Fortify

Abraham Kang is fascinated with the nuanced details associated with programming languages and their associated APIs in terms of how they affect security. Abraham has a Bachelor of Science from Cornell University. Abraham currently works for HP Fortify as a Principal Security Researcher. Prior to joining Fortify, Abraham worked with application security for over 10 years with the most recent 4 years being a security code reviewer at Wells Fargo. Abraham is focused on application, framework, and mobile security and presented his findings at Blackhat USA, BSIDES, OWASP, Baythreat and HP Protect.

*****

Date: Friday October 26, 2012 3:00pm - 3:45pm

Location: AppSecUSA, Austin, TX. Hyatt Regency Hotel.

Track: Attack

Sursa: Web Framework Vulnerabilties - Abraham Kang on Vimeo