Warning Ahead: Security Storms Brewing in JavaScript
Explore JavaScript vulnerabilities, including unique issues, third-party platform exploits, and HTML5 security concerns. Learn about emerging threats and their impact on enterprise security.
Hacking the Oracle Application Framework - Deep-Dive Penetration Testing Techniques
Explore deep-dive penetration testing techniques for complex enterprise applications, using Oracle Application Framework as a case study. Learn about static reverse engineering, mock environments, and dynamic monitoring.
Client-side Security with the Security Header Injection Module (SHIM)
Learn about client-side security headers and a new open-source tool for ASP.NET to mitigate vulnerabilities by setting security headers in web applications.
iOS App Integrity: Enhancing Security with Encrypted Code Modules
Explore iOS app security vulnerabilities and learn advanced protection techniques like Encrypted Code Modules (ECM) to safeguard against static analysis, binary patching, and other common attacks.
Modern Web Application Defense with OWASP Tools
Learn to defend web applications using OWASP tools. Explore XSS, CSRF, and other vulnerabilities through live demos. Gain practical skills to prevent attacks and secure your applications effectively.
Improving Penetration Testing Efficiency with OWASP Code Pulse and Attack Surface Detector
Explore OWASP tools for efficient web app penetration testing: Code Pulse for real-time code coverage and Attack Surface Detector for comprehensive endpoint discovery, enhancing security assessment capabilities.
Dependency-Track: Intelligent Software Composition Analysis Platform
Explore Dependency-Track, an intelligent SCA platform for identifying and reducing risks from third-party components. Learn about its bill-of-material approach and automation options for continuous component analysis.
ZAP Heads Up Display - Introduction and Demo
Explore OWASP ZAP's new Heads Up Display feature for automated web application security testing. Learn about its capabilities, demo, hidden fields, attack modes, and integration with browser APIs.
Serverless Infections - Malware in Serverless Computing Environments
Explore security risks in serverless computing, including potential malware infections and data exfiltration. Learn about a novel RCE attack and best practices for securing serverless environments.
Novel Exploitation Techniques in WordPress - Prepared Statements and Object Injection
Explore novel WordPress exploitation techniques, focusing on a core design flaw leading to SQL injection and PHP object injection vulnerabilities. Learn prevention strategies for developers.
Building a Security Test Automation Framework
Learn best practices for building a security test automation framework using Docker, Kubernetes, and Defect Dojo. Discover how to manage vulnerabilities, prevent key sprawl, and implement security tooling in CI/CD pipelines.
Android App Protection Techniques: Obfuscation, Packing, and Protection - APPSEC Cali 2018
Explore Android app protection techniques, including obfuscation, packing, and protection. Learn to analyze and counter these methods to identify potential malware and enhance app security.
Architecting for Security in the Cloud
Explore cloud security architecture, identifying vulnerabilities, and implementing robust defenses. Learn strategies to protect your applications from various attack vectors and ensure scalable, secure cloud deployments.
Navigating the Security Landscape of a Cloud-First World
Navigating cloud security challenges: shared responsibility, data protection, and enterprise ownership in the era of rapid cloud adoption. Strategies for maintaining security in cloud migrations.
Supply Chain Anarchy - Trojaned Binaries in the Java Ecosystem
Explore the security risks of third-party code in Java applications, focusing on potential discrepancies between source code and binaries. Learn about an automated security pipeline for detecting malicious differences.
Top 10 Security Best Practices for Securing Microservices
Comprehensive guide to securing microservices, covering TLS, authentication, authorization, DDoS protection, monitoring, encryption, and more. Essential for developers and architects building scalable, secure APIs.
Leveraging the ASVS in the Secure Software Development Lifecycle
Integrating OWASP ASVS into the secure software development lifecycle to create uniform security requirements, prioritize tasks, and track adherence across applications using existing tools and processes.
How to Spend $3.6 Million on One Coding Mistake - OWASP BeNeLux Day
Explore infamous data breaches, their technical vulnerabilities, and preventive coding solutions. Learn practical techniques to enhance application security and avoid costly mistakes in your development process.
OAuth and Mandatory Access Control: Beyond Discretionary Access Control - Lecture 4
Explores OAuth's limitations in mandatory access control, discussing industry extensions and the need for standardization beyond RBAC for comprehensive security policy enforcement.
Secure Software Development Framework: Towards an SDL for All SDLCs
Proposes a flexible Secure Software Development Framework adaptable to various development methodologies, enhancing security while maintaining efficiency and ease of adoption for developers and architects.
Juice Shop - OWASP's Most Broken Flagship
Explore OWASP's intentionally vulnerable web application, learn about its features, and discover how it can enhance your web security skills through hands-on hacking challenges.