From DTD to XXE - An Evaluation of XML Parsers
Comprehensive evaluation of XML parsers, exploring vulnerabilities from DTD to XXE attacks. Gain insights into secure XML parsing and learn to mitigate potential security risks.
From Facepalm to Brain Bender - Advanced Web Security Challenges
Explore web security challenges, from basic vulnerabilities to complex exploits, with insights from industry experts on detection, prevention, and mitigation strategies.
Building Secure Cloud-Native Applications with Spring Boot and Spring
Learn to build secure cloud-native applications using Spring Boot and Spring, focusing on best practices and techniques for robust, scalable, and protected software development.
Systematically Breaking and Fixing OpenID Connect
Explore systematic vulnerabilities and fixes in OpenID Connect, covering attack types, threat models, and countermeasures for improved authentication security.
Detecting and Managing Bot Activity More Efficiently
Explore efficient bot detection techniques, categorization methods, and response strategies to manage both beneficial and potentially harmful automated web traffic.
Building Your Own Large Scale Web Security Scanning Infrastructure
Learn to build, scale, and integrate a robust web security scanning infrastructure into your continuous delivery pipeline, with insights on customization and comparisons to existing solutions.
OWASP ZAP - More Advanced Features
Explore advanced features of OWASP ZAP, a powerful open-source web application security testing tool, with insights from Simon Bennetts at AppSecEU 2015 in Amsterdam.
Abusing JSONP With Rosetta Flash - AppSec EU 2015
Explore JSONP vulnerabilities and the Rosetta Flash exploit technique in this cybersecurity talk, uncovering potential risks and defense strategies for web applications.
The API Assessment Primer
Learn essential API security assessment techniques, including key considerations, testing steps, and best practices for protecting APIs and mobile applications from common vulnerabilities and threats.
Web Service Workers - Breaking the Web: Exploiting a Cool Feature
Explore Web Service Workers' potential to disrupt web security, examining innovative uses and potential vulnerabilities in this cutting-edge browser feature.
Calm Down: HTTPS Is Not a VPN
Explore HTTPS limitations, privacy concerns, and security implications in web communications. Learn about packet capture, fingerprinting, and potential vulnerabilities in encrypted connections.
Scanning with Swagger - Using the Open API Specification to Find Vulnerabilities
Explore leveraging Open API specification for enhanced security scanning, uncovering vulnerabilities and improving application protection strategies.
The Timing Attacks They Are A-Changin' - Web-based and Browser-based Timing Attack Techniques
Explore evolving timing attacks in web security, from classic cross-site techniques to browser-based methods, and learn effective mitigation strategies.
Skillful, Scalable Full-Stack Security in a State of Constant Flux
Approaches to maintaining secure full-stack posture at scale in changing environments. Discusses automation vs. human testing, analytics in continuous security, and scaling with human validation and intelligence.
15 Years of Web Security - The Rebellious Teenage Years
Explore web security's evolution, challenges, and future trends with insights on threat modeling, vulnerability data, and emerging solutions like cyber insurance and security guarantees.
Adaptive Testing Methodology: Crowdsourced Testing for Customized Target Stack
Discover an efficient, customizable pentesting methodology that adapts to specific technology stacks and time constraints, improving consistency and effectiveness in vulnerability detection.
OCSP Stapling in the Wild - Lecture
Explore OCSP stapling in the wild with experts Devdatta Akhawe and Emily Stark. Learn about TLS security, browser implementations, and real-world challenges in HTTPS ecosystems.
CSP - The Good, the Bad and the Ugly
Explore Content Security Policy's strengths and weaknesses in web application security, presented by Shape Security's engineering manager Ilya Nesterov at APPSEC CA 2017.
Uninvited Guests on the World's Wild Web: Understanding Malicious Web Bots
Explore malicious web bots and automated threats to web applications with insights from the OWASP Handbook. Learn to understand, identify, and mitigate these digital risks in today's wild web landscape.
Dissecting Browser Privacy
Explore browser privacy with a senior security engineer from Brave, covering key issues and advancements in protecting user data while browsing the web.
HTTPS and TLS Security Practices - Front Line Insights 2016
Comprehensive overview of modern HTTPS and TLS security practices, covering protocol vulnerabilities, certificate fundamentals, and best practices for implementing strong encryption in web services.