Главная
Study mode:
on
1
Intro
2
Vanessa Sauter
3
Travis McCormack
4
Why does method matter
5
Web Apps
6
About the Research
7
Web App Vulnerabilities
8
Machine Wins
9
Manual Setup
10
Vulnerabilities
11
Uber Bug Bounty
12
Why write weak enforcement of workflows
13
CashMoney example
14
Race conditions
15
Chain exploits
16
Humans and Machines
17
Case Study
18
Debate
Description:
Explore the intricacies of distinguishing between human-discovered and machine-detected web application vulnerabilities in this 25-minute conference talk from BSidesSF 2020. Delve into Vanessa Sauter's presentation, which draws inspiration from the Voight-Kampff test to create a filtering system for vulnerability discoveries. Learn about the importance of identifying discovery methods, the strengths of automated scanners, and the unique value of human expertise in cybersecurity. Examine case studies, including insights from Uber's bug bounty program, and understand the nuances of various vulnerability types such as weak workflow enforcement, race conditions, and chained exploits. Engage in a thought-provoking debate on the roles of humans and machines in the ever-evolving landscape of web application security.

The Voight-Kampff Test for Discovering Web Application Vulnerabilities

Security BSides San Francisco
Add to list