App Sec Village·27 min
Avi Lumelsky · Gal Elbaz
Unveils the 0.0.0.0-day vulnerability in major browsers that lets public websites pivot to internal localhost APIs and achieve RCE.
0-0-0-0-daybrowser-securityremote-code-execution+2
DEF CON 32/App Sec Village across years
App Sec Village DC32
Las Vegas Convention Center · 8-11 August 2024 · 23 talks
DEF CON 32 App Sec Village focuses on application security, secure software development, and modern API and cloud vulnerabilities. The talks cover topics ranging from CI/CD pipeline exploitation and LLM application security to frontend defenses and vulnerability management.
1–23 of 23 talks
App Sec Village·18 min
Aleise McGowan · Tennisha Martin
Examines ransomware attacks against casino giants like MGM and Caesars, highlighting application vulnerabilities and ICT and IoT security challenges.
ransomwareiotincident-analysis+1
App Sec Village·33 min
Ravid Mazon · Jay Chen
Automated detection of Broken Object Level Authorization (BOLA) vulnerabilities across web APIs using LLMs in BOLABuster.
bolaapi-securityllm+2
App Sec Village·18 min
Wang Zhilong · Xinzhi Luo
Analysis of when and why large language models hallucinate during automated code review, and how misleading identifier names induce errors.
llmaicode-review+1
App Sec Village·13 min
Spyros Gasteratos · Andra Lezza
Spyros Gasteratos and Andra Lezza explore strategies for integrating security into the product development lifecycle through threat modeling, OWASP Cornucopia, and collaborative developer workflows.
threat-modelingsecure-developmentowasp+1
App Sec Village·29 min
Ben Dechrai
Implementing scalable fine-grained authorization using Relationship-Based Access Control (ReBAC) without hardcoded business logic.
access-controlrebacauthorization+2
App Sec Village·31 min
Chloé Messdaghi · Kasimir Schulz
Navigating the complexities of responsible vulnerability disclosure, data bias, and model manipulation in AI systems.
ai-policyresponsible-disclosureprompt-injection+2
App Sec Village·29 min
Vangelis Stykas
How API vulnerabilities in EV chargers and solar inverters create systemic risks for power grid infrastructure.
critical-infrastructureics-otv2g+2
App Sec Village·21 min
niks · Charles Waterhouse
Reconnaissance and vulnerability discovery across enterprise banking software used by major financial institutions worldwide.
bankingbug-bountyaccess-control-bypass+2
App Sec Village·27 min
Javan Rasokat · Andra Lezza
Practical insights and defensive strategies from real-world development and hardening of production LLM applications.
llmaiprompt-injection+2
App Sec Village·28 min
SheHacksPurple
A practical three-tier maturity model for evolving application security programs beyond intimidating compliance frameworks.
methodologysecurity-controlsrisk-assessment+1
App Sec Village·27 min
punkcoder
Practical strategies for solo AppSec engineers navigating burnout, team layoffs, and expanding threat landscapes.
workforceburnoutculture+2
App Sec Village·29 min
Ian Hickey
Exploits URL path handling differentials to turn trusted websites into malware delivery platforms using Relative Path File Injection.
rpowebpolyglot+2
App Sec Village·25 min
Jen Ozmen · Aaron Shim
Google's engineering blueprint for eliminating cross-site scripting at scale using compile-time and runtime frontend protections.
xsswebmitigations+1
App Sec Village·32 min
Paulo Silva · David Sopas
Vulnerability chaining and web application research uncovering flaws across eleven major automotive manufacturers.
automotivewebvulnerability-research+2
App Sec Village·33 min
Jason Haddix
Unvarnished perspective on the systemic friction, triage dynamics, and economic realities of commercial bug bounty platforms.
bug-bountycultureresponsible-disclosure+2
App Sec Village·26 min
Michelle Eggers
Architecture, operational role, and defensive controls for securing modern enterprise mainframe environments supporting mission-critical banking.
mainframelegacyinfrastructure+2
App Sec Village·31 min
Cassie Crossley
How Schneider Electric generates, stores, and operationalizes thousands of product SBOMs to accelerate CERT incident response.
sbomsupply-chainvulnerability-management+1
App Sec Village·25 min
Iggy
Exploration of time-based blind SQL injection techniques and data extraction strategies through the lens of Operation GhostShell.
sql-injectiontiming-attacksdatabase+2
App Sec Village·45 min
Kunal Bhattacharya
Modernizing application security programs to protect infrastructure-as-code, secrets, and emerging cloud and AI technology stacks.
iacsecrets-detectioncloud+2
App Sec Village·25 min
Jerry Gamblin
How the Exploit Prediction Scoring System (EPSS) uses threat data and probability modeling to prioritize patching across pipelines and systems.
epssci-cdrisk-assessment+2
App Sec Village·24 min
Peiyu Wang
Real-world attack vectors, threat modeling techniques, and vulnerability case studies for penetration testing decentralized Web3 applications.
web3dappsthreat-modeling+2
App Sec Village·26 min
Elad Pticha · Oreen Livni
Demonstrates a command injection vulnerability in the Bazel GitHub Action that allowed malicious tampering in Google's build pipeline.
ci-cdgithub-actionsbazel+2