Hacking Web Apps
David Rhoades - Hacking Web Apps Hacking Web Apps WARNING: The vulnerabilities you are about to see are real.
Summary
Architecture and Background
David Rhoades - Hacking Web Apps Hacking Web Apps WARNING: The vulnerabilities you are about to see are real. Only the names have been changed to protect the vulnerable. Viewer discretion is advised. Is your web application secure?
Vulnerability Analysis
Many have found out the hard way: encryption and firewalls are not enough. a Since 1996 the instructor has performed security assessments against web-based applications for Fortune 500 companies. The applications audited included consumer banking (US, Europe, and Asia), business banking, credit unions, conference & travel reservation systems, credit card applications & account access, 401K account access, stock broker transactions, and consumer telephone account access. What were the real-world vulnerabilities encountered?
Exploitation and Demonstrations
Come see for yourself as this fast paced course re-enacts these hacks. See what the weaknesses were and how they were exploited. If Fortune 500 companies made these mistakes, chances are good that they are not alone. The lessons learned will apply to web portals, e-commerce (B2B or B2C), online banking, shopping, subscription-based services, or any web-enable application.
Remediation and Defensive Strategies
* Watch how attackers manipulate HTTP and HTML to locate web app vulnerabilities * See the latest hacker tools and techniques for web apps * Demo: Real-world web app weaknesses and exploits will be demonstrated live * The vulnerabilities demonstrated will be based on real vulnerabilities seen by the instructor while auditing customers &Mac246; only the names have been changed to protect the vulnerable. * This presentation offers valuable insight into some subtle but serious dangers for online applications David Rhoades is a principal consultant with Maven Security Consulting Inc. (www.mavensecurity.com), which is headquartered outside Washington DC and provides information security assurance and training services. David started his career in 1995 with Bell Communications Research (Bellcore), working in their Computer Security & Telephony Fraud Group. His work has taken him across the US and abroad to Europe and Asia where he has lectured and consulted in various areas of information security. David has a BS in Computer Engineering from the Pennsylvania State University and has taught security courses for USENIX, the SANS Institute, and the MIS Training Institute.
Related talks
Main Stage·48 min
Daniel Roelker
Daniel Roelker - HTTP IDS Evasions Revisited HTTP IDS Evasions Revisited HTTP IDS evasions have been prevalent ever since the release of RFP's whisker.
Main Stage·35 min
Vangelis Stykas
Vangelis Stykas demonstrates how typical web application flaws in abandoned malware C2 infrastructure allow researchers to compromise admin panels and identify threat actors.
Main Stage·36 min
regilero
regilero demystifies HTTP request smuggling techniques, illustrating how desynchronizing reverse proxies and backend web servers leads to cache poisoning and filter bypasses.