Web2 Meets Web3: Hacking Decentralized Applications
Real-world attack vectors, threat modeling techniques, and vulnerability case studies for penetration testing decentralized Web3 applications.
Summary
Architecture and Attack Surface of Dapps
Decentralized applications (Dapps) combine conventional Web2 frontend and backend components with blockchain-based smart contracts. This hybrid architecture introduces unique security challenges that span both traditional application weaknesses and blockchain-specific attack vectors.
Threat Modeling and Vulnerability Case Studies
Threat modeling for Dapps requires evaluating the trust boundaries between off-chain Web2 interfaces and on-chain state. Real-world vulnerability case studies demonstrate how attackers exploit flaws in Dapp integration points, access control, and transaction workflows.
Related talks
App Sec Village·32 min
Paulo Silva · David Sopas
Vulnerability chaining and web application research uncovering flaws across eleven major automotive manufacturers.
App Sec Village·25 min
Jen Ozmen · Aaron Shim
Google's engineering blueprint for eliminating cross-site scripting at scale using compile-time and runtime frontend protections.
App Sec Village·29 min
Ian Hickey
Exploits URL path handling differentials to turn trusted websites into malware delivery platforms using Relative Path File Injection.