What are we missing in web applications? - Mirza Burhan Baig (ZeroDayLab) | CRESTCon UK
Analyzes what are teams missing in web applications? - Mirza Burhan Baig (ZeroDayLab) | CRESTCon UK and evaluates key implications for security practitioners.
Summary
Speaker and scope
Mirza Burhan Baig (Zero Day Lab) blends web/mobile pentesting and red teaming to argue that scanners and patched OWASP Top 10 issues leave a major gap: business logic flaws.
OWASP shift
In the 2021 Top 10, broken authentication rose to A1 while injection dropped to A3, reflecting frameworks, plugins, and browsers mitigating classic vulns like SQLi and XSS.
Scanner limits
Tools such as IBM AppScan and Netsparker miss logic flaws that require understanding application workflow, not just syntax or payloads.
Logic flaws defined
Attackers skip or reorder intended steps (e.g., 1→3→4), enabling IDOR and privilege abuse when developers secure tokens and input validation but neglect authorization and workflow rules.
Real-world stakes
High-impact cases like the Bangladesh Bank/Lazarus heist show how logic and process failures, not just injection, drive major breaches.
Related talks
leHACK·36 min
Presents 🇬🇧 WHAT ARE teams MISSING IN WEB APPLICATIONS and evaluates key implications for security practitioners.
CRESTCon·27 min
Evaluates what Red Teamers should know about Blue Team Optics - Dimitrios Bougioukas (Hack The Box) and evaluates key implications for security practitioners.
CRESTCon·30 min
John Fitzpatrick (CTO · JUMPSEC) | CRESTCon UK presentation
Reviews succeeding at cybersecurity and evaluates key implications for security practitioners.