https://wiki.owasp.org/index.php?action=history&feed=atom&title=AppSecLatam2012%2FTraining%2FJava_Secure_Coding 2026-05-01T09:53:22Z Revision history for this page on the wiki MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=AppSecLatam2012/Training/Java_Secure_Coding&diff=136101&oldid=prev 2012-09-18T22:52:32Z

<p>Created page with &quot;=AppSec Latam 2012 Training: Java Secure Coding= &#039;&#039;&#039;Course Length: 2 Day&#039;&#039;&#039;&lt;br&gt; Training Audience: Technical&lt;br&gt; Required Skill Level: Intermediate&lt;br&gt; ==Course Description=...&quot;</p> <p><b>New page</b></p><div>=AppSec Latam 2012 Training: Java Secure Coding=<br /> '''Course Length: 2 Day'''&lt;br&gt;<br /> Training Audience: Technical&lt;br&gt;<br /> Required Skill Level: Intermediate&lt;br&gt;<br /> <br /> <br /> ==Course Description==<br /> In this class we discuss secure coding techniques using Java. It is a very hands-on course with many labs. Everything is done from a developers perspective, NOT a hackers perspective. We make an effort to show what to do, and avoid the usual security paradigm of only discussing what not to do. <br /> <br /> The course covers input validation, authentication, authorization, session management, databases, output encoding, error handling, logging, file handling, file uploading, and cryptography.<br /> <br /> <br /> The class is hands-on and will include labs. Attendees should have a laptop capable of running VMs. We will provide a VM at the beginning of the class.<br /> <br /> <br /> ==Instructor Bio==<br /> Instructor: Ari Elias-Bachrach, [http://www.appsec-labs.com Appsec Labs]&lt;br&gt;<br /> Twitter: @angelofsecurity<br /> <br /> <br /> <br /> <br /> == Course Outline==<br /> <br /> 1. Intro to class<br /> a. Goals for class<br /> b. Agenda<br /> c. Intro to security<br /> d. integrating security into the SDLC<br /> <br /> 2. Input validation<br /> a. Why needed (cmd injection, xss, sql injection, logic errors, etc.)<br /> b. When needed (any time there’s input. Everything is input)<br /> c. Where done (Client = bad, server = good)<br /> d. Whitelist vs blacklist<br /> e. How to do regex<br /> f. Canonicalization<br /> g. Other ways to validate – length, range<br /> h. ESAPI<br /> <br /> 3. Authentication<br /> a. Definition and explanation<br /> b. The three factors of authentication – what they are and examples of each<br /> c. Types of auth: basic, digest, client cert, windows, forms based<br /> d. Securing the passwords (hash, salt, HMAC)<br /> e. Brute force<br /> f. Anti-automation<br /> g. Revealing usernames<br /> <br /> 4. Authorization<br /> a. Definition and explanation<br /> b. ACL<br /> c. secure by URL<br /> d. secure at service layer<br /> <br /> 5. Session Management<br /> a. Maintaining session state<br /> b. What not do <br /> c. Java session management with JSESSIONID <br /> d. Cookie security<br /> e. Session fixation<br /> <br /> 6. How to deal with databases<br /> a. Why needed (SQLi) <br /> b. Parameterized queries<br /> c. Stored procedures<br /> d. Connection strings – how to store them<br /> f. Permissions<br /> g. Other misc tips<br /> <br /> 7. Output encoding<br /> a. Intro to XSS<br /> b. Demo something more dangerous – change action of form or steal JSESSIONID<br /> c. HTML encode<br /> d. Other encoding contexts<br /> e. ESAPI encoding<br /> f. ESAPI demo<br /> <br /> 8. Error handling<br /> a. Info disclosed during error handling<br /> b. Custom error messages<br /> <br /> 9. Logging/auditing<br /> a. Importance of logging<br /> b. Logging technologies (log4j)<br /> c. Events to log<br /> d. Data NOT to log<br /> <br /> 10. File handling<br /> a. Directory traversal<br /> b. Canonicalization<br /> c. File extension handling – backup file (.old .bck, etc.)<br /> d. Directory listing<br /> <br /> 11. File uploads<br /> a. Threats<br /> b. Whitelist file types<br /> c. Convert file types (to drop executable code/virus)<br /> d. Limit number of uploads &amp; file sizes and who can do them<br /> e. File storage<br /> <br /> 12. Data confidentiality and integrity<br /> a. Threats to Data<br /> b. Crypto<br /> c. JCE – Java crypto architecture<br /> d. Hash Functions &amp; salt<br /> e. Digital signatures<br /> f. SSL</div>

Sarah Baso