BeNeLux OWASP Day 2013 - Revision history

Knoblochmartin: added download link to presentation Jerome

2013-12-12T10:48:07Z

added download link to presentation Jerome

Favroom: /* Title, by Dick Berlijn */

2013-12-03T16:00:36Z

‎Title, by Dick Berlijn

Favroom: /* Title, by Dick Berlijn */

2013-12-03T15:59:41Z

‎Title, by Dick Berlijn

Knoblochmartin: added presentation of Tom van Goethem

2013-12-03T13:25:58Z

added presentation of Tom van Goethem

Knoblochmartin: added pdf of the opening, Migchiel de Jong and Victor van der Veen

2013-12-02T16:34:58Z

added pdf of the opening, Migchiel de Jong and Victor van der Veen

Knoblochmartin: presentations uploaded and link added for NIck, Alexois and Jan.

2013-12-01T18:35:25Z

presentations uploaded and link added for NIck, Alexois and Jan.

Sdeleersnyder: /* Agenda */

2013-12-01T08:53:28Z

‎Agenda

Knoblochmartin: /* Agenda */

2013-11-29T00:47:26Z

‎Agenda

Dm-17: /* Social Event, November 28th */

2013-11-27T16:34:42Z

‎Social Event, November 28th

Dm-17: /* Social Event, November 28th */

2013-11-27T15:33:21Z

‎Social Event, November 28th

@@ Line 183: / Line 183: @@
 | colspan="2" style="text-align: center;background: grey; color: white" | ''Break''
 |-
-| 16h30 - 17h10 || [[#JeromeNokin|Jerome Nokin]] || '''Turning your managed Anti-Virus into my botnet'''
+| 16h30 - 17h10 || [[#JeromeNokin|Jerome Nokin]] || '''[http://funoverip.net/wp-content/uploads/2013/12/Turning-your-managed-AV-into-my-botnet_OWASP2013_Nokin-Jerome_v1.1.pdf Turning your managed Anti-Virus into my botnet]'''
 |-
 | 17h10 - 17h50 || [[#VictorvanderVeen|Victor van der Veen]] || '''[[Media:TraceDroid.pdf | TraceDroid: A Fast and Complete Android Method Tracer]]'''
@@ Line 283: / Line 283: @@
 Particular focus will be given to the different steps required to analyze both protocols and management functionality and covers reverse-engineering, debugging and the creation of fuzzing tools. Who does not want to transform a major managed AV into his private botnet within minutes?
 <br>
 <br>
 ''Bio:''<br>

@@ Line 234: / Line 234: @@
 === Title, by Dick Berlijn ===
 ''Abstract:''<br>
 <br>
 <br>
@@ Line 240: / Line 241: @@
 <br>
 <br>
-[http://www.youtube.com/watch?feature=player_embedded&v=l_XOrcBxy-E Link to the movie on YouTube]
 <div id="MigchieldeJong"></div>

@@ Line 240: / Line 240: @@
 <br>
 <br>
+[http://www.youtube.com/watch?feature=player_embedded&v=l_XOrcBxy-E Link to the movie on YouTube]
 <div id="MigchieldeJong"></div>

@@ Line 167: / Line 167: @@
 | colspan="2" style="text-align: center;background: grey; color: white" | ''Morning Break''
 |-
-| 11h30 - 12h10 || [[#TomVanGoethem|Tom Van Goethem]] || '''Remote code execution in WordPress: an analysis'''
+| 11h30 - 12h10 || [[#TomVanGoethem|Tom Van Goethem]] || '''[[Media:RemoteCodeExecutionInWordPress-OWASPBeNeLux-Tom_Van_Goethem.pdf | Remote code execution in WordPress: an analysis]]'''
 |-
 | 12h10 - 12h50 || [[#AlexiosFakosAndJanPhilipp|Alexios Fakos & Jan Philipp]] || '''[[Media:OWASP_BeNeLux-SharePoint-Comprehensive_Security_model_v1.0.pdf | Getting a handle on SharePoint security complexity]]'''
@@ Line 211: / Line 211: @@
 With over 13 million downloads, WordPress is one of the most popular open source blog platforms and content management systems. One of its key features is the installation of plugins. These are developed by third parties, but WordPress has to maintain its legacy codebase in order to remain compatible with these plugins. As this codebase makes use of unsafe functions, vulnerabilities may arise, affecting thousands websites - if not more. This presentation will focus on a vulnerability that has been present in WordPress versions up to September 2013. This vulnerability, which may lead to Remote Code Execution, was found by a simple combination of two publicly known elements: PHP Object Injection and unexpected behaviour of MySQL regarding Unicode characters.
 <br>
 <br>
 ''Bio:''<br>

@@ Line 158: / Line 158: @@
 | colspan="2" style="text-align: center; background: grey; color: white" | ''Registration''
 |-
-| 10h00 - 10h15 || OWASP Benelux Organization || '''Welcome'''
+| 10h00 - 10h15 || OWASP Benelux Organization || '''[[Media: OWASP_benelux-day_2013_opening_agenda_closing.pdf | Welcome]]'''
 |-
 | 10h15 - 10h30 || Sebastien Deleersnyder, OWASP Global || '''[https://www.owasp.org/images/4/49/OWASP_Update_BeNeLux_2013.pptx OWASP update]'''
@@ Line 176: / Line 176: @@
 | 13h30 - 14h10 || [[#DickBerlijn|Dick Berlijn]] || '''Keynote: Cyber warfare'''
 |-
-| 14h10 - 14h50 || [[#MigchieldeJong|Migchiel de Jong]] || ''' Static Analysis and code review; A journey through time, '''
+| 14h10 - 14h50 || [[#MigchieldeJong|Migchiel de Jong]] || ''' [[Media:owasp2013-mdejong.pdf | Static Analysis and code review; A journey through time]]'''
 |-
 | 14h50 - 15h30 || [[#NickNikiforakis|Nick Nikiforakis]] || '''[[Media:webfingerprinting_owaspBENELUX2013.pdf |Everything you always wanted to know about web-based device fingerprinting (but were afraid to ask)]]'''
@@ Line 185: / Line 185: @@
 | 16h30 - 17h10 || [[#JeromeNokin|Jerome Nokin]] || '''Turning your managed Anti-Virus into my botnet'''
 |-
-| 17h10 - 17h50 || [[#VictorvanderVeen|Victor van der Veen]] || '''TraceDroid: A Fast and Complete Android Method Tracer'''
+| 17h10 - 17h50 || [[#VictorvanderVeen|Victor van der Veen]] || '''[[Media:TraceDroid.pdf | TraceDroid: A Fast and Complete Android Method Tracer]]'''
 |-
 | 17h50 - 18h00 || OWASP Benelux 2013 organization || '''Closing Notes'''
@@ Line 246: / Line 246: @@
 Static analysis techniques to support code review, not just for security, have been around for a long time. This talk will take you on journey from the early days of computer science to this modern day and age of cloud, BYOD and mobile apps and how the passing of time affected code review and the technology to support it. The takeaways from this session are; Understanding the fundamentals problems that have to be addressed to really get the benefits from using static analysis for code review. Trends in code review. Best practices for code review. What the future holds for code review.
 <br>
 <br>
 ''Bio:''<br>
@@ Line 293: / Line 294: @@
 You can already give TraceDroid a try via http://tracedroid.few.vu.nl
 <br>
 <br>
 ''Bio:''<br>

@@ Line 169: / Line 169: @@
 | 11h30 - 12h10 || [[#TomVanGoethem|Tom Van Goethem]] || '''Remote code execution in WordPress: an analysis'''
 |-
-| 12h10 - 12h50 || [[#AlexiosFakosAndJanPhilipp|Alexios Fakos & Jan Philipp]] || '''Getting a handle on SharePoint security complexity'''
+| 12h10 - 12h50 || [[#AlexiosFakosAndJanPhilipp|Alexios Fakos & Jan Philipp]] || '''[[Media:OWASP_BeNeLux-SharePoint-Comprehensive_Security_model_v1.0.pdf | Getting a handle on SharePoint security complexity]]'''
 |-
 | 12h50 - 13h30
@@ Line 178: / Line 178: @@
 | 14h10 - 14h50 || [[#MigchieldeJong|Migchiel de Jong]] || ''' Static Analysis and code review; A journey through time, '''
 |-
-| 14h50 - 15h30 || [[#NickNikiforakis|Nick Nikiforakis]] || '''Everything you always wanted to know about web-based device fingerprinting (but were afraid to ask)'''
+| 14h50 - 15h30 || [[#NickNikiforakis|Nick Nikiforakis]] || '''[[Media:webfingerprinting_owaspBENELUX2013.pdf |Everything you always wanted to know about web-based device fingerprinting (but were afraid to ask)]]'''
 |-
 | 15h30 - 15h50
@@ Line 221: / Line 221: @@
 This presentation’s main goal is to provide decision makers, architects, administrators and developers with a comprehensive SharePoint security overview. We will introduce a SharePoint security model applicable to SharePoint versions 2010 and 2013. Then we will take a closer look at the use of different types of security principals and their effective use. This will be followed by covering security aspects when implementing and extending SharePoint to meet business needs and will be emphasized by showcasing common security pitfalls with examples throughout the presentation. This will be demonstrated with security down to the “nitty-gritty” details based on actual use cases and tips and pitfalls that have been encountered during security assessments and implementation of SharePoint solutions.
 <br>
 <br>
 ''Bio:''<br>
@@ Line 263: / Line 264: @@
 are trying to defend against it today.
 <br>
 <br>
 ''Bio:''<br>

@@ Line 160: / Line 160: @@
 | 10h00 - 10h15 || OWASP Benelux Organization || '''Welcome'''
 |-
-| 10h15 - 10h30 || Sebastien Deleersnyder, OWASP Global || '''OWASP update'''
+| 10h15 - 10h30 || Sebastien Deleersnyder, OWASP Global || '''[https://www.owasp.org/images/4/49/OWASP_Update_BeNeLux_2013.pptx OWASP update]'''
 |-
 | 10h30 - 11h10 || [[#JanJorisVereijken|Jan Joris Vereijken]] || '''Keynote: Inside the mind of the fraudster'''

@@ Line 316: / Line 316: @@
 :Our Bowling Tracks are open from 21:30 - 24:00
 <hr>
 '''The OWASP BeNeLux-Day 2013 Social Event is sponsored by:"