Conference agenda, 13th of October

In this talk you will learn all about the project and its capabilities. You will...

• join a "happy shopper round tour"
• enjoy a hacking demo of some of the 43+ challenges
• get an insight into the underlying application architecture
• witness how to customize Juice Shop into a security awareness booster
• learn how to set up a CTF event with Juice Shop for extra fun during trainings

https://www.owasp.org/index.php/OWASP_Juice_Shop_Project

A standardized end2end frame to provide secure enablement for both application developers and online presences will be presented from Telekom's experience.

This is a demonstration oriented talk that explains OWASP ZAP automation strategies for Security Testing by example.

Panel discussion with: Iulia Ivanov, Giorgiana Vlasceanu, Alexandra Anghel, Daniela Ene and Daniel Barbu
      See panelists bios here

How many web browsers do we use in a week or a month? Are those web browsers exposed to attacks? Do we trust our favourite web browsers? We will discover multiple attack scenarios and attack vectors which can endanger our browsing experience. Be warned, your relationship with your favourite web browser might suffer and trust issues might arise.

This Project implementation is based on well known machine learning algorithm which is Support Vector Machines for solving the problem of android malware analysis. This method involves the mechanism of detection of android malware by effeciently embedding the functional call graphs along the feature map. The gamechanger in this concept would be the optimal utilization of the SVM Algorithm(Support Vector Machine) that proves to be better than other approaches with a minimalistic amount of false positives found and a higher detection rate.

Conference agenda, 13th of October

There will be implicit training in the form of practical exercises in how you calculate risk and accountability. Threat modelling also involves different disciplines in design, development and security so we expect the audience to join the conversation.

Nowadays real attacks often go undetected for months, use modern tools & techniques, and the responders many times get overwhelmed by the complexity of analysis, time pressure, and the need to understand adversary tactics.
In this presentation and demo, we will show some common techniques of getting a foothold in a target, stealing credentials, doing lateral movement and preparing for data exfil from the red teamer perspective, as well as best practices and approaches for blue teamers to detect and respond to them.

Nevertheless, the real world of application security is way more complicated than this. New attack vectors are being found on a regular basis and security standards and vulnerability libraries tend to get obsolete pretty fast. It’s nearly impossible to keep on track regarding all vulnerabilities which an application can be vulnerable to.
The goal of this talk is to raise awareness about this topic. Several less known security vulnerabilities will be explained, shown in practice and mitigation strategies will be proposed.

The TLS v1.3 specification, managed by the Internet Engineering Task Force (IETF), is currently on its 21st draft and is aiming to be ratified later this year. It marks the biggest change in the protocol since 1996 when SSL v3.0 was published. Rather than incremental additions and deprecations, features such as RSA key exchange, 3DES and session renegotiation have been removed completely and big efficiency gains can now be made from one-round-trip and even zero-round-trip handshakes.

This talk will explain to the audience thee basics of TLS 1.3: the goals of the protocol and how it achieves them; what features have been added, removed and changed

The talk is technical, but does not require knowledge or experience of cryptography or mathematics.

This presentation will go through reactive and proactive measures that authentication systems can take to protect their users against credential stuffing.

Via this presentation we try to provide hints on the following topics:

• What software security standards tell us and why we should listen to them;
• Types of vulnerabilities statistically identified by SAST scanners on source code / Deep dive into some vulnerabilities discovered by SAST solutions;
• Solutions at code level and for the software environment: supporting processes and technology (vendor-agnostic), architectures, features, limitations. / The holistic secure software development process model;
• How can ethical hackers make use of SAST solutions to optimize their white box tests.
  

Workshop

The objective of doing so is to introduce the audience to the benefits of performing Threat Modelling on a system during the early stages of design / development. This ensures that key security threats are known and understood early on allowing remediation to be done in a more cost effective and pragmatic way than had they been found much later on during testing or when in production.

A fictitious payment web application will be examined in this session – defining its business functionality, actors, assets and technology stack. Data flowing between the components will then be drawn out in the form of data-flow diagrams (DFD’s). Thereafter the attack-surface will be mapped out using the STRIDE methodology identifying threats pertaining to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and the Elevation of privilege. Finally, these will documented in a form allowing categorisation of risk together with identified security controls that should be tested.
Intended audience: Architects, Designers, Developers, Testers, Security professionals, Project managers.
Skill level: The workshop does not assume an in-depth knowledge of software security.
Requirements: A mind-set of how an attacker might seek to compromise this system, so as to best identify the threats pertaining to it.
Seats available: 20 (first-come, first served)
Price: free
Register here

How many challenges can you beat? During the workshop you can get some first-hand hints in case you fell stuck. At the end of the workshop there will be a demo of some of the more mindboggling challenges - but only for those, who don't want to solve them on their own later! You will have an idea how good you and your tools are with
Intended audience: Developers and pentesters with at least basic understanding of common web application vulnerabilities
Skill level: The workshop does not assume an in-depth knowledge of software security.
Requirements:

• laptop with OWASP Juice Shop installed using one of the setups described in https://github.com/bkimminich/juice-shop#setup
• internet browser with some API testing plugin (e.g. PostMan for Chrome)
• (optionally) any kind of pentesting tools

Seats available: 20 (first-come, first served)
Price: free
Register here

• Fundamentals of Android Operating System
• Understanding the Android Security Architecture
• Android Permission Model
• Understanding how to setup a pentest environment
• Understanding the Android Debug Bridge
• Fundamentals of Android Application Signing
• Understanding the working of app permissions using the Android Manifest File

Though not in-depth but this workshop would definitely give a great push to start into the Mobile Security Scene. At the end of the workshop, the attendees would be given few challenges to be solved, giving them an understanding and idea on how to find some of the very well-known Android Security Issues. Intended Audience: Application Developers, Penetration Testers who plan to get into the field of Mobile Pentesting with basic knowledge and understanding of the Android Operating System. Prerequisites:

• A Laptop with full administrative access since you will be installing software.
• Make sure to have free space of atleast 10 GB on your laptop and with minimum 4 GB RAM
• Basic knowledge on Android

Software Requirements:

• VirtualBox 5.x.x installed. Please have this installed before the session starts. VMWare will not be supported.
• Any of the following OS : OSX , Win 7 and above, Ubuntu 12.0.4 and above

Seats available: 20 (first-come, first served)
Price: free
Register here

Training

The focus of this training will be on how to build secure applications and how to evaluate them using real world scenarios. The attendees will learn the concepts solving exercises and using various OWASP resources like the OWASP ASVS (Application Security Verification Standard) and the OWASP Testing Guide. Topics covered:
Day 1:

• Architecture design and threat modelling
• Authentication Flaws
• Session Management Flaws
• Access Control Verification Requirements
• Input Handling and Output Encoding/Escaping

Day 2:

• Cryptography at Rest
• Error Handling and Logging
• Data Protection Verification
• Communications Security
• Business Logic Verification Requirements
• Files and Resources
• Mobile Security
• Web Service Security

Intended audience: This training is suitable for developers, quality assurance, code reviewers and penetration testers
Skill level: Beginner - intermediate
Requirements: Basic web knowledge; laptop with at least 4GB RAM and virtualization software (VMware Workstation Player).
Seats available: 20 (first-come, first served)
Price: 400 euros/person
Register here

Training

We will discuss each type of vulnerability described in the OWASP Top 10 project and will teach participants manual discovery and exploitation techniques. Furthermore, a set of useful security testing tools will be introduced during the workshop. This is a hands-on workshop where participants will learn how to:

• Built a threat model for the target application
• Perform web app recon
• Discover SQL injection and exploit it to extract information from the back-end database
• Find OS command injection and exploit it to execute arbitrary commands on the target server
• Discover Cross-Site Scripting and exploit it to gain access to another user’s web session
• Spot XML External Entity vulnerabilities and use them to read arbitrary files from the server
• Identify Local File Inclusion and exploit it to gain remote command execution
• Find Cross-Site Request Forgery and exploit it to gain access to the admin panel
• Detect standard components of web apps containing known vulnerabilities and exploit them

Moreover, we will discuss ways in which security can be better integrated into the software development lifecycle and how the OWASP Top 10 vulnerabilities can be avoided, identified early on or mitigated before they reach production environments.
Intended audience: Web application developers, penetration testers, information security professionals, quality assurance personnel, web security enthusiasts
Skill level: The course assumes basic knowledge about the inner workings of the web and some web programming skills
Requirements:

• Laptop with a working operating system
• At least 2 GB of free disk space and at least 2 GB RAM
• Administrative rights on the laptop
• VMWare Player installed

Seats available: 20 (first-come, first served)
Price: 400 euros/person
Register here