This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "AppSecUSA 2012.com"
From OWASP
(→Web Framework Vulnerabilities) |
|||
| Line 13: | Line 13: | ||
==== Mobile Applications & Proxy Shenanigans ==== | ==== Mobile Applications & Proxy Shenanigans ==== | ||
| − | *'''Dan Amodio''' | Mobile | | + | *'''Dan Amodio''' | Mobile | Presentation Not available |
==== Reverse Engineering “Secure” HTTP APIs With An SSL Proxy ==== | ==== Reverse Engineering “Secure” HTTP APIs With An SSL Proxy ==== | ||
| − | *'''Alejandro Caceres''' | Reverse Engineering | | + | *'''Alejandro Caceres''' | Reverse Engineering | Presentation Not available |
==== Gauntlt: Rugged by Example ==== | ==== Gauntlt: Rugged by Example ==== | ||
| Line 26: | Line 26: | ||
==== Building a Web Attacker Dashboard with ModSecurity and BeEF ==== | ==== Building a Web Attacker Dashboard with ModSecurity and BeEF ==== | ||
| − | *'''Ryan Barnett''' | Attack | | + | *'''Ryan Barnett''' | Attack | Presentation Not available |
==== Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews ==== | ==== Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews ==== | ||
| − | *'''Sherif Koussa''' | Developer | | + | *'''Sherif Koussa''' | Developer | Presentation Not available |
==== Cracking the Code of Mobile Application ==== | ==== Cracking the Code of Mobile Application ==== | ||
| Line 35: | Line 35: | ||
==== Hacking .NET Application: Reverse Engineering 101 ==== | ==== Hacking .NET Application: Reverse Engineering 101 ==== | ||
| − | *'''Jon Mccoy''' | Reverse Engineering | | + | *'''Jon Mccoy''' | Reverse Engineering | Presentation Not available |
==== Doing the unstuck: How Rugged cultures drive Biz & AppSec Value ==== | ==== Doing the unstuck: How Rugged cultures drive Biz & AppSec Value ==== | ||
| Line 45: | Line 45: | ||
==== Hacking with WebSockets ==== | ==== Hacking with WebSockets ==== | ||
| − | *'''Vaagn Toukharian''' | Attack | | + | *'''Vaagn Toukharian''' | Attack | Presentation Not available |
==== Bug Bounty Programs ==== | ==== Bug Bounty Programs ==== | ||
| − | *'''Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice''' | Developer | | + | *'''Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice''' | Developer | Presentation Not available |
==== How we tear into that little green man ==== | ==== How we tear into that little green man ==== | ||
| − | *'''Mathew Rowley''' | Mobile | | + | *'''Mathew Rowley''' | Mobile | Presentation Not available |
==== AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life ==== | ==== AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life ==== | ||
| − | *'''Jerry Hoff''' | Developer | | + | *'''Jerry Hoff''' | Developer | Presentation Not available |
==== Put your robots to work: security automation at Twitter ==== | ==== Put your robots to work: security automation at Twitter ==== | ||
| − | *'''Justin Collins, Neil Matatall, Alex Smolen''' | Rugged devops | | + | *'''Justin Collins, Neil Matatall, Alex Smolen''' | Rugged devops | Presentation Not available |
=== 3:00 pm - 3:45 pm === | === 3:00 pm - 3:45 pm === | ||
| Line 64: | Line 64: | ||
==== Exploiting Internal Network Vulns via the Browser using BeEF Bind ==== | ==== Exploiting Internal Network Vulns via the Browser using BeEF Bind ==== | ||
| − | *'''Michele Orru''' | Attack | | + | *'''Michele Orru''' | Attack | Presentation Not available |
==== The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) ==== | ==== The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) ==== | ||
| Line 73: | Line 73: | ||
==== I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST ==== | ==== I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST ==== | ||
| − | *'''Ofer Maor''' | Developer | | + | *'''Ofer Maor''' | Developer | Presentation Not available |
==== Rebooting (secure) software development with continuous deployment ==== | ==== Rebooting (secure) software development with continuous deployment ==== | ||
| − | *'''Nick Galbreath''' | Rugged devops | | + | *'''Nick Galbreath''' | Rugged devops | Presentation Not available |
=== 4:00 pm - 4:45 pm === | === 4:00 pm - 4:45 pm === | ||
| Line 86: | Line 86: | ||
==== Analyzing and Fixing Password Protection Schemes ==== | ==== Analyzing and Fixing Password Protection Schemes ==== | ||
| − | *'''John Steven''' | Developer | | + | *'''John Steven''' | Developer | Presentation Not available |
==== Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods ==== | ==== Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods ==== | ||
| − | *'''Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner''' | Attack | | + | *'''Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner''' | Attack | Presentation Not available |
==== WTF - WAF Testing Framework ==== | ==== WTF - WAF Testing Framework ==== | ||
| Line 109: | Line 109: | ||
==== Payback on Web Attackers: Web Honeypots ==== | ==== Payback on Web Attackers: Web Honeypots ==== | ||
| − | *'''Simon Roses Femerling''' | Architecture | | + | *'''Simon Roses Femerling''' | Architecture | Presentation Not available |
==== Spin the bottle: Coupling technology and SE for one awesome hack ==== | ==== Spin the bottle: Coupling technology and SE for one awesome hack ==== | ||
| − | *'''David Kennedy''' | Attack | | + | *'''David Kennedy''' | Attack | Presentation Not available |
==== Incident Response: Security After Compromise ==== | ==== Incident Response: Security After Compromise ==== | ||
| − | *'''Richard Bejtlich''' | Case Studies | | + | *'''Richard Bejtlich''' | Case Studies | Presentation Not available |
=== 11:00 am - 11:45 am === | === 11:00 am - 11:45 am === | ||
| Line 128: | Line 128: | ||
==== The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems ==== | ==== The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems ==== | ||
| − | *'''Dan Cornell, Josh Sokol''' | Architecture | | + | *'''Dan Cornell, Josh Sokol''' | Architecture | Presentation Not available |
==== Blended Threats and JavaScript: A Plan for Permanent Network Compromise ==== | ==== Blended Threats and JavaScript: A Plan for Permanent Network Compromise ==== | ||
| − | *'''Phil Purviance''' | Attack | | + | *'''Phil Purviance''' | Attack | Presentation Not available |
==== Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards ==== | ==== Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards ==== | ||
| − | *'''Juan Perez-Etchegoyen, Jordan Santarsieri''' | Case Studies | | + | *'''Juan Perez-Etchegoyen, Jordan Santarsieri''' | Case Studies | Presentation Not available |
=== 1:00 pm - 1:45 pm === | === 1:00 pm - 1:45 pm === | ||
| Line 144: | Line 144: | ||
==== Real World Cloud Application Security ==== | ==== Real World Cloud Application Security ==== | ||
| − | *'''Jason Chan''' | Cloud | | + | *'''Jason Chan''' | Cloud | Presentation Not available |
==== NoSQL, no security? ==== | ==== NoSQL, no security? ==== | ||
| − | *'''Will Urbanski''' | Architecture | | + | *'''Will Urbanski''' | Architecture | Presentation Not available |
==== SQL Server Exploitation, Escalation, and Pilfering ==== | ==== SQL Server Exploitation, Escalation, and Pilfering ==== | ||
| − | *'''Antti Rantasaari, Scott Sutherland''' | Attack | | + | *'''Antti Rantasaari, Scott Sutherland''' | Attack | Presentation Not available |
==== Iran's real life cyberwar ==== | ==== Iran's real life cyberwar ==== | ||
| Line 169: | Line 169: | ||
==== XSS & CSRF with HTML5 - Attack, Exploit and Defense ==== | ==== XSS & CSRF with HTML5 - Attack, Exploit and Defense ==== | ||
| − | *'''Shreeraj Shah''' | Attack | | + | *'''Shreeraj Shah''' | Attack | Presentation Not available |
==== The Application Security Ponzi Scheme: Stop paying for security failure ==== | ==== The Application Security Ponzi Scheme: Stop paying for security failure ==== | ||
| − | *'''Jarret Raim, Matt Tesauro''' | Case Studies | | + | *'''Jarret Raim, Matt Tesauro''' | Case Studies | Presentation Not available |
=== 3:00 pm - 3:45 pm === | === 3:00 pm - 3:45 pm === | ||
| Line 182: | Line 182: | ||
==== Origin(al) Sins ==== | ==== Origin(al) Sins ==== | ||
| − | *'''Alex Russell''' | Developer | | + | *'''Alex Russell''' | Developer | Presentation Not available |
==== The 7 Qualities of Highly Secure Software ==== | ==== The 7 Qualities of Highly Secure Software ==== | ||
| Line 198: | Line 198: | ||
==== Security at Scale ==== | ==== Security at Scale ==== | ||
| − | *'''Yvan Boily''' | Developer | | + | *'''Yvan Boily''' | Developer | Presentation Not available |
==== Four Axes of Evil ==== | ==== Four Axes of Evil ==== | ||
| Line 204: | Line 204: | ||
==== Pining For the Fjords: The Role of RBAC in Today's Applications ==== | ==== Pining For the Fjords: The Role of RBAC in Today's Applications ==== | ||
| − | *'''Wendy Nather''' | Architecture | | + | *'''Wendy Nather''' | Architecture | Presentation Not available |
==== Counterintelligence Attack Theory ==== | ==== Counterintelligence Attack Theory ==== | ||
| − | *'''Fred Donovan''' | Attack | | + | *'''Fred Donovan''' | Attack | Presentation Not available |
==== Top Strategies to Capture Security Intelligence for Applications ==== | ==== Top Strategies to Capture Security Intelligence for Applications ==== | ||
Revision as of 16:48, 18 November 2012
- AppSecUSA Presentations and Talks
- 1 Thursday 25th Oct
- 1.1 10:00 am - 10:45 am
- 1.2 11:00 am - 11:45 am
- 1.2.1 Building a Web Attacker Dashboard with ModSecurity and BeEF
- 1.2.2 Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews
- 1.2.3 Cracking the Code of Mobile Application
- 1.2.4 Hacking .NET Application: Reverse Engineering 101
- 1.2.5 Doing the unstuck: How Rugged cultures drive Biz & AppSec Value
- 1.3 2:00 pm - 2:45 pm
- 1.4 3:00 pm - 3:45 pm
- 1.4.1 Exploiting Internal Network Vulns via the Browser using BeEF Bind
- 1.4.2 The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension)
- 1.4.3 Demystifying Security in the Cloud: AWS Scout
- 1.4.4 I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST
- 1.4.5 Rebooting (secure) software development with continuous deployment
- 1.5 4:00 pm - 4:45 pm
- 2 Friday 26th Oct
- 2.1 10:00 am - 10:45 am
- 2.2 11:00 am - 11:45 am
- 2.2.1 The Same-Origin Saga
- 2.2.2 Hack your way to a degree: a new direction in teaching application security at universities
- 2.2.3 The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems
- 2.2.4 Blended Threats and JavaScript: A Plan for Permanent Network Compromise
- 2.2.5 Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards
- 2.3 1:00 pm - 1:45 pm
- 2.4 2:00 pm - 2:45 pm
- 2.4.1 Get off your AMF and don’t REST on JSON
- 2.4.2 Unraveling Some of the Mysteries around DOM-Based XSS
- 2.4.3 Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
- 2.4.4 XSS & CSRF with HTML5 - Attack, Exploit and Defense
- 2.4.5 The Application Security Ponzi Scheme: Stop paying for security failure
- 2.5 3:00 pm - 3:45 pm
- 2.6 4:00 pm - 4:45 pm
Thursday 25th Oct
10:00 am - 10:45 am
Building Predictable Systems using Behavioral Security Modeling: |Functional Security Requirements
- John Benninghoff | Developer | Building Predictable Systems using Behavioral Security Modeling - PDF
Top Ten Web Defenses
- Jim Manico | Mobile | Top 10 Defenses for Website Security - PDF
Mobile Applications & Proxy Shenanigans
- Dan Amodio | Mobile | Presentation Not available
Reverse Engineering “Secure” HTTP APIs With An SSL Proxy
- Alejandro Caceres | Reverse Engineering | Presentation Not available
Gauntlt: Rugged by Example
- Jeremiah Shirk | Rugged devops | PDF
11:00 am - 11:45 am
Building a Web Attacker Dashboard with ModSecurity and BeEF
- Ryan Barnett | Attack | Presentation Not available
Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews
- Sherif Koussa | Developer | Presentation Not available
Cracking the Code of Mobile Application
- Sreenarayan Ashokkumar | Mobile | Cracking the Mobile Application Code - PDF
Hacking .NET Application: Reverse Engineering 101
- Jon Mccoy | Reverse Engineering | Presentation Not available
Doing the unstuck: How Rugged cultures drive Biz & AppSec Value
- Josh Corman | Rugged devops | Doing the unstuck: How Rugged cultures drive Biz & AppSec Value - PDF
2:00 pm - 2:45 pm
Hacking with WebSockets
- Vaagn Toukharian | Attack | Presentation Not available
Bug Bounty Programs
- Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice | Developer | Presentation Not available
How we tear into that little green man
- Mathew Rowley | Mobile | Presentation Not available
AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life
- Jerry Hoff | Developer | Presentation Not available
Put your robots to work: security automation at Twitter
- Justin Collins, Neil Matatall, Alex Smolen | Rugged devops | Presentation Not available
3:00 pm - 3:45 pm
Exploiting Internal Network Vulns via the Browser using BeEF Bind
- Michele Orru | Attack | Presentation Not available
The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension)
- Shay Chen | Developer | The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) - PDF
Demystifying Security in the Cloud: AWS Scout
- Jonathan Chittenden | Cloud | Demystifying Security in the Cloud - PDF
I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST
- Ofer Maor | Developer | Presentation Not available
Rebooting (secure) software development with continuous deployment
- Nick Galbreath | Rugged devops | Presentation Not available
4:00 pm - 4:45 pm
Cross Site Port Scanning
- Riyaz Walikar | Attack | Cross Site Port Scanning - PDF
Analyzing and Fixing Password Protection Schemes
- John Steven | Developer | Presentation Not available
Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods
- Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner | Attack | Presentation Not available
WTF - WAF Testing Framework
- Yaniv Azaria, Amichai Shulman | Architecture | WAF Testing Framework - PDF
DevOps Distilled: The DevOps Panel at AppSec USA
- Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett | Rugged devops | DevOps Distilled - PDF
Friday 26th Oct
10:00 am - 10:45 am
Effective approaches to web application security
- Zane Lackey | Developer | Effective approaches to web application security - PDF
Why Web Security Is Fundamentally Broken
- Jeremiah Grossman | Developer | Why Web Security Is Fundamentally Broken - PDF
Payback on Web Attackers: Web Honeypots
- Simon Roses Femerling | Architecture | Presentation Not available
Spin the bottle: Coupling technology and SE for one awesome hack
- David Kennedy | Attack | Presentation Not available
Incident Response: Security After Compromise
- Richard Bejtlich | Case Studies | Presentation Not available
11:00 am - 11:45 am
The Same-Origin Saga
- Brendan Eich | Developer | The Same-Origin Saga - PDF
Hack your way to a degree: a new direction in teaching application security at universities
- Konstantinos Papapanagiotou | Developer | Hack your way to a degree: a new direction in teaching application security at universities - PDF
The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems
- Dan Cornell, Josh Sokol | Architecture | Presentation Not available
Blended Threats and JavaScript: A Plan for Permanent Network Compromise
- Phil Purviance | Attack | Presentation Not available
Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards
- Juan Perez-Etchegoyen, Jordan Santarsieri | Case Studies | Presentation Not available
1:00 pm - 1:45 pm
Builders Vs. Breakers
- Brett Hardin, Matt Konda, Jon Rose | Developer | Builders-vs-Breakers - PDF
Real World Cloud Application Security
- Jason Chan | Cloud | Presentation Not available
NoSQL, no security?
- Will Urbanski | Architecture | Presentation Not available
SQL Server Exploitation, Escalation, and Pilfering
- Antti Rantasaari, Scott Sutherland | Attack | Presentation Not available
Iran's real life cyberwar
- Phillip Hallam-Baker | Case Studies | Iran’s Real Life Cyberwar - PDF
2:00 pm - 2:45 pm
Get off your AMF and don’t REST on JSON
- Dan Kuykendall | Developer | Get off your AMF and don’t REST on JSON - PDF
Unraveling Some of the Mysteries around DOM-Based XSS
- Dave Wichers | Developer | Unraveling some Mysteries around DOM-based XSS - PDF
Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
- Tobias Gondrom | Architecture | Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs - PDF
XSS & CSRF with HTML5 - Attack, Exploit and Defense
- Shreeraj Shah | Attack | Presentation Not available
The Application Security Ponzi Scheme: Stop paying for security failure
- Jarret Raim, Matt Tesauro | Case Studies | Presentation Not available
3:00 pm - 3:45 pm
Using Interactive Static Analysis for Early Detection of Software Vulnerabilities
- Bill Chu | Developer | Static Analysis for Early Detection of Software Vulnerabilities - PDF
Origin(al) Sins
- Alex Russell | Developer | Presentation Not available
The 7 Qualities of Highly Secure Software
- Mano 'dash4rk' Paul | Architecture | 7 Qualities of Highly Secure Software - PDF
Web Framework Vulnerabilities
- Abraham Kang | Attack | Web App Framework Based Vulnerabilies - PDF
Web App Crypto - A Study in Failure
- Travis H | Case Studies | Web App Cryptology A Study in Failure - PDF
4:00 pm - 4:45 pm
Security at Scale
- Yvan Boily | Developer | Presentation Not available
Four Axes of Evil
- HD Moore | Developer | Four Axes of Evil - PDF
Pining For the Fjords: The Role of RBAC in Today's Applications
- Wendy Nather | Architecture | Presentation Not available
Counterintelligence Attack Theory
- Fred Donovan | Attack | Presentation Not available
Top Strategies to Capture Security Intelligence for Applications
- John Dickson | Case Studies | Top Strategies to Capture Security Intelligence for Applications - PDF
