This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Deconstructing ColdFusion"
Dallendoug (talk | contribs) (added link header) |
Mark.bristow (talk | contribs) (→The presentation) |
||
| Line 5: | Line 5: | ||
== The presentation == | == The presentation == | ||
| − | [[Image:Owasp_logo_normal.jpg|right]]ColdFusion is a somewhat forgotten but still very prevalent web application development platform. This presentation is a technical survey of ColdFusion security that will be of interest mostly to code auditors, penetration testers, and developers. | + | [[Image:Owasp_logo_normal.jpg|right]] |
| − | + | ColdFusion is a somewhat forgotten but still very prevalent web application development platform. This presentation is a technical survey of ColdFusion security that will be of interest mostly to code auditors, penetration testers, and developers. In the talk, we’ll cover the history of the ColdFusion platform and its relevance to today’s security landscape. We’ll describe basics of ColdFusion markup, control flow, functions, and components and demonstrate how to identify common web application vulnerabilities in the source code. We’ll also delve into ColdFusion J2EE internals, showing what CFML pages and components look like when compiled down to Java, and describing some of the unusual behavior we’ve observed at that level. We'll discuss open-source tools to aid reverse engineers in working with ColdFusion's proprietary classfile format. | |
| − | In the talk, we’ll cover the history of the ColdFusion platform and its relevance to today’s security landscape. We’ll describe basics of ColdFusion markup, control flow, functions, and components and demonstrate how to identify common web application vulnerabilities in the source code. | ||
| − | |||
| − | We’ll also delve | ||
| − | |||
| − | |||
== The speaker == | == The speaker == | ||
Revision as of 21:55, 5 October 2010
Registration | Hotel | Walter E. Washington Convention Center
The presentation
ColdFusion is a somewhat forgotten but still very prevalent web application development platform. This presentation is a technical survey of ColdFusion security that will be of interest mostly to code auditors, penetration testers, and developers. In the talk, we’ll cover the history of the ColdFusion platform and its relevance to today’s security landscape. We’ll describe basics of ColdFusion markup, control flow, functions, and components and demonstrate how to identify common web application vulnerabilities in the source code. We’ll also delve into ColdFusion J2EE internals, showing what CFML pages and components look like when compiled down to Java, and describing some of the unusual behavior we’ve observed at that level. We'll discuss open-source tools to aid reverse engineers in working with ColdFusion's proprietary classfile format.
The speaker
Speaker bio will be posted shortly.
