OWASP EEE Russia Event 2015 Agenda

Conference agenda
Time	Title	Speaker	Description
13:30 - 14:00 (30 mins)	Registration
14:00 - 14:45 (45 mins)	Building better product security: an engineering approach	Taras Ivaschenko	In modern internet company time to market is very important. The faster you release new features for users the better service you have. This is essential thing and we, as security people, need to follow business demands. In my talk I will cover several case studies about building Product security processes in engineering company. I will explain our approaches on how to be a bottle opener, not a bottleneck.
14:50 - 15:35 (45 mins)	Give me a stable input and I'll p0wn the planet	Zakaria Rachid	This talk is about hacking connected kiosks and objects that populate our daily life. A previous version talk was presented in France at La Nuit Du hack 2k14 with limit diffusion in France. New attack vectors and critical infrastructures have made there appearance, and some of the old ones are more developed with of course new screenshots/video of the PoC. The defensive chapter is also more thick, thanks to some new runs i made around Europe. Finally, the talk will be more mature, depicting a semblance of methodology and filled with iamthecavalry material.
15:40 - 16:00 (20 mins)	Lunch/Coffee Break
16:00 - 16:45 (45 mins)	Bugs -> max; time <= T	Omar Ganiev	The talk will cover some tips, tricks and tools for rapid web application security assessment (black and white box). They are useful in various situtations: pentest with very limited time or huge scope, competition, bugbounty program, etc. We'll go through minimal set of tests, that should be performed, and shortest paths to pwning the app.
16:50 - 17:35 (45 mins)	Mysql OOB injection. Can I surprise you?	Ivan Novikov	OOB - out-of-band technique for obtaining data by another band (data channel) than used to send payload. Currently known that only load_file() function can be used for this in MySQL case. But this method is based on UNC names and works only under Windows platforms. We tried to find other ways to obtain MySQL data by OOB. Of course this provides also SSRF attacks through SQL injections.