This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "AppSecUSA 2012.com"
From OWASP
(→SQL Server Exploitation, Escalation, and Pilfering) |
|||
| Line 6: | Line 6: | ||
---- | ---- | ||
| − | ==== Building Predictable Systems using Behavioral Security Modeling: |Functional Security Requirements ==== | + | {| border="1" cellpadding="0" cellspading="0" |
| + | ! scope="col" align="left" width="100%" | | ||
| + | |||
| + | ==== Building Predictable Systems using Behavioral Security Modeling: |Functional Security Requirements ==== | ||
| + | |||
*'''John Benninghoff''' | Developer | [https://www.owasp.org/images/7/7f/Building_Predictable_Systems.pdf Building Predictable Systems using Behavioral Security Modeling - PDF] | *'''John Benninghoff''' | Developer | [https://www.owasp.org/images/7/7f/Building_Predictable_Systems.pdf Building Predictable Systems using Behavioral Security Modeling - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Top Ten Web Defenses ==== | ==== Top Ten Web Defenses ==== | ||
*'''Jim Manico''' | Mobile | [https://www.owasp.org/images/0/08/Top_10_Defenses_for_Website_Security.pdf Top 10 Defenses for Website Security - PDF] | *'''Jim Manico''' | Mobile | [https://www.owasp.org/images/0/08/Top_10_Defenses_for_Website_Security.pdf Top 10 Defenses for Website Security - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Mobile Applications & Proxy Shenanigans ==== | ==== Mobile Applications & Proxy Shenanigans ==== | ||
*'''Dan Amodio''' | Mobile | Presentation not available | *'''Dan Amodio''' | Mobile | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Reverse Engineering “Secure” HTTP APIs With An SSL Proxy ==== | ==== Reverse Engineering “Secure” HTTP APIs With An SSL Proxy ==== | ||
*'''Alejandro Caceres''' | Reverse Engineering | Presentation not available | *'''Alejandro Caceres''' | Reverse Engineering | Presentation not available | ||
| − | + | |- | |
| − | ==== Gauntlt: Rugged by Example ==== | + | ! scope="col" align="left" width="100%" |==== Gauntlt: Rugged by Example ==== |
*'''Jeremiah Shirk''' | Rugged devops | Presentation not available | *'''Jeremiah Shirk''' | Rugged devops | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 11:00 am - 11:45 am === | === 11:00 am - 11:45 am === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Building a Web Attacker Dashboard with ModSecurity and BeEF ==== | ==== Building a Web Attacker Dashboard with ModSecurity and BeEF ==== | ||
*'''Ryan Barnett''' | Attack | Presentation not available | *'''Ryan Barnett''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews ==== | ==== Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews ==== | ||
*'''Sherif Koussa''' | Developer | Presentation not available | *'''Sherif Koussa''' | Developer | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Cracking the Code of Mobile Application ==== | ==== Cracking the Code of Mobile Application ==== | ||
*'''Sreenarayan Ashokkumar''' | Mobile | [https://www.owasp.org/images/c/cd/Cracking_the_Mobile_Application_Code.pdf Cracking the Mobile Application Code - PDF] | *'''Sreenarayan Ashokkumar''' | Mobile | [https://www.owasp.org/images/c/cd/Cracking_the_Mobile_Application_Code.pdf Cracking the Mobile Application Code - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Hacking .NET Application: Reverse Engineering 101 ==== | ==== Hacking .NET Application: Reverse Engineering 101 ==== | ||
*'''Jon Mccoy''' | Reverse Engineering | Presentation not available | *'''Jon Mccoy''' | Reverse Engineering | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Doing the unstuck: How Rugged cultures drive Biz & AppSec Value ==== | ==== Doing the unstuck: How Rugged cultures drive Biz & AppSec Value ==== | ||
*'''Josh Corman''' | Rugged devops | [https://www.owasp.org/images/d/d5/Doing_the_Unstuck.pdf Doing the unstuck: How Rugged cultures drive Biz & AppSec Value - PDF] | *'''Josh Corman''' | Rugged devops | [https://www.owasp.org/images/d/d5/Doing_the_Unstuck.pdf Doing the unstuck: How Rugged cultures drive Biz & AppSec Value - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 2:00 pm - 2:45 pm === | === 2:00 pm - 2:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Hacking with WebSockets ==== | ==== Hacking with WebSockets ==== | ||
*'''Vaagn Toukharian''' | Attack | Presentation not available | *'''Vaagn Toukharian''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Bug Bounty Programs ==== | ==== Bug Bounty Programs ==== | ||
*'''Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice''' | Developer | Presentation Not available | *'''Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice''' | Developer | Presentation Not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== How we tear into that little green man ==== | ==== How we tear into that little green man ==== | ||
*'''Mathew Rowley''' | Mobile | Presentation not available | *'''Mathew Rowley''' | Mobile | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life ==== | ==== AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life ==== | ||
*'''Jerry Hoff''' | Developer | Presentation not available | *'''Jerry Hoff''' | Developer | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Put your robots to work: security automation at Twitter ==== | ==== Put your robots to work: security automation at Twitter ==== | ||
*'''Justin Collins, Neil Matatall, Alex Smolen''' | Rugged devops | Presentation Not available | *'''Justin Collins, Neil Matatall, Alex Smolen''' | Rugged devops | Presentation Not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 3:00 pm - 3:45 pm === | === 3:00 pm - 3:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Exploiting Internal Network Vulns via the Browser using BeEF Bind ==== | ==== Exploiting Internal Network Vulns via the Browser using BeEF Bind ==== | ||
*'''Michele Orru''' | Attack | Presentation not available | *'''Michele Orru''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) ==== | ==== The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) ==== | ||
*'''Shay Chen''' | Developer | [https://www.owasp.org/images/f/f5/The_Diviner_-_Digital_Clairvoyance_Breakthrough_-_Gaining_Access_to_the_Source_Code_%26_Server_Side_Memory_Structure_of_ANY_Application.pdf The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) - PDF] | *'''Shay Chen''' | Developer | [https://www.owasp.org/images/f/f5/The_Diviner_-_Digital_Clairvoyance_Breakthrough_-_Gaining_Access_to_the_Source_Code_%26_Server_Side_Memory_Structure_of_ANY_Application.pdf The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Demystifying Security in the Cloud: AWS Scout ==== | ==== Demystifying Security in the Cloud: AWS Scout ==== | ||
*'''Jonathan Chittenden''' | Cloud | [https://www.owasp.org/images/0/0f/Demystifying_Security_in_the_Cloud.pdf Demystifying Security in the Cloud - PDF] | *'''Jonathan Chittenden''' | Cloud | [https://www.owasp.org/images/0/0f/Demystifying_Security_in_the_Cloud.pdf Demystifying Security in the Cloud - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST ==== | ==== I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST ==== | ||
*'''Ofer Maor''' | Developer | Presentation not available | *'''Ofer Maor''' | Developer | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Rebooting (secure) software development with continuous deployment ==== | ==== Rebooting (secure) software development with continuous deployment ==== | ||
*'''Nick Galbreath''' | Rugged devops | Presentation not available | *'''Nick Galbreath''' | Rugged devops | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 4:00 pm - 4:45 pm === | === 4:00 pm - 4:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Cross Site Port Scanning ==== | ==== Cross Site Port Scanning ==== | ||
*'''Riyaz Walikar''' | Attack | [https://www.owasp.org/images/8/89/Poking_Servers_with_Facebook-Cross_Site_Port_Scanning.pdf Cross Site Port Scanning - PDF] | *'''Riyaz Walikar''' | Attack | [https://www.owasp.org/images/8/89/Poking_Servers_with_Facebook-Cross_Site_Port_Scanning.pdf Cross Site Port Scanning - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Analyzing and Fixing Password Protection Schemes ==== | ==== Analyzing and Fixing Password Protection Schemes ==== | ||
*'''John Steven''' | Developer | Presentation not available | *'''John Steven''' | Developer | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods ==== | ==== Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods ==== | ||
*'''Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner''' | Attack | Presentation not available | *'''Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== WTF - WAF Testing Framework ==== | ==== WTF - WAF Testing Framework ==== | ||
*'''Yaniv Azaria, Amichai Shulman''' | Architecture | [https://www.owasp.org/images/0/00/OWASP-2012-WTF.pdf WAF Testing Framework - PDF] | *'''Yaniv Azaria, Amichai Shulman''' | Architecture | [https://www.owasp.org/images/0/00/OWASP-2012-WTF.pdf WAF Testing Framework - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== DevOps Distilled: The DevOps Panel at AppSec USA ==== | ==== DevOps Distilled: The DevOps Panel at AppSec USA ==== | ||
*'''Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett''' | Rugged devops | [https://www.owasp.org/images/9/90/Corman_AppSecUSA_2012_DevOpsPanel.pdf DevOps Distilled - PDF] | *'''Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett''' | Rugged devops | [https://www.owasp.org/images/9/90/Corman_AppSecUSA_2012_DevOpsPanel.pdf DevOps Distilled - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
== Friday 26th Oct == | == Friday 26th Oct == | ||
=== 10:00 am - 10:45 am === | === 10:00 am - 10:45 am === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Effective approaches to web application security ==== | ==== Effective approaches to web application security ==== | ||
*'''Zane Lackey''' | Developer | [https://www.owasp.org/images/b/b4/Effective_approaches_to_web_application_security.pdf Effective approaches to web application security - PDF] | *'''Zane Lackey''' | Developer | [https://www.owasp.org/images/b/b4/Effective_approaches_to_web_application_security.pdf Effective approaches to web application security - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Why Web Security Is Fundamentally Broken ==== | ==== Why Web Security Is Fundamentally Broken ==== | ||
*'''Jeremiah Grossman''' | Developer | [https://www.owasp.org/images/9/90/Web_Security_Fundamentally_Broken.pdf Why Web Security Is Fundamentally Broken - PDF] | *'''Jeremiah Grossman''' | Developer | [https://www.owasp.org/images/9/90/Web_Security_Fundamentally_Broken.pdf Why Web Security Is Fundamentally Broken - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Payback on Web Attackers: Web Honeypots ==== | ==== Payback on Web Attackers: Web Honeypots ==== | ||
*'''Simon Roses Femerling''' | Architecture | Presentation not available | *'''Simon Roses Femerling''' | Architecture | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Spin the bottle: Coupling technology and SE for one awesome hack ==== | ==== Spin the bottle: Coupling technology and SE for one awesome hack ==== | ||
*'''David Kennedy''' | Attack | Presentation not available | *'''David Kennedy''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Incident Response: Security After Compromise ==== | ==== Incident Response: Security After Compromise ==== | ||
*'''Richard Bejtlich''' | Case Studies | Presentation not available | *'''Richard Bejtlich''' | Case Studies | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 11:00 am - 11:45 am === | === 11:00 am - 11:45 am === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== The Same-Origin Saga ==== | ==== The Same-Origin Saga ==== | ||
*'''Brendan Eich''' | Developer | [https://www.owasp.org/images/a/a2/The_Same-Origin_Saga.pdf The Same-Origin Saga - PDF] | *'''Brendan Eich''' | Developer | [https://www.owasp.org/images/a/a2/The_Same-Origin_Saga.pdf The Same-Origin Saga - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Hack your way to a degree: a new direction in teaching application security at universities ==== | ==== Hack your way to a degree: a new direction in teaching application security at universities ==== | ||
*'''Konstantinos Papapanagiotou''' | Developer | [https://www.owasp.org/images/9/9a/OWASP_Hackademic_AppSecUS2012_v1.pdf Hack your way to a degree: a new direction in teaching application security at universities - PDF] | *'''Konstantinos Papapanagiotou''' | Developer | [https://www.owasp.org/images/9/9a/OWASP_Hackademic_AppSecUS2012_v1.pdf Hack your way to a degree: a new direction in teaching application security at universities - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems ==== | ==== The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems ==== | ||
*'''Dan Cornell, Josh Sokol''' | Architecture | Presentation not available | *'''Dan Cornell, Josh Sokol''' | Architecture | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Blended Threats and JavaScript: A Plan for Permanent Network Compromise ==== | ==== Blended Threats and JavaScript: A Plan for Permanent Network Compromise ==== | ||
*'''Phil Purviance''' | Attack | Presentation not available | *'''Phil Purviance''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards ==== | ==== Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards ==== | ||
*'''Juan Perez-Etchegoyen, Jordan Santarsieri''' | Case Studies | Presentation not available | *'''Juan Perez-Etchegoyen, Jordan Santarsieri''' | Case Studies | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 1:00 pm - 1:45 pm === | === 1:00 pm - 1:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Builders Vs. Breakers ==== | ==== Builders Vs. Breakers ==== | ||
*'''Brett Hardin, Matt Konda, Jon Rose''' | Developer | [https://www.owasp.org/images/8/83/OWASP_AppSec_2012-Builders-vs-Breakers.pdf Builders-vs-Breakers - PDF] | *'''Brett Hardin, Matt Konda, Jon Rose''' | Developer | [https://www.owasp.org/images/8/83/OWASP_AppSec_2012-Builders-vs-Breakers.pdf Builders-vs-Breakers - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Real World Cloud Application Security ==== | ==== Real World Cloud Application Security ==== | ||
*'''Jason Chan''' | Cloud | Presentation not available | *'''Jason Chan''' | Cloud | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== NoSQL, no security? ==== | ==== NoSQL, no security? ==== | ||
*'''Will Urbanski''' | Architecture | Presentation not available | *'''Will Urbanski''' | Architecture | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== SQL Server Exploitation, Escalation, and Pilfering ==== | ==== SQL Server Exploitation, Escalation, and Pilfering ==== | ||
*'''Antti Rantasaari, Scott Sutherland''' | Attack | Presentation not available | *'''Antti Rantasaari, Scott Sutherland''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Iran's real life cyberwar ==== | ==== Iran's real life cyberwar ==== | ||
*'''Phillip Hallam-Baker''' | Case Studies | [https://www.owasp.org/images/5/59/Iran%E2%80%99s_Real_Life_Cyberwar.pdf Iran’s Real Life Cyberwar - PDF] | *'''Phillip Hallam-Baker''' | Case Studies | [https://www.owasp.org/images/5/59/Iran%E2%80%99s_Real_Life_Cyberwar.pdf Iran’s Real Life Cyberwar - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 2:00 pm - 2:45 pm === | === 2:00 pm - 2:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Get off your AMF and don’t REST on JSON ==== | ==== Get off your AMF and don’t REST on JSON ==== | ||
*'''Dan Kuykendall''' | Developer | [https://www.owasp.org/images/2/20/Get_off_your_AMF_and_dont_REST_on_JSON-AppSecUSA2012.pdf Get off your AMF and don’t REST on JSON - PDF] | *'''Dan Kuykendall''' | Developer | [https://www.owasp.org/images/2/20/Get_off_your_AMF_and_dont_REST_on_JSON-AppSecUSA2012.pdf Get off your AMF and don’t REST on JSON - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Unraveling Some of the Mysteries around DOM-Based XSS ==== | ==== Unraveling Some of the Mysteries around DOM-Based XSS ==== | ||
*'''Dave Wichers''' | Developer | [https://www.owasp.org/images/c/c5/Unraveling_some_Mysteries_around_DOM-based_XSS.pdf Unraveling some Mysteries around DOM-based XSS - PDF] | *'''Dave Wichers''' | Developer | [https://www.owasp.org/images/c/c5/Unraveling_some_Mysteries_around_DOM-based_XSS.pdf Unraveling some Mysteries around DOM-based XSS - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs ==== | ==== Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs ==== | ||
*'''Tobias Gondrom''' | Architecture | [https://www.owasp.org/images/f/fe/OWASP_defending-MITMA_US_2012.pdf Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs - PDF] | *'''Tobias Gondrom''' | Architecture | [https://www.owasp.org/images/f/fe/OWASP_defending-MITMA_US_2012.pdf Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== XSS & CSRF with HTML5 - Attack, Exploit and Defense ==== | ==== XSS & CSRF with HTML5 - Attack, Exploit and Defense ==== | ||
*'''Shreeraj Shah''' | Attack | Presentation not available | *'''Shreeraj Shah''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== The Application Security Ponzi Scheme: Stop paying for security failure ==== | ==== The Application Security Ponzi Scheme: Stop paying for security failure ==== | ||
*'''Jarret Raim, Matt Tesauro''' | Case Studies | Presentation not available | *'''Jarret Raim, Matt Tesauro''' | Case Studies | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 3:00 pm - 3:45 pm === | === 3:00 pm - 3:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Using Interactive Static Analysis for Early Detection of Software Vulnerabilities ==== | ==== Using Interactive Static Analysis for Early Detection of Software Vulnerabilities ==== | ||
*'''Bill Chu''' | Developer | [https://www.owasp.org/images/4/46/Interactive_Static_Analysis.pdfInteractive Static Analysis for Early Detection of Software Vulnerabilities - PDF] | *'''Bill Chu''' | Developer | [https://www.owasp.org/images/4/46/Interactive_Static_Analysis.pdfInteractive Static Analysis for Early Detection of Software Vulnerabilities - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Origin(al) Sins ==== | ==== Origin(al) Sins ==== | ||
*'''Alex Russell''' | Developer | Presentation not available | *'''Alex Russell''' | Developer | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== The 7 Qualities of Highly Secure Software ==== | ==== The 7 Qualities of Highly Secure Software ==== | ||
*'''Mano 'dash4rk' Paul''' | Architecture | [https://www.owasp.org/index.php/File:7_Qualities_of_Highly_Secure_Software.pdf 7 Qualities of Highly Secure Software - PDF] | *'''Mano 'dash4rk' Paul''' | Architecture | [https://www.owasp.org/index.php/File:7_Qualities_of_Highly_Secure_Software.pdf 7 Qualities of Highly Secure Software - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Web Framework Vulnerabilities ==== | ==== Web Framework Vulnerabilities ==== | ||
*'''Abraham Kang''' | Attack | [https://www.owasp.org/images/d/db/WebFrameworkVulnerablilitiesAppSecUSA.pdf Web App Framework Based Vulnerabilies - PDF] | *'''Abraham Kang''' | Attack | [https://www.owasp.org/images/d/db/WebFrameworkVulnerablilitiesAppSecUSA.pdf Web App Framework Based Vulnerabilies - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Web App Crypto - A Study in Failure ==== | ==== Web App Crypto - A Study in Failure ==== | ||
*'''Travis H''' | Case Studies | [https://www.owasp.org/images/2/2f/Web_app_crypto_20121026.pdf Web App Cryptology A Study in Failure - PDF] | *'''Travis H''' | Case Studies | [https://www.owasp.org/images/2/2f/Web_app_crypto_20121026.pdf Web App Cryptology A Study in Failure - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
=== 4:00 pm - 4:45 pm === | === 4:00 pm - 4:45 pm === | ||
---- | ---- | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Security at Scale ==== | ==== Security at Scale ==== | ||
*'''Yvan Boily''' | Developer | Presentation not available | *'''Yvan Boily''' | Developer | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Four Axes of Evil ==== | ==== Four Axes of Evil ==== | ||
*'''HD Moore''' | Developer | [https://www.owasp.org/images/6/6f/Four_Axes_of_Evil.pdf Four Axes of Evil - PDF] | *'''HD Moore''' | Developer | [https://www.owasp.org/images/6/6f/Four_Axes_of_Evil.pdf Four Axes of Evil - PDF] | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Pining For the Fjords: The Role of RBAC in Today's Applications ==== | ==== Pining For the Fjords: The Role of RBAC in Today's Applications ==== | ||
*'''Wendy Nather''' | Architecture | Presentation not available | *'''Wendy Nather''' | Architecture | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Counterintelligence Attack Theory ==== | ==== Counterintelligence Attack Theory ==== | ||
*'''Fred Donovan''' | Attack | Presentation not available | *'''Fred Donovan''' | Attack | Presentation not available | ||
| − | + | |- | |
| + | ! scope="col" align="left" width="100%" | | ||
==== Top Strategies to Capture Security Intelligence for Applications ==== | ==== Top Strategies to Capture Security Intelligence for Applications ==== | ||
*'''John Dickson''' | Case Studies | [https://www.owasp.org/images/8/8c/Top_Strategies_to_Capture_Security_Intelligence_for_Applications_OWASP.pdf Top Strategies to Capture Security Intelligence for Applications - PDF] | *'''John Dickson''' | Case Studies | [https://www.owasp.org/images/8/8c/Top_Strategies_to_Capture_Security_Intelligence_for_Applications_OWASP.pdf Top Strategies to Capture Security Intelligence for Applications - PDF] | ||
| + | |} | ||
<br> | <br> | ||
Revision as of 18:18, 18 November 2012
- AppSecUSA Presentations and Talks
- 1 Thursday 25th Oct
- 1.1 10:00 am - 10:45 am
- 1.2 11:00 am - 11:45 am
- 1.2.1 Building a Web Attacker Dashboard with ModSecurity and BeEF
- 1.2.2 Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews
- 1.2.3 Cracking the Code of Mobile Application
- 1.2.4 Hacking .NET Application: Reverse Engineering 101
- 1.2.5 Doing the unstuck: How Rugged cultures drive Biz & AppSec Value
- 1.3 2:00 pm - 2:45 pm
- 1.4 3:00 pm - 3:45 pm
- 1.4.1 Exploiting Internal Network Vulns via the Browser using BeEF Bind
- 1.4.2 The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension)
- 1.4.3 Demystifying Security in the Cloud: AWS Scout
- 1.4.4 I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST
- 1.4.5 Rebooting (secure) software development with continuous deployment
- 1.5 4:00 pm - 4:45 pm
- 2 Friday 26th Oct
- 2.1 10:00 am - 10:45 am
- 2.2 11:00 am - 11:45 am
- 2.2.1 The Same-Origin Saga
- 2.2.2 Hack your way to a degree: a new direction in teaching application security at universities
- 2.2.3 The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems
- 2.2.4 Blended Threats and JavaScript: A Plan for Permanent Network Compromise
- 2.2.5 Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards
- 2.3 1:00 pm - 1:45 pm
- 2.4 2:00 pm - 2:45 pm
- 2.4.1 Get off your AMF and don’t REST on JSON
- 2.4.2 Unraveling Some of the Mysteries around DOM-Based XSS
- 2.4.3 Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
- 2.4.4 XSS & CSRF with HTML5 - Attack, Exploit and Defense
- 2.4.5 The Application Security Ponzi Scheme: Stop paying for security failure
- 2.5 3:00 pm - 3:45 pm
- 2.6 4:00 pm - 4:45 pm
Thursday 25th Oct
10:00 am - 10:45 am
Building Predictable Systems using Behavioral Security Modeling: |Functional Security Requirements
|
|---|
Top Ten Web Defenses
|
Mobile Applications & Proxy Shenanigans
|
Reverse Engineering “Secure” HTTP APIs With An SSL Proxy
|
==== Gauntlt: Rugged by Example ====
|
11:00 am - 11:45 am |
Building a Web Attacker Dashboard with ModSecurity and BeEF
|
Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews
|
Cracking the Code of Mobile Application
|
Hacking .NET Application: Reverse Engineering 101
|
Doing the unstuck: How Rugged cultures drive Biz & AppSec Value
|
2:00 pm - 2:45 pm |
Hacking with WebSockets
|
Bug Bounty Programs
|
How we tear into that little green man
|
AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life
|
Put your robots to work: security automation at Twitter
|
3:00 pm - 3:45 pm |
Exploiting Internal Network Vulns via the Browser using BeEF Bind
|
The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) |
Demystifying Security in the Cloud: AWS Scout
|
I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST
|
Rebooting (secure) software development with continuous deployment
|
4:00 pm - 4:45 pm |
Cross Site Port Scanning
|
Analyzing and Fixing Password Protection Schemes
|
Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods
|
WTF - WAF Testing Framework
|
DevOps Distilled: The DevOps Panel at AppSec USA
|
Friday 26th Oct10:00 am - 10:45 am |
Effective approaches to web application security
|
Why Web Security Is Fundamentally Broken
|
Payback on Web Attackers: Web Honeypots
|
Spin the bottle: Coupling technology and SE for one awesome hack
|
Incident Response: Security After Compromise
|
11:00 am - 11:45 am |
The Same-Origin Saga
|
Hack your way to a degree: a new direction in teaching application security at universities
|
The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems
|
Blended Threats and JavaScript: A Plan for Permanent Network Compromise
|
Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards
|
1:00 pm - 1:45 pm |
Builders Vs. Breakers
|
Real World Cloud Application Security
|
NoSQL, no security?
|
SQL Server Exploitation, Escalation, and Pilfering
|
Iran's real life cyberwar
|
2:00 pm - 2:45 pm |
Get off your AMF and don’t REST on JSON
|
Unraveling Some of the Mysteries around DOM-Based XSS
|
Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs |
XSS & CSRF with HTML5 - Attack, Exploit and Defense
|
The Application Security Ponzi Scheme: Stop paying for security failure
|
3:00 pm - 3:45 pm |
Using Interactive Static Analysis for Early Detection of Software Vulnerabilities
|
Origin(al) Sins
|
The 7 Qualities of Highly Secure Software
|
Web Framework Vulnerabilities
|
Web App Crypto - A Study in Failure
|
4:00 pm - 4:45 pm |
Security at Scale
|
Four Axes of Evil
|
Pining For the Fjords: The Role of RBAC in Today's Applications
|
Counterintelligence Attack Theory
|
Top Strategies to Capture Security Intelligence for Applications
|
