Which is the username and password to access where I see the tools?
@venkaiahbolineedi Жыл бұрын
Nice video
@terry5246 Жыл бұрын
Is this the infamous pedophile SuperDaE?
@arsalananwar3397 Жыл бұрын
nice session
@chief_rasko2 жыл бұрын
Rainbow Unicorn Attack anyone? 🔔
@philipyourdis21242 жыл бұрын
Come back home Dylan
@Scotty1139172 жыл бұрын
Interesting, informative, and chocked full of chuckles. Looking forward to the periodic refresh of this video through 2024.
@JoeCupano2 жыл бұрын
Well done !
@JavierVegaPerry3 жыл бұрын
I'm just about to sign up for my OWASP Membership, but there is a factor that is still unclear to me, when i become a member do i have access to additional resources from OWASP? Like documentation, best practices and all that? I want to support OWASP, and ive been following OWASP for some years now, but the main "benefit" i see on the membership site are discounts so i dont really know if i get "under the hood" of security resources to improve my knowledge, thanks in advance.
@OWASPLondon3 жыл бұрын
Documentation, best practices, standards, tools, meetups, talks, KZfaq recordings are all FREE - you don't have to be an OWASP member to enjoy that. For membership benefits please checkout this 1-minute video: kzfaq.info/get/bejne/ipikn8aL2L_Ym6M.html
@Kas_Styles3 жыл бұрын
2:00
@cyphear023 жыл бұрын
Great talk! I could be wrong, but I don't believe burp was forked from Paros (mentioned at the very end).
@drop86373 жыл бұрын
Guys I think the title is wrong... is it 2021 no?
@ekahraman73893 жыл бұрын
Awesome!
@jagmarc3 жыл бұрын
.he .oundtrack is .ery .istorted. .he start of .early every word .s .ut .ff. .akes it .ery .ifficult to .nderstand
@harlandsanders8943 жыл бұрын
This guy fled Australia because of Child Exploitation Material charges...
@cameronsimon10743 жыл бұрын
Not True - he fled Australia because of accusations of hacking Microsoft and downloading the designs of XBOX: kzfaq.info/get/bejne/is6ZgpqTyayUZXU.html
@harlandsanders8943 жыл бұрын
@@cameronsimon1074He fled a number of charges including drug and sex crimes, but he was never formally charged with hacking. www.pcworld.idg.com.au/article/525172/australian_who_boasted_hacking_plead_guilty_charges_stemming_from_raid/ Also if you pause your video at 4:57 you can clearly see on his original warrant "6x possess indecent or obscene articles; 7x Possessed child exploitation material"
@andleebzaib4893 жыл бұрын
Is there a course available that would help me understand the script of rules?
@securestep93 жыл бұрын
There is a book - ModSecurity handbook: www.feistyduck.com/library/modsecurity-handbook-free/online/ch01-introduction.html
@andleebzaib4893 жыл бұрын
@@securestep9 Thank you. It looks great and beginner friendly. I have found another more detailed book as well.
01:25 what is API ? 01:55 who uses API ? beating heart of every modern applications 02:52 agenda 03:29 client devices are becoming varied and stronger 04:35 flow of information 05:30 traditional application 05:48 in the modern applications 06:23 less abstraction layers, JSON language 06:36 server is more used as proxy for data 06:40 the rendering component is the client not the server 06:45 client consume raw data, API's exposes the underlying implementation of the app 06:50 the API's expose underlying implementation of the app 07:03 and the user's state is monitored and maintained by the client 07:35 REST AP standard, predictable entry point 08:03 Traditional vulnerabilities are less common in API-Based applications, SQLi, ORM's, CSRF 08:26 Path Manipulations are very different with Cloud-based storage 08:39 SaaS, 08:47 DevOps, API's change all the time, 09:38 planned projects 10:30 Roadmap 11:22 the creation process of the top ten 11:58 API Security Top 10 ------------------------------------------------------------------------- Inon Shkedy ------------------------------------------------------------------------- 13:04 IDF red team, Israeli army 13:37 silicon valley, CI/CD, cloud-based, CSRF 14:12 authorization, decentralized, something very spread in the API 14:57 it's really hard to create a good authorization mechanism with API ------------------------------------------------------------------------- 15:21 A1, IDOR, BOLA 16:28 by far the most common vulnerabilities in API, it's not about ID its about a lack of authorization 18:37 BOLA, UBER, full account takeover, Anand Prakash ------------------------------------------------------------------------- 19:21 A2, Broken Authentication, Facebook, full account takeover ------------------------------------------------------------------------- 21:43 A3 Excessive Data Exposure, dating app 23:07 Why ? API economy, 3fun, example, Alex Lomas ------------------------------------------------------------------------- 24:32 A4 Lack of resources & rate limiting ------------------------------------------------------------------------- 25:00 A5 Broken Function Level Authorization, BFLA 27:38 Function Level Authorization, different roles 28:00 Shopify, lack of the validation of the user role ------------------------------------------------------------------------- 28:22 A6 Mass Assignment, Ruby on Rails, Node.js, black magic 30:24 Why is so common in API's, mass assignment is a bit tricky vulnerability 32:28 James Kettle, example ------------------------------------------------------------------------- 32:38 A7 Security misconfiguration ------------------------------------------------------------------------- 32:59 A8 Injection, why from A1 to A8 ?, ORM's ------------------------------------------------------------------------- 34:05 A9 Improper Asset management 35:02 Unknown API hosts, CI/CD ------------------------------------------------------------------------- 36:11 A10 Insufficient logging, monitoring 37:09 First thing to do, A9
@boneydsilva4 жыл бұрын
why...i did not get one bit
@grantgitgude56044 жыл бұрын
I like that he makes note of how no one reads the documentation and that is where the answers are. I have screwed myself over many lost hours by just searching instead of reading the docs. The HUD is great. Thanks OWASP.
@azeyn20504 жыл бұрын
Awesome!
@veraearnherewebemmynitehac30154 жыл бұрын
I really do appreciate fextyhackers.wordpress,com for the $45,000 i got from them
@x11Mircale4 жыл бұрын
Awesome Video for security gurus. i will make sure to read the book.
@farrir31754 жыл бұрын
Great talk, very informative and still entertaining. Thanks for sharing!
@reviczka4 жыл бұрын
Being in the audience with representations across the board including large financial services, the talk was merely touching responsible disclosure. It was clearly stated which actions would be a breach of the computer misuse act. See also: kzfaq.info/get/bejne/jJyIndil25e4pWw.html
@rootEth4 жыл бұрын
Surprised to see OWASP hosting a talk in which the speaker openly admits to breaches of the Computer Misuse Act. Even more surprised to see it uploaded!
@grantongers98244 жыл бұрын
I don't think you were in the audience, where you? While the methods described are very much on the border of legality (in my not legal and very humble opinion) the GCHQ folks present declined to arrest the speakers as they felt it perfectly legal. They instead asked questions of them and agreed that the CMA probably needed an update to make this discrepancy more clear. Also, as this talk was a last minute addition I don't think that the London team could possibly have known the details of it, even if illegal activities might have been discussed. As it turned out there was a lot to learn from the talk and the OWASP London policy of publishing everything said at these meetups is very much aligned with the Open in OWASP, I feel.
@omegacon44 жыл бұрын
Given the complexities of cybercrime, it often takes a former criminal to defeat future ones. We are lucky that he decided to turn his life around and devote it to white hat cyber work.
@philipyourdis21242 жыл бұрын
Considering Dylan Wheeler is wanted in Australia for possession of child exploitation material it does seem strange OWASP would choose to upload
@badrequests89424 жыл бұрын
2019 and OWASP uploads a youtube video in 360p
@junokim35074 жыл бұрын
bullshit
@michael-gary-scott4 жыл бұрын
thank you for the thank you :-)
4 жыл бұрын
If you want to help to get the full Juice Shop jingle done (kzfaq.info/get/bejne/jr6bgLyQu9-uXY0.html) this is the GitHub issue you need to upvote: github.com/braimee/bpatty/issues/13
@zeeshanmustafa79824 жыл бұрын
Why the resolution is so low ? About 360p ?
@scottreynolds35695 жыл бұрын
Nice. Thats what i been waiting for :-D
@kristophergunnar95513 жыл бұрын
i know it is kinda randomly asking but do anybody know of a good site to watch newly released movies online?
@gaellucas87053 жыл бұрын
@Kristopher Gunnar Ehh try flixportal. just google for it:) -gael
@kristophergunnar95513 жыл бұрын
@Gael Lucas thanks, I went there and it seems like a nice service :D I really appreciate it !!
@gaellucas87053 жыл бұрын
@Kristopher Gunnar Happy to help =)
@b1twis35 жыл бұрын
Wow, a lot of useful information. Got inspired to build a new idea. Thank you so much and appreciate your efforts Ibrahim.
@rajburnwal1895 жыл бұрын
You have not shown the process of AJAX spider? Could you please give me details the process of the same?
@PyMasters-r8h5 жыл бұрын
this worked great for me: www.we45.com/blog/how-to-integrate-zap-into-jenkins-ci-pipeline-we45-blog
@petervangeenhoven69915 жыл бұрын
Thanks man! Sure there are some that complain about the audio but the info is there for those who need it. Very useful for me in any case!
@patelanshul5 жыл бұрын
Thanks for the video, it helped me understand lot of concepts ! Kudos !!
@evangelosmorakis97365 жыл бұрын
What's great to see apart from the speaker obviously is Greg in a suit!!!!
@manjesh43596 жыл бұрын
This is a very useful topic ,why donot you release it with good quality? there is no audio / poor audio in most the places
@sebastiansimon75576 жыл бұрын
As to how the `let` code at 1:34 works, see stackoverflow.com/q/49604335/4642212.
@ValeTheVale6 жыл бұрын
Hi, how I create a Zaproxy_home if I work on Ubuntu?
@vimalmishra86936 жыл бұрын
Vedio has good topic . but need better explanation which will help user. allot . else this is like other video to just dump on youtube and most people watch luck by chance !!!
@stuartwinter-tear69567 жыл бұрын
Superb talk and shocking, to be frank. Wow.
@brunodiego39477 жыл бұрын
Hi Goran, very good your demo. A couple of question because I am trying to do a demo for my developers team in my work, but I can't make it to work. Maybe is because I use 2 Ubuntu servers without graphical user interface. For what I can see in this video demo you run the Jenkins in Windows server (Or desktop edition) machine right ? how many virtual servers yo use in this demo? just one? thanks in advise for any help that you can give me My best regards Diego
@gorandev73147 жыл бұрын
I'm really sorry for not replying earlier. I don't actively check the video comments and i don't receive notifications on new comments since i didn't do the upload personally. To you can easily contact me by email or via the google group:groups.google.com/forum/#!forum/zaproxy-jenkins To answer your questions (better late than never). The demo itself was run on a single jenkins master (localhost) VM which was running WIndows 10 which initiated a zap proxy scan on the same VM (localhost). The plugin supports being run remotely. In my own environment i am running Jenkins on Ubuntu 16.04.2 LTS and i have a Slave machine running Windows 10 which has ZAP installed on it. They are both GUI. ZAP can be run without a UI but you'll have to ask in the groups.google.com/forum/#!forum/zaproxy-users on how to make the necessary changes/configurations which the jenkins plugin requires. You can find a full tutorial at wiki.jenkins-ci.org/display/JENKINS/zap+plugin. I hope that helps, if you have any further questions. Please direct them to the zaproxy-jenkins google group :) Cheers Goran.
@desparanto7 жыл бұрын
For this to work ZAP itself needs to have the export report and custom report plugins. zap 2.6.0 and a bunch of other stuff - this tutorial is not fully accurate.
@bilalmazhar1007 жыл бұрын
great video
@bilalmazhar1007 жыл бұрын
where i can see full video of this presentation ??????????
@OWASPLondon7 жыл бұрын
full video is here: kzfaq.info/get/bejne/iNlhia6hz7zaZps.html