BSidesKC 2018 - Andy Nelson - Injection Attacks: Defending an Application Takedown

Описание: With the release of the OWASP (Open Web Application Security Project) Top 10 for 2017, injection is again at the top of the list. As software engineers, most of us are aware that injection attacks exist. However, we are rarely aware of how easy they are to perform or what it takes to defend them. In this talk, I will create a simple test application that has some injection vulnerabilities that you might find in applications you work on today. Then I will show you how easy they are to exploit both manually and with “h4ck3r t00lz”. Lastly, I will show you how to change your code to defend against these attacks. If you are a software engineer developing with Rails or JAX-RS that wants to have a better understanding of how easy it is to defend your application, then this talk is for you.