How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Anything a user sends is an injection vector, including cookies and JWTs. Learn to break things safely to build more resilient applications.

#1about 2 minutes

Bridging the communication gap between developers and security

Security and development teams often work in silos, but collaboration is essential for building secure products from the start.

#2about 3 minutes

An overview of classic and modern injection attacks

The workshop covers a range of vulnerabilities from classic SQL injection and XSS to modern threats like template and AI prompt injection.

#3about 2 minutes

How SSRF exploits cloud metadata services in microservices

Server-Side Request Forgery (SSRF) is a critical vulnerability in cloud-native applications that can allow attackers to access sensitive metadata servers.

#4about 3 minutes

Weaponizing cookies and JWTs for denial of service

Attackers can cause a denial-of-service by bloating JSON Web Tokens (JWTs) in cookies to overwhelm and bottleneck backend authentication systems.

#5about 5 minutes

A practical demo of a command injection vulnerability

A hands-on demonstration shows how a command injection in a file export feature can be used to execute arbitrary commands on the server.

#6about 6 minutes

The dangerous trend of prioritizing speed over security

The pressure to ship features quickly leads to half-baked products and a culture where security is treated as an afterthought, creating significant risk.

#7about 7 minutes

Adopting a proactive mindset for secure development

Developers can prevent vulnerabilities by moving away from "magical thinking" about libraries and actively breaking their own code to find flaws early.

#8about 7 minutes

A horror story of hardcoded and shared secrets

A real-world example illustrates the common but dangerous practice of committing secrets to git and sharing passwords in plain text files.

#9about 5 minutes

How flawed password policies create predictable vulnerabilities

A financial institution's policy of monthly password rotation led to users adopting a simple, predictable pattern that defeated the security measure entirely.