WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

Capture the Flag 101

Micah Silverman

Is a widely used package secretly compromising your Node.js runtime? Adopt a "hack yourself" mindset with Capture the Flag exercises to proactively exploit and patch hidden architectural vulnerabilities.

Pause
Mute Enter Fullscreen
#1 about 5 min

Introduction to cloud-native application developer security

How shifting security to developers changes traditional approaches to application safety.

#2 about 3 min

Learning application security through capture the flag events

How complex cross-functional challenges encourage practical learning and out-of-the-box thinking.

#3 about 3 min

Understanding flags and collaborative rules of engagement

Finding alphanumeric solution codes while sharing progress without spoiling the challenge.

#4 about 3 min

Setting up the invisible ink web vulnerability challenge

Gathering provided files and interface hints to start solving the web application security puzzle.

#5 about 2 min

Utilizing basic HTTP verbs for security exploration

Reviewing get, post, and delete methods to understand how data interacts with the RESTful server.

#6 about 6 min

Interacting with payloads and content types using curl

Sending command line requests to test server responses and discover tainted data flows.

#7 about 2 min

Identifying prototype pollution vulnerabilities with scanning tools

Running a security scan against the package configuration to discover prototype pollution flaws.

#8 about 8 min

Exploiting lodash merge functions via prototype pollution

Using practical proof of concepts to inject arbitrary data into JavaScript object prototypes.

Matching moments

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

3:55 min

Identifying underlying Node.js runtime vulnerabilities using fuzzing tools

Sonya Moisset · WWC 2023

26:47 min

Exploring pathways to application security careers and research workflows

Vandana Verma Sehgal · LIVE

2:41 min

Setting the stage for software security demos

Vandana Verma Sehgal · LIVE

4:35 min

Improving developer education with realistic security training environments

Joseph Katsioloudes Joseph Katsioloudes · WWC 2025

3:58 min

Exploring advanced security tooling and community dependency vetting

Niels Tanis Niels Tanis · WWC 2024

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
almost 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
about 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
about 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
about 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
about 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
about 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
WWC 2023 • almost 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • almost 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 5 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
WWC 2025 • 12 months ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

101 Typical Security Pitfalls thumbnail
28:41
WWC 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.