WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

Capture the Flag 101

Micah Silverman

Is a widely used package secretly compromising your Node.js runtime? Adopt a "hack yourself" mindset with Capture the Flag exercises to proactively exploit and patch hidden architectural vulnerabilities.

Pause
Mute Enter Fullscreen
#1 about 5 min

Introduction to cloud-native application developer security

How shifting security to developers changes traditional approaches to application safety.

#2 about 3 min

Learning application security through capture the flag events

How complex cross-functional challenges encourage practical learning and out-of-the-box thinking.

#3 about 3 min

Understanding flags and collaborative rules of engagement

Finding alphanumeric solution codes while sharing progress without spoiling the challenge.

#4 about 3 min

Setting up the invisible ink web vulnerability challenge

Gathering provided files and interface hints to start solving the web application security puzzle.

#5 about 2 min

Utilizing basic HTTP verbs for security exploration

Reviewing get, post, and delete methods to understand how data interacts with the RESTful server.

#6 about 6 min

Interacting with payloads and content types using curl

Sending command line requests to test server responses and discover tainted data flows.

#7 about 2 min

Identifying prototype pollution vulnerabilities with scanning tools

Running a security scan against the package configuration to discover prototype pollution flaws.

#8 about 8 min

Exploiting lodash merge functions via prototype pollution

Using practical proof of concepts to inject arbitrary data into JavaScript object prototypes.

Matching moments

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

3:55 min

Identifying underlying Node.js runtime vulnerabilities using fuzzing tools

Sonya Moisset · World Congress 2023

26:47 min

Exploring pathways to application security careers and research workflows

Vandana Verma Sehgal · LIVE

2:41 min

Setting the stage for software security demos

Vandana Verma Sehgal · LIVE

4:35 min

Improving developer education with realistic security training environments

Joseph Katsioloudes Joseph Katsioloudes · World Congress 2025

3:58 min

Exploring advanced security tooling and community dependency vetting

Niels Tanis Niels Tanis · World Congress 2024

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
about 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
over 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
over 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
over 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
over 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
over 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 25, 2026 · 14:50–15:20

Outdoor Stage

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 16:00–18:00

Stage 13

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
World Congress 2023 • almost 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
World Congress 2025 • about 1 year ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.