WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Are attackers using basic directory escapes to bypass your filters and steal SSH keys? Discover the exact Node.js API sequence needed to permanently neutralize path traversal attacks.

Pause
Mute Enter Fullscreen
#1 about 4 min

Defining and executing a basic path traversal attack

How directory traversal exploits insecure coding workflows to expose unauthorized files through untracked user inputs.

#2 about 2 min

Recognizing the systemic impacts of path traversal attacks

Why directory traversal enables severe consequences like sensitive information exposure and deep vulnerability chaining.

#3 about 3 min

Examining real-world zero-day exploits in enterprise applications

How high-profile vulnerabilities in server infrastructure expose sensitive credentials and source code directories.

#4 about 1 min

Working securely with Node.js path application programming interfaces

Understanding the native functions responsible for concatenating, resolving, and sanitizing local directory paths.

#5 about 7 min

Bypassing incomplete validation filters using malicious URL encoding

How attackers exploit percent-encoding to bypass incomplete path validation logic across static file servers.

#6 about 6 min

Exploiting path traversal vulnerabilities in code editor extensions

How compromised local development integrations grant unauthorized external access to personal system configurations and credentials.

#7 about 4 min

Identifying underlying Node.js runtime vulnerabilities using fuzzing tools

Leveraging offensive security payloads to automatically discover missing sanitization logic during application framework execution.

#8 about 4 min

Mitigating vulnerabilities with automated scanning and secure practices

Implementing automated static application testing within local editor environments to continuously prevent directory traversal injections.

Matching moments

26:47 min

Exploring pathways to application security careers and research workflows

Vandana Verma Sehgal · LIVE

1:44 min

Evaluating framework architectures against cross-site scripting attack vectors

Philippe De Ryck · LIVE

2:12 min

Analyzing real-world structural vulnerabilities in popular npm dependency packages

Liran Tal Liran Tal · World Congress 2025

2:46 min

Mapping the complete software supply chain attack surface

Matthew Brady Matthew Brady · World Congress 2026 Europe

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

3:02 min

Uncovering hidden vulnerabilities and bloat in web ecosystems

Chris Heilmann +2 · LIVE

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 24, 2026 · 12:15–12:45

Stage 6

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 25, 2026 · 14:50–15:20

Outdoor Stage

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Capture the Flag 101 thumbnail
27:11
World Congress 2022 • over 4 years ago

Capture the Flag 101

Micah Silverman

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.