Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Vulnerabilities: A Field Guide

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Ruan Brandão Ruan Brandão
February 08, 2019
Technology
170
0

Web Vulnerabilities: A Field Guide

Slides for the talk presented at RubyFuza & Friends 2019.

Avatar for Ruan Brandão

Ruan Brandão

February 08, 2019

More Decks by Ruan Brandão

See All by Ruan Brandão
Top 10 OWASP: As maiores ameaças para sua aplicação web
Avatar for Ruan Brandão ruanbrandao
0
46
Desenvolvimento de jogos com Elixir
Avatar for Ruan Brandão ruanbrandao
0
51
Algoritmos Racistas
Avatar for Ruan Brandão ruanbrandao
0
110
Software Ethics
Avatar for Ruan Brandão ruanbrandao
2
390
Narrativas no Desenvolvimento de Software
Avatar for Ruan Brandão ruanbrandao
0
300
Ética no Desenvolvimento de Software
Avatar for Ruan Brandão ruanbrandao
4
950
Aplicando o Método Científico no Desenvolvimento de Software
Avatar for Ruan Brandão ruanbrandao
2
310
Internet Personalizada
Avatar for Ruan Brandão ruanbrandao
0
82

Other Decks in Technology

See All in Technology
20260807_第6回_関東kaggler会LT_claw系bot xangiと始める、"寂しくない" kaggle
Avatar for suguuuuuすぐー sugupoko
0
330
研究開発部の紹介 / Sansan R&D Profile
Avatar for Sansan, Inc. sansan33
PRO
4
24k
社内の7割が使うデータ基盤を、 データチーム2人で回すためにやったこと
Avatar for KOH koh_yoshi
4
1.4k
Service Connect 上のサービスに ECS Service の外側から到達できなかった話
Avatar for Itaru Ota ota1022
1
270
会社紹介資料 / Sansan Company Profile
Avatar for Sansan, Inc. sansan33
PRO
24
430k
35分でわかるEffective Platform Engineering
Avatar for nwiizo nwiizo
3
200
What's new in Go 1.27?
Avatar for Koya IWAMURA ciarana
0
210
JavaScript 研修 (2026)
Avatar for Recruit recruitengineers
PRO
2
610
つくって納得、つかって実感！ 大規模言語モデルことはじめ ver2.0
Avatar for Recruit recruitengineers
PRO
5
1.9k
まちスペース®とデジタルツインと「まちづくり」
Avatar for hiro_OGI hiro_ogi
0
130
事業価値と Engineering 2026年度版
Avatar for Recruit recruitengineers
PRO
51
25k
Software Supply Chain Attackからクラウド環境を守るためにできること
Avatar for LHazy lhazy
2
280

Featured

See All Featured
Redefining SEO in the New Era of Traffic Generation
Avatar for Szymon Słowik szymonslowik
1
390
Have SEOs Ruined the Internet? - User Awareness of SEO in 2025
Avatar for Akash Hashmi akashhashmi
0
420
The Spectacular Lies of Maps
Avatar for Per Axbom axbom
PRO
1
920
The Limits of Empathy - UXLibs8
Avatar for Cassini Nazir cassininazir
1
610
Ten Tips & Tricks for a 🌱 transition
Avatar for Manu Carrasco Molina stuffmc
0
170
Marketing Yourself as an Engineer | Alaka | Gurzu
Avatar for Gurzu gurzu
0
280
Odyssey Design
Avatar for Ryan Kendrick rkendrick25
PRO
2
760
Exploring the relationship between traditional SERPs and Gen AI search
Avatar for Ray Grieselhuber raygrieselhuber
PRO
2
4.2k
Abbi's Birthday
Avatar for Violet Bock coloredviolet
3
9.3k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
31
3.3k
Google's AI Overviews - The New Search
Avatar for Barry Adams badams
0
1.1k
SEOcharity - Dark patterns in SEO and UX: How to avoid them and build a more ethical web
Avatar for Sara Fernández Carmona sarafernandez
0
240

Transcript

  1. GOOD MORNING RUBYFUZA ☕

  2. RUAN BRANDÃO SOFTWARE ENGINEER AT MAGNETIS (WE ARE HIRING) TWITTER

    TIMELINE CURATOR @RUANBRANDAO /RUAN-BRANDAO

  3. Photo by Rafaela Biazi on Unsplash

  4. São Paulo

  5. Paulínia - São Paulo

  6. Pipa - Rio Grande do Norte

  7. Made in "

  8. CYBER ATTACKS

  9. WEB VULNERABILITIES A FIELD GUIDE FOR

  10. THE WEB HTTP HTTPS TLS SSL Databases Servers Credentials TCP/IP

    DNS Clusters Cache Browsers

  11. USING COMPONENTS WITH KNOWN VULNERABILITIES

  12. None

  13. UPDATE YOUR APPLICATION DEPENDENCIES Security tip #1

  14. INJECTION ‣ SQL ‣ NOSQL ‣ CODE ‣ COMMANDS

  15. INJECTION VULNERABILITIES ALLOW ATTACKERS TO RUN CODE ON YOUR APPLICATION

    SERVERS

  16. SQL INJECTION

  17. XKCD, available at https://xkcd.com/327/

  18. None

  19. BE CAREFUL WITH THE ORDER METHOD

  20. CODE INJECTION & COMMAND INJECTION

  21. BE EXTRA CAREFUL WITH EVAL AND BACKTICKS

  22. BE CAREFUL WITH CONSTANTIZE

  23. CROSS SITE SCRIPTING (XSS)

  24. CROSS SITE SCRIPTING ALLOWS ATTACKERS TO RUN CODE ON YOUR

    APPLICATION USERS BROWSERS
  25. None
  26. None
  27. None

  28. RAILS DOES THE HARD WORK

  29. BE CAREFUL WITH THE RAW AND HTML_SAFE

  30. NEVER TRUST USER INPUT Security tip #2

  31. BROKEN ACCESS CONTROL

  32. None
  33. None
  34. None
  35. None

  36. BE CAREFUL WITH ACCESS TO SENSIBLE DATA Security tip #3

  37. BROKEN AUTHENTICATION

  38. DO NOT REINVENT THE WHEEL. UNLESS YOU REALLY, REALLY, KNOW

    WHAT YOU ARE DOING. Security tip #4

  39. AND MUCH MORE… ‣ CROSS-SITE REQUEST FORGERY (CSRF) ‣ REMOTE

    CODE EXECUTION (RCE) ‣ SENSITIVE DATA EXPOSURE ‣ SECURITY MISCONFIGURATION
  40. None

  41. Photo by Patrick Tomasso on Unsplash

  42. https://owasp.org

  43. None

  44. Photo by Barn Images on Unsplash

  45. STATIC CODE ANALYSIS

  46. None

  47. TOOLS STATIC CODE ANALYSIS TOOLS

  48. TOOLS STATIC CODE ANALYSIS TOOLS

  49. TOOLS STATIC CODE ANALYSIS TOOLS GitHub - Available at https://github.blog/2017-10-11-a-more-connected-universe/

  50. SECURITY SCANNERS

  51. TOOLS SECURITY SCANNER TOOLS http://www.arachni-scanner.com/

  52. PENETRATION TESTS (PENTESTS)

  53. SECURITY IS NOT A PRODUCT. SECURITY IS AN ONGOING PROCESS.

    Security tip #0

  54. THANK YOU! ❤ @RUANBRANDAO /RUAN-BRANDAO