Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Vulnerabilities: A Field Guide

Avatar for Ruan Brandão Ruan Brandão
February 08, 2019
Technology
170
0

Web Vulnerabilities: A Field Guide

Slides for the talk presented at RubyFuza & Friends 2019.

Avatar for Ruan Brandão

Ruan Brandão

February 08, 2019

More Decks by Ruan Brandão

See All by Ruan Brandão
Top 10 OWASP: As maiores ameaças para sua aplicação web
Avatar for Ruan Brandão ruanbrandao
0
47
Desenvolvimento de jogos com Elixir
Avatar for Ruan Brandão ruanbrandao
0
52
Algoritmos Racistas
Avatar for Ruan Brandão ruanbrandao
0
120
Software Ethics
Avatar for Ruan Brandão ruanbrandao
2
390
Narrativas no Desenvolvimento de Software
Avatar for Ruan Brandão ruanbrandao
0
310
Ética no Desenvolvimento de Software
Avatar for Ruan Brandão ruanbrandao
4
960
Aplicando o Método Científico no Desenvolvimento de Software
Avatar for Ruan Brandão ruanbrandao
2
310
Internet Personalizada
Avatar for Ruan Brandão ruanbrandao
0
82

Other Decks in Technology

See All in Technology
設計の世代交代を乗り越える、14年続くAndroidアプリの開発戦略
Avatar for SansanTech sansantech
PRO
1
110
Azure Cost Management の FOCUS コストデータを迷わず読むための“3つの軸”
Avatar for Tetsuya Odashima tetsuyaooooo
0
140
Bet AI Day 2026丨AIによって本質に戻るシステムリスク管理
Avatar for LayerX layerx
PRO
0
790
【Oracle AI Spotlight ウェビナー】AWSか、Azureか、Google Cloudか。その議論にオラクルを含める意義。
Avatar for oracle4engineer oracle4engineer
PRO
2
220
データエンジニアの困りごとをDevinと一緒に解消する
Avatar for 10xinc 10xinc
2
780
AI時代におけるプロダクト横断勉強会の設計
Avatar for ZOZO Developers zozotech
PRO
0
150
V8コントリビュート超入門
Avatar for Riya Amemiya riyaamemiya
0
130
AIとペアプロを始める。人とのペアプロをやめる。ペアプロの良さを改めて知る。もっと好きになった。 / Rediscovering Pair Programming
Avatar for yuki honyanya
1
190
ブラウザアプリの継続的パフォーマンスモニタリング (序) / Continuous Browser Application Performance Monitoring; Act 1
Avatar for moznion moznion
0
100
KAEN Company Deck
Avatar for 株式会社KAEN kaen
PRO
0
290
2026-09-04 SRE Tech Talk #15 怠惰なTerraform / Lazy Terraform
Avatar for SUZUKI Masashi masasuzu
0
170
[RSJ26] Building a VLA Model Based on Self-Distilled Classification
Avatar for Semantic Machine Intelligence Lab., Keio Univ. keio_smilab
PRO
0
190

Featured

See All Featured
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
49
10k
Joys of Absence: A Defence of Solitary Play
Avatar for Sebastian Deterding codingconduct
1
460
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
10k
Gemini Prompt Engineering: Practical Techniques for Tangible AI Outcomes
Avatar for Mfonobong Umondia mfonobong
2
510
Self-Hosted WebAssembly Runtime for Runtime-Neutral Checkpoint/Restore in Edge–Cloud Continuum
Avatar for Yuki Nakata chikuwait chikuwait
0
760
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
15k
Navigating Team Friction
Avatar for Lara Hogan lara
192
16k
How to Grow Your eCommerce with AI & Automation
Avatar for Katarina Dahlin katarinadahlin
PRO
1
260
AI in Enterprises - Java and Open Source to the Rescue
Avatar for ivargrimstad ivargrimstad
0
1.4k
SEOcharity - Dark patterns in SEO and UX: How to avoid them and build a more ethical web
Avatar for Sara Fernández Carmona sarafernandez
0
260
HU Berlin: Industrial-Strength Natural Language Processing with spaCy and Prodigy
Avatar for Ines Montani inesmontani
PRO
0
680
Building Adaptive Systems
Avatar for Chris Keathley keathley
44
3.2k

Transcript

  1. GOOD MORNING RUBYFUZA ☕

  2. RUAN BRANDÃO SOFTWARE ENGINEER AT MAGNETIS (WE ARE HIRING) TWITTER

    TIMELINE CURATOR @RUANBRANDAO /RUAN-BRANDAO

  3. Photo by Rafaela Biazi on Unsplash

  4. São Paulo

  5. Paulínia - São Paulo

  6. Pipa - Rio Grande do Norte

  7. Made in "

  8. CYBER ATTACKS

  9. WEB VULNERABILITIES A FIELD GUIDE FOR

  10. THE WEB HTTP HTTPS TLS SSL Databases Servers Credentials TCP/IP

    DNS Clusters Cache Browsers

  11. USING COMPONENTS WITH KNOWN VULNERABILITIES

  12. None

  13. UPDATE YOUR APPLICATION DEPENDENCIES Security tip #1

  14. INJECTION ‣ SQL ‣ NOSQL ‣ CODE ‣ COMMANDS

  15. INJECTION VULNERABILITIES ALLOW ATTACKERS TO RUN CODE ON YOUR APPLICATION

    SERVERS

  16. SQL INJECTION

  17. XKCD, available at https://xkcd.com/327/

  18. None

  19. BE CAREFUL WITH THE ORDER METHOD

  20. CODE INJECTION & COMMAND INJECTION

  21. BE EXTRA CAREFUL WITH EVAL AND BACKTICKS

  22. BE CAREFUL WITH CONSTANTIZE

  23. CROSS SITE SCRIPTING (XSS)

  24. CROSS SITE SCRIPTING ALLOWS ATTACKERS TO RUN CODE ON YOUR

    APPLICATION USERS BROWSERS
  25. None
  26. None
  27. None

  28. RAILS DOES THE HARD WORK

  29. BE CAREFUL WITH THE RAW AND HTML_SAFE

  30. NEVER TRUST USER INPUT Security tip #2

  31. BROKEN ACCESS CONTROL

  32. None
  33. None
  34. None
  35. None

  36. BE CAREFUL WITH ACCESS TO SENSIBLE DATA Security tip #3

  37. BROKEN AUTHENTICATION

  38. DO NOT REINVENT THE WHEEL. UNLESS YOU REALLY, REALLY, KNOW

    WHAT YOU ARE DOING. Security tip #4

  39. AND MUCH MORE… ‣ CROSS-SITE REQUEST FORGERY (CSRF) ‣ REMOTE

    CODE EXECUTION (RCE) ‣ SENSITIVE DATA EXPOSURE ‣ SECURITY MISCONFIGURATION
  40. None

  41. Photo by Patrick Tomasso on Unsplash

  42. https://owasp.org

  43. None

  44. Photo by Barn Images on Unsplash

  45. STATIC CODE ANALYSIS

  46. None

  47. TOOLS STATIC CODE ANALYSIS TOOLS

  48. TOOLS STATIC CODE ANALYSIS TOOLS

  49. TOOLS STATIC CODE ANALYSIS TOOLS GitHub - Available at https://github.blog/2017-10-11-a-more-connected-universe/

  50. SECURITY SCANNERS

  51. TOOLS SECURITY SCANNER TOOLS http://www.arachni-scanner.com/

  52. PENETRATION TESTS (PENTESTS)

  53. SECURITY IS NOT A PRODUCT. SECURITY IS AN ONGOING PROCESS.

    Security tip #0

  54. THANK YOU! ❤ @RUANBRANDAO /RUAN-BRANDAO