Free

OWASP Vancouver - Finding High-Risk Web Vulnerabilities with a Small Number...

Event Information

Share this event

Date and Time

Location

Location

TBA

Vancouver, BC

Canada

View Map

Event description

Description

Speaker: Miles (San-Tsai) Sun

Abstract: Using a small number of generic payloads to discover high-risk web vulnerabilities (e.g., SQL injection, Remote Code Execution) is highly desirable during a penetration test. In this talk, I will present and demonstrate a lightweight vulnerability detection approach complimenting to traditional automatic scanners. Using an expression probing technique, this approach can systematically probe whether user-controlled input is treated as code by the server-side program logic, as well as the situational context of the injected payload, and its underlying language. Compared to automatic vulnerability scanners, this approach imposes tiny network footprint (e.g., quick, negligible system impact, avoid IP blocking), is agnostic to application platform/language, and friendly to Web Application Firewall/Intrusion Detection and Prevention System. This lightweight detection technique could address or reduce many common challenges faced by penetration testers.

Speaker Bio: San-Tsai Sun is a passionate information security professional and researcher. With more than 20 years of expertise in system development and application security, he is currently an Advanced Security Engineer at Staples, where he enjoys his work in penetration test, static/dynamic vulnerability scan, source code review, risk analysis/threat modeling, and application security design consultancy. Prior to Staples, he was a Senior Information Security Consultant at HSBC Bank. San-Tsai holds a PhD in Information Security from the University of British Columbia, and has been helping hundred of websites to address high risk security vulnerabilities found on their sites.

Share with friends

Date and Time

Location

TBA

Vancouver, BC

Canada

View Map

Save This Event

Event Saved