JavaScript is not available.

Feb 3

On Tuesday, we're excited to welcome Laura Bell Main, Founder of safestack and influential information security advocate (@lady_nerd). We’re pushing the usual start time to 3 PM EST/ 1PM MST to work with int’l schedules, so look for the livestream then: youtube.com/live/xc7S5BvdQ

Feb 3

On Tuesday, we're excited to welcome Laura Bell Main, Founder of safestack and influential information security advocate (

@lady_nerd

). We’re pushing the usual start time to 3 PM EST/ 1PM MST to work with int’l schedules, so look for the livestream then: youtube.com/live/xc7S5BvdQ

Feb 1

Hey Everyone, a stand-alone video of the Absolute AppSec panel at

@CactusCon

is available now. See what

, and

have to say about the current state of Application Security! Thanks to everyone who attended! Link here:

The State of (Absolute) AppSec at CactusCon11 on January 28, 2023

Absolute AppSec’s cactuscon11 panel was held on January 28th where Mike McCabe (@mccabe615 on twitter) and cactuscon founder Andrew Wilson (@kuzushi) join S...

Jan 31

Referencing the past where paved paths and security considerations at Netflix made the company a beacon for appsec professionals,

says, "today

is the new netflix of security." We're going to follow

's rec on this. 😀

Now discussing the threat model behind

's key protection developments with reference to

@askjeevansingh

as a TM expert. It's worth watching his discussion with seth and ken here:

Absolute AppSec Ep #131 - Jeevan Singh - Threat Modeling

Jeevan Singh from Segment joins Seth and Ken to discuss the recently-released, open source threat modeling training material.

Some additional context: an academic paper on secret leakage in github repos: ndss-symposium.org/wp-content/upl

The explanation

provides for the partnership between

Behind GitHub's new authentication token formats | The GitHub Blog

and

@github

for dealing with API token secrets relates to this context of gh developments:

github.blog

We’re excited to share a deep dive into how our new authentication token formats are built and how these improvements are keeping your tokens more secure. As we continue to focus on the security of...

You can catch up with Sal at

@BSidesSF

where he'll be talking on API token security.

bsidessf.org

BSidesSF

BSidesSF 2023 will be held April 22-23, 2023! We can't wait to share the Next Big Thing! Call for Participation is closed! Decisions will be sent on or around January 24, 2023. Check t...

Sal is discussing his career trajectory that brought him to

How Twilio Segment proactively protects customer’s API tokens

. We will be discussing his blogpost that has just recently gone live on API key security:

segment.com

Explore how Segment's Security Features Team built solutions to protect customers from committed and orphaned secrets.

For those interested, the practical secure-code review course is being offered at

@defcon

Seattle:

instagram.com

DEF CON (@wearedefcon) • Instagram photo

The Absolute AppSec live show with

@0x102c

is starting up now right here:

Absolute AppSec Ep. with Sal Olivares

Sal Olivares, Senior Software Engineer from segment.io, joins Seth and Ken to discuss recent projects.

Show this thread

Absolute AppSec Retweeted

Sal is live on

in 15 minutes to chat about this work! youtu.be/zCN-iWnaHOo

This Tweet is unavailable.

Jan 30

Tomorrow, we are excited to have

@0x102c

on the livestream. We’ll be discussing #APIsecurity and recent

work. Sal also will be

@BSidesSF

discussing protecting customer API keys. Join

and

at 12 Noon Eastern for more: youtu.be/zCN-iWnaHOo

Promo for Absolute AppSec livestream with Sal Olivares tomorrow at the youtube link provided in the post.

read image description

ALT

Jan 28

AppSec programs are improved by a layered approach, says

. Bug Bounty finds edge cases, tooling finds low-hanging fruit, the appsec team is there mainly for advice. It's all part of the larger program.

Arguing for improving conditions,

@kuzushi

says that secure defaults have done more for improving the state of appsec than about anything else.

Also joining is the estimable Andrew Wilson from

State of (Absolute) AppSec (2023) At

@cactuscon

. A live episode is starting up right now are Absolute AppSec’s YouTube livestream. Join

and

Don't Skimp on Security: Add These Must-Have Features to Your Web Apps

as they’re joined by

@mccabe615

. Catch up with the zeitgeist: youtu.be/dAQCwt8n6Ik

Ken brings up a potentially useful tool, an imagemagick security policy evaluator. blog.doyensec.com/2023/01/10/ima

Next topic: What security features should devs add to web apps? From

@AshAllenDesign

dev.to

Introduction As web developers, we're all usually pretty security-conscious and aware of...

Microservice reviews are best tested in context with the related app and, as

Seth Law - Practical Code Review

points out, it should be tested dynamically because that's where these kind of edge-cases are found.

Discussing edge-case bypasses to regular expressions intended to protect access to microservices. Seth talks through both x-forward-by and url-encoding bypasses.

First topic inspired by slack discussion.

@misfir3

's question.

Slack question: Any folks have insights on secure code review relative to microservices … how you potentially approach it differently from ‘monoliths’?
Namely thinking of ID’ing potentially risky ‘attack surfaces’ (and I’m primarily thinking of inputs as ‘attack surfaces’ in this scenario, but also realize I might have the wrong model there)

read image description

ALT

This is a reminder to come join the Absolute AppSec Slack channel! Given recent news, be aware we have a job channel in there as well as our lively topical discussions. join.slack.com/t/absoluteapps

Secure-Code Review is coming to DefCon in Bellevue. For more information, check the web page here:

training.defcon.org

Trainer(s) bio: Ken Johnson Ken Johnson, has been hacking web applications professionally for 12 years and given security training for 9 of those years. Ken is both a breaker and builder and curren...

Running live now! Come see us if you're at

@cactuscon

. We're doing a workshop Saturday morning, and then a 'State of AppSec' panel in the afternoon. Some collection of guests will be there, including

Oyez Oyez! Please be apprised that Absolute AppSec episode 196 with the honorable

and

will be hold court regarding must-have microservices at 12 NOON Eastern time. (Preamble means you are now legally obligated to tune in.) Link here:

Absolute AppSec Ep. #196 - API Reviews, Web App Security Features

Seth and Ken dig into a topic that was raised by a member of our Slack community. The initial half of the show reviews both the risks and dynamic or static r...

We're really excited about this one! On January 31 at 12 NOON Eastern/ 10 AM Mountain,

@0x102c

is joining us to discuss some cool recent work at

. Link will be here: youtu.be/zCN-iWnaHOo

Quote Tweet

Leif Dreizler

@leifdreizler

Jan 20

Replying to @jmassey09 and @github

@0x102c has a blog post that will hopefully go out next week

discussing some of the implement details, as well as an upcoming appearance on @absoluteappsec!

Caido - A lightweight web security auditing toolkit

Jan 17

We're keeping up our eyes on this burp alternative:

caido.io

Built from the ground up in Rust, Caido aims to help security professionals and enthusiasts audit web applications with efficiency and ease.

Final topic: research by

@Abdulrah33mK

on prototype pollution in Python:

blog.abdulrah33m.com

Prototype Pollution in Python - Abdulrah33m's Blog

> TL;DR The main objective of this research is to prove the possibility of having a variation of Prototype Pollution in other programming languages, including those that are class-based by showing...

In this article,

provides a compendium of exploitation methods, query manipulations, as well as useful tools for working with the API query language

Next topic: GraphQL exploitation write-up. cybervelia.com/?p=736

Next Topic: a write-up on using CORS misconfiguration to bypass firewalls:

trufflesecurity.com

Bypass firewalls with of-CORs and typo-squatting - Truffle Security

Of-CORS, an appsec framework to exploit internal open CORS apps without violating bug bounty rules.

Seth and Ken discuss the CVE's generated through

@huntrdev

the open-source bug bounty service. Ken reminds us of the episode where they had the team on: youtube.com/watch?v=avuGm...

First topic:

's CVE 2022 a year in review:

New Announcement!

in Bellevue, Washington on April 13th-14th, 2023, Seth and Ken are teaching their practical secure-code review course. Sign up now for training discount! For more information, check the web page here:

training.defcon.org

Seth Law - Practical Code Review

Meet us next week at

where Seth and Ken will be doing a live workshop version of after dark code reviews as well as a "state of appsec" panel.

Looking for something to push back against Mid-January doldrums? Maybe all you need is a cup of AppSec hygge? In that case, tune in at Noon Eastern time with our illustrious hosts

and

for the 195th episode of Absolute AppSec: