Dean H. Saxe
Managing Consultant at Foundstone
When not working, Dean enjoying hiking, cooking, homebrewing and traveling the world.
Presentations
Secure Application Development with Ajax
In this seminar we'll examine the security concerns around Ajax applications, how they are exploited and how developers can mitigate the risks to their applications. Ajax security begins with a discussion of the Same Origin Policy (SOP) of JavaScript, this is one of the key security features of JavaScript. Next, we'll examine authentication and authorization concerns with Ajax and how the developer can avoid common pitfalls.
The remainder of the talk will focus on the role of data validation in Ajax based applications. We'll examine how attackers may abuse Ajax applications designed to bypass the SOP (i.e. mash-ups using Ajax proxies), dynamic code injection attacks and proper serialization/deserialization of XML and JSON data.
Web Application Hacking for Web Developers
See the hacker's toolbox in action as various web applications are ripped open by exploiting simple software bugs. Common problems such as Cross-Site Scripting (XSS) and SQL Injection will be demonstrated and explained, along with more subtle vulnerabilities including privilege escalation, data tampering, and Cross-Site Request Forgery. Even if you've seen XSS and SQL Injection before, advanced techniques will be presented that can slip through many protections.
As a finale, the "holy grail" of web security will be broken with a Man-In-The-Middle attack on SSL. Although countermeasures are briefly covered, this is first and foremost a "shock and awe" presentation that will motivate you to secure your applications. Attendees will receive a CD with all the "Hacme" applications used during the presentation so you can practice your new "skillz".
