Absolute AppSec

Latest Episodes:

Episode 154 - Conferences, Cloud Security, Software Supply Chain Dec 07, 2021

Show notes

It's one of those days, must be Q4. View of tech conferences as an outsider. An analysis of data from Google's "Threat Horizons" report and what it tells us about Cloud Security. A few items related security of the software supply chain, including an academic white paper comparing different SCA tools.

Episode 153 - Fuzzing, Authentication, Browser Wars (again) Nov 30, 2021

Show notes

Our last episode before its December!!! Where oh where did 2021 go? Seth and Ken wrap up a conversation on fuzzing strategies for HTTP Requests. A discussion on the difficulty of authentication and why that is. Finally, Google Chrome has taken over the web and how it comes back to the browser wars of the early 2000s.

Episode 152 - Breaches, Symbolic Execution, Dynamic vs. Static Assessments Nov 23, 2021

Show notes

Gobble gobble! It is that time of the year again to stuff our faces... WITH APPSEC! A discussion on breach notification related to the recent GoDaddy disclosure. Understanding symbolic execution with trail of bits. The differences of dynamic and static assessments and why both are important.

Episode 151 - Secure Code Review, Software Interdependency Nov 16, 2021

Show notes

Ahem, Seth and Ken return with a live code review of a recently seen authentication routine. A discussion of software interdependence and the issues it creates (such as SSRF). In other words, 151 and not even the rum... sigh. Well somehow these clowns are still allowed on YouTube so stay tuned for another episode I guess or whatever. Or don't, who cares. Worst. Internship. Ever.

Episode 150 - Jerry Gamblin - NVD CVEs, Vulnerability Disclosure, Burp Cert Oct 26, 2021

Show notes

Jerry Gamblin makes a return to the podcast to talk about recent events in Missouri and how _not_ to respond to responsible vulnerability disclosure. A discussion on the increase of CVEs showing up in the National Vulnerability Database, how Kenna was acquired by Cisco, and Portswigger's new Burp Suite Certificate.

Episode 149 - Burnout, AppSec News Sources Oct 19, 2021

Show notes

Just two old men bi***ing and moaning about App Sec and the price of a good pair of New Balances. Real discussion on dealing with burnout and imposter syndrome. How to stay engaged and interested when the excitement becomes mundane.

Episode 148 - Facebook, Phrack, Paved Path Oct 05, 2021

Show notes

Strange things are afoot at the Circle K. Facebook outage and BGP routing. A new issue of phrack released on Oct 5 results a discussion on the good ol' days, BBSes, and the commercialization of security. Finally, thoughts on paved paths and how they affect security.

Episode 147 - James Kettle (@albinowax), Security Research Sep 21, 2021

Show notes

The one and only James Kettle (@albinowax) of Portswigger joins Seth and Ken to talk about his path into security, HTTP request smuggling, and how to perform security research.

Episode 146 - OWASP Top 10, Bug Bounties with @JHaddix, Request Smuggling Sep 14, 2021

Show notes

Now with the latest in old people ramblings. Discussion about the OWASP Top 10 Draft list and how the Top 10 should be used as an awareness document. Discussions on bug bounties with surprise guest Jason Haddix (@JHaddix). More fun with HTTP Request Smuggling.

Episode 145 - Return of @cktricky, Burnout, Bumble Vuln, Brute-Forcing Aug 26, 2021

Show notes

@cktricky is _back_ with a newfound lease on life (and application security). The duo discusses in-person vs. virtual conferences, DEF CON 29, burnout, vulnerabilities in dating apps. A demonstration of using Burp Suite to fuzz a user enumeration vulnerability and brute-force an account.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected