Absolute AppSec

Latest Episodes:

Episode 128: Stefan Edwards/David Coursey - PHP, Backdoors, and AppSec Nihilism Mar 30, 2021

Show notes

Seth hosts Stefan Edwards (@lojikil) and David Coursey (@dacoursey) discussing PHP's recent backdoor, probable fixes including code commit signing and the move to GitHub. THe discussion covers ease of security, developer tendencies when securing code, and application security nihilism.

Episode 127: Regexes, WAFs, Secondary Contexts Mar 23, 2021

Show notes

Seth and Ken discuss the role of regular expressions in routing of web application requests. Discussion covers basics of routing, exploitation of secondary contexts, and bypassing of web application firewalls.

Episode 126: Junior AppSec Positions, Phishing Site Detection, Client-side JavaScript Mar 16, 2021

Show notes

Seth and Ken are back on another Taco Tuesday to talk through getting into application security and how to support those new to the field. Also a discussion on phishing sites that detect VMs and other tools to bypass detection and observed client-side JavaScript attacks.

Episode 125: Interviews, SQLi, Concurrency, Wordpress Mar 09, 2021

Show notes

Seth and Ken discuss interviewing techniques for technical resources, SQL injection in the media and Github's recent concurrency vulnerability. Also a discussion on recent WordPress plugin vulnerabilities and why they are always so devastating.

Episode 124: 2020 Top 10 Web Hacking Techniques, Development vs. Security Mar 02, 2021

Show notes

Seth and Ken discuss Portswigger's Top 10 Web Hacking Techniques of 2020, specifically injection attacks through images in PDFs and reverse proxies. Further discussion on creativity in development and how that affects and limits security.

Episode 123: Client-Side Controls, Dependency Confusion Feb 23, 2021

Show notes

Seth and Ken discuss client-side controls and 3rd-party JavaScript security features. Confused deputy vulnerabilities (dependency confusion) in the news.

Episode 122: Brian Glas (@infosecdad) - OWASP Top 10 2021 Feb 18, 2021

Show notes

Seth and Ken welcome back Professor Brian Glas (@infosecdad) to dispel the recent OWASP Top 10 2021 speculation and rumor. We talk through the origins and purpose of the OWASP Top 10 as well as the 2021 call for data and upcoming release.

Episode 121: Stefan Edwards (@lojikil) - Formal Specification, Fuzzing, LangSec Feb 02, 2021

Show notes

Stefan Edwards (@lojikil) once again joins Seth and Ken to talk all things LangSec (language security). Discussion ranges from manual vs. automated testing to fuzzing to semantic analysis to formal specification.

Episode 120: OWASP Top 10 2021, Researcher Attacks, Parler, Phishing Jan 26, 2021

Show notes

Seth and Ken discuss the proposed 2021 OWASP Top 10 Risks, North Korean attacks against security researchers, password managers, latest in Parler de-platforming, and phishing possibilities.

Episode 119: Bugtraq, Web Cache Poisoning, and Blind SSRF Jan 19, 2021

Show notes

Seth and Ken wax nostalgic about the old days due to the shut down of the Bugtraq Mailing List (RIP old friend). Further discussions on web cache poisoning and blind server-side request forgery (SSRF) exploits.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected