OWASP Foundation Courses

How to Approach InfoSec Like a Federal Auditor - 5 Key Security Principles

Explore federal security standards for improved InfoSec practices. Learn key principles like defining security boundaries, creating functional specifications, and protecting critical parameters and network traffic.

• YouTube
• 37 minutes
• On-Demand
• Free Video

Enhancing Physical Perimeter Defense Using Software-Defined Radio

Explore innovative physical perimeter defense using software-defined radio to detect potential threats by simulating cell tower signals, enabling early reconnaissance identification and post-breach investigation.

• YouTube
• 24 minutes
• On-Demand
• Free Video

Black-Box Approximate Taint Tracking by Utilizing Data Partitioning

Innovative black-box taint tracking system for detecting user input data injection in commands and SQL queries, offering cost-effective and performant runtime protection without code modifications.

• YouTube
• 36 minutes
• On-Demand
• Free Video

Remediating XSS in GitHub Open Source Projects - Lessons Learned

Insights on scaling XSS remediation across GitHub open source projects, focusing on risk reduction, adding security controls, and automating code modification for diverse applications.

• YouTube
• 49 minutes
• On-Demand
• Free Video

iGoat: A Self-Learning Tool for iOS App Security Testing

Learn iOS app security through hands-on exercises with iGoat, an open-source tool for developers and pentesters. Explore vulnerabilities, exploit techniques, and implement fixes in a safe environment.

• YouTube
• 26 minutes
• On-Demand
• Free Video

A Static Tainting Analysis Method for Aspect-Oriented Programs

Introduces a new method for detecting vulnerabilities in aspect-oriented web applications, focusing on static tainting analysis to improve security in languages like AspectJ.

• YouTube
• 37 minutes
• On-Demand
• Free Video

NoSQL Is Not NoVulnerable - Exploring Security Risks in NoSQL Databases

Explores vulnerabilities in NoSQL databases, comparing threats to traditional SQL systems and demonstrating new attacks exploiting complex data types like JSON to bypass application-level access controls.

• YouTube
• 35 minutes
• On-Demand
• Free Video

HUNT: Data-Driven Web Hacking and Manual Testing

Turbocharge web hacking with HUNT, a Burp Suite extension using real threat intelligence to provide parameter-level vulnerability suggestions and organize testing methodologies for more thorough assessments.

• YouTube
• 44 minutes
• On-Demand
• Free Video

ReproNow - Saving Time in Reproducing and Triaging Security Bugs

Introducing ReproNow: an open-source tool for efficiently reproducing and triaging security vulnerabilities. This chrome/firefox extension captures researcher's walkthrough, including network requests, streamlining bug validation for security engineers.

• YouTube
• 44 minutes
• On-Demand
• Free Video

Attacking JSON - Vulnerabilities in Popular Parsers

Explore JSON parser vulnerabilities in .NET and Java, including RCE risks. Learn about attack techniques, vulnerable formats, and mitigation strategies for safer serialization implementations.

• YouTube
• 41 minutes
• On-Demand
• Free Video

Passive Fingerprinting of HTTP/2 Clients

Explore HTTP/2 protocol nuances for passive client fingerprinting. Learn about implementation differences, potential use cases, and observed attacks on Akamai's platform.

• YouTube
• 38 minutes
• On-Demand
• Free Video

AppSecUSA 2017 - OWASP Leaders Session

Comprehensive review of OWASP Project and Chapter Leaders' working session, discussing key decisions and actions affecting global operations. Essential viewing for OWASP leadership.

• YouTube
• 2 hours 15 minutes
• On-Demand
• Free Video

The Less Hacked Path - Exploring Modern Security Vulnerabilities

Explore fascinating side-channel attacks and low-cost tools used against modern technology. Learn about innovative hacking methods and how to secure against them from renowned security researcher Samy Kamkar.

• YouTube
• 59 minutes
• On-Demand
• Free Video

Software Supply Chain Lifecycle Management: Reducing Attack Vectors and Enabling Rugged DevOps

Exploring software supply chain lifecycle management to reduce attack vectors and enable rugged DevOps, focusing on IoT security, third-party software risks, and standards-based automation for threat detection.

• YouTube
• 52 minutes
• On-Demand
• Free Video

How to Ensure That No One Wants to Work With You - AppSec EU 2017

Humorous guide on counterproductive workplace behaviors, highlighting common mistakes to avoid for better professional relationships and team dynamics.

• YouTube
• 17 minutes
• On-Demand
• Free Video