Web Security

English | MP4 | AVC 1920×1080 | AAC 44KHz 2ch | 4h 45m | 6.59 GB

Security is an increasingly important part of building modern web applications, but it often falls victim to the pressure of tight deadlines. As attacks become more sophisticated, protecting our users becomes not just an ethical responsibility, but part of preserving a company’s reputation and trust.

In an effort to understand what we as developers are up against, we’ll get hands-on experience staging some attacks, and in doing so learn how we can fend off those who would do our users harm.

We’ll begin with a series of attacks that relate to a web application client, starting with Cross-Site Scripting (XSS) and malicious image/pdf attachments. We’ll get authenticated users to perform unwanted actions using a Cross-Site Request Forgery (CSRF) attack, and learn about defense strategies like CSRF tokens. We’ll even learn how to stage a Clickjacking attack and use hidden iframes to trick users into interacting with one application while they think they’re using another.

Next, we’ll turn our focus onto our web application’s back end. We’ll use a SQL injection attack to expose private information from a database and learn how to sanitize user input properly to protect against this kind of thing. We’ll also attack the app’s authentication system its self, to try and determine which usernames correspond to registered accounts.

Finally, we’ll look at the network connection between our user and the web application back-end, and explore how a man-in-the-middle attack is staged. We’ll get some hands-on experience with modern browser security features like HSTS headers and Subresource Integrity — technologies that can protect users on a compromised WiFi network.