Varun-Subtle_Security_flaws

•Download as PPT, PDF•

0 likes•280 views

G

Varun Sharma from Microsoft India identifies 5 common authentication and authorization flaws in web applications: 1. Custom authentication is implemented instead of using proven system methods. 2. Rule-based authorization is not considered, with authorization relying only on disabling UI elements. 3. Input validation only checks for blacklisted characters instead of whitelisting allowed values. 4. Cryptography is improperly implemented without understanding what security mechanisms provide. 5. Applications are vulnerable to denial of service attacks from excessive automated requests.

Technology Business

Varun Sharma Application Consulting and Engineering (ACE) Team, Microsoft India

[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

Product 1 ‘s Site Product 2 ‘s Site Product 3 ‘s Site Central Payment Site Signed XML POST

[object Object],[object Object],[object Object],[object Object]

Book movie ticket Screen 1 for User 1

Book movie ticket Screen 2 for User 1 You have 7 minutes left Enter Payment details:- Name:- Credit Card Number:- Address:- … . Click to Book

Book movie ticket Screen 1 for User 2

Book movie ticket Screen 1 for User 2 after 7 minutes

[object Object],[object Object],[object Object]

More Related Content

Similar to Varun-Subtle_Security_flaws

For the last couple of years I have been participating in various public and private bug bounty programmes including United Airlines, ING, RBS, EU or Synack. Usually these programmes are run by security-mature companies which take a lot of effort to make sure that their applications are secure. So how is that even possible that they are still vulnerable to well-known issues like XSS or IDOR which should not exist in 2019 anymore? Presentation will share information about common “inter-application” vulnerabilities encountered during testing process and emphasize the need of appropriate security testing at each stage of system life cycle. During 45 minutes long talk I will present several real-life examples of "inter-application" vulnerabilities, explain the root causes of these issues and propose steps which could be taken to avoid these vulnerabilities in the future.

"Inter- application vulnerabilities. hunting for bugs in secure applications"...

"Inter- application vulnerabilities. hunting for bugs in secure applications"...

"Inter- application vulnerabilities. hunting for bugs in secure applications"...

Psdot 19 four factor password authentication

Psdot 19 four factor password authentication

Psdot 19 four factor password authentication

[OPD 2019] Inter-application vulnerabilities

[OPD 2019] Inter-application vulnerabilities

[OPD 2019] Inter-application vulnerabilities

Security testing

Security testing

Security testing

Sql securitytesting

Sql securitytesting

Sql securitytesting

Thilak Pathirage -Senior IT Gov and Risk Consultant

The Immune System of Internet

The Immune System of Internet

The Immune System of Internet

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

QA or the Highway

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

QA or the Highway

Ways to protect From Keyloggers!

Ways to protect From Keyloggers!

Ways to protect From Keyloggers!

Multisoft Virtual Academy

Security Testing

Security Testing

Security Testing

A presentation given by Ankita Gupta, Co-Founder and CEO, Akto.io, at our 2024 Austin API Summit, March 12-13. Session Description: In this session, I will talk about API security of LLM APIs, addressing key vulnerabilities and attack vectors. The purpose is to educate developers, API designers, architects and organizations about the potential security risks when deploying and managing LLM APIs. 1. Overview of Large Language Models (LLMs) APIs 2. Understanding LLM Vulnerabilities: - Prompt Injections - Sensitive Data Leakage - Inadequate Sandboxing - Insecure Plugin Design - Model Denial of Service - Unauthorized Code Execution - Input attacks - Poisoning attacks 3. Best practices to secure LLM APIs from data breaches I will explain all the above using real life examples.

Security of LLM APIs by Ankita Gupta, Akto.io

Security of LLM APIs by Ankita Gupta, Akto.io

Security of LLM APIs by Ankita Gupta, Akto.io

Stories of data breaches caused by stolen or guessed passwords have increased scrutiny around login practices. Requiring even more complex passwords is not recommended as users struggle to remember them – and write them down. Multi-factor authentication has become best practice for strengthening login security and is now required by regulations such as the latest PCI Data Security Standard, the New York Department of Financial Services’ Cybersecurity Regulation (23 NYCRR 500) and more. Watch this webinar to learn how multi-factor authentication can be implemented for IBM i users to strengthen security and meet compliance requirements. You’ll learn: • What true multi-factor authentication really is • Authentication options and tradeoffs • Tips on implementing multi-factor authentication for IBM i

Combat Passwords on Post-Its with Multi-Factor Authentication for IBM i

Combat Passwords on Post-Its with Multi-Factor Authentication for IBM i

Combat Passwords on Post-Its with Multi-Factor Authentication for IBM i

Andrews whitakrer lecture18-security.ppt

Andrews whitakrer lecture18-security.ppt

Andrews whitakrer lecture18-security.ppt

Two way authentication

Two way authentication

Two way authentication

Two way authentication

Two way authentication

Two way authentication

a famework for analyzing template security and privacy in biometric authenti...

a famework for analyzing template security and privacy in biometric authenti...

a famework for analyzing template security and privacy in biometric authenti...

Ethical_Hacking_ppt

Ethical_Hacking_ppt

Ethical_Hacking_ppt

Automation attacks are currently plaguing organizations in industries ranging from financial to retail, to gaming & entertainment. These attacks exploit stolen credential leaks, black market & custom attack toolkits, and massively scalable infrastructure to launch widely distributed attacks that are extremely difficult to detect, let alone attribute. In this presentation we will inform the audience of the scale of this problem, discuss a detection methodology to counter these attacks, and walk through 3 real-world examples of how attackers created and monetized the distributed infrastructure they require to launch these attacks.

Automation Attacks At Scale

Automation Attacks At Scale

Automation Attacks At Scale

ransomware keylogger rootkit.pptx

ransomware keylogger rootkit.pptx

ransomware keylogger rootkit.pptx

Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

Shinpei Hayashi

Similar to Varun-Subtle_Security_flaws (20)

"Inter- application vulnerabilities. hunting for bugs in secure applications"...

"Inter- application vulnerabilities. hunting for bugs in secure applications"...

"Inter- application vulnerabilities. hunting for bugs in secure applications"...

Psdot 19 four factor password authentication

Psdot 19 four factor password authentication

Psdot 19 four factor password authentication

[OPD 2019] Inter-application vulnerabilities

[OPD 2019] Inter-application vulnerabilities

[OPD 2019] Inter-application vulnerabilities

Security testing

Security testing

Security testing

Sql securitytesting

Sql securitytesting

Sql securitytesting

The Immune System of Internet

The Immune System of Internet

The Immune System of Internet

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

The 5 Layers of Security Testing by Alan Koch

Ways to protect From Keyloggers!

Ways to protect From Keyloggers!

Ways to protect From Keyloggers!

Security Testing

Security Testing

Security Testing

Security of LLM APIs by Ankita Gupta, Akto.io

Security of LLM APIs by Ankita Gupta, Akto.io

Security of LLM APIs by Ankita Gupta, Akto.io

Combat Passwords on Post-Its with Multi-Factor Authentication for IBM i

Combat Passwords on Post-Its with Multi-Factor Authentication for IBM i

Combat Passwords on Post-Its with Multi-Factor Authentication for IBM i

Andrews whitakrer lecture18-security.ppt

Andrews whitakrer lecture18-security.ppt

Andrews whitakrer lecture18-security.ppt

Two way authentication

Two way authentication

Two way authentication

Two way authentication

Two way authentication

Two way authentication

a famework for analyzing template security and privacy in biometric authenti...

a famework for analyzing template security and privacy in biometric authenti...

a famework for analyzing template security and privacy in biometric authenti...

Ethical_Hacking_ppt

Ethical_Hacking_ppt

Ethical_Hacking_ppt

Automation Attacks At Scale

Automation Attacks At Scale

Automation Attacks At Scale

ransomware keylogger rootkit.pptx

ransomware keylogger rootkit.pptx

ransomware keylogger rootkit.pptx

Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

More from guest66dc5f

Os Timed Original

Os Timed Original

Os Timed Original

Control your entire house with your iPhone

Control your entire house with your iPhone

Control your entire house with your iPhone

Awesome car collection

Awesome car collection

Awesome car collection

Freaky car number plates

Freaky car number plates

Freaky car number plates

David-FPGA

Sunil-Hacking_firefox

Sunil-Hacking_firefox

Sunil-Hacking_firefox

Rahul-Analysis_of_Adversarial_Code

Rahul-Analysis_of_Adversarial_Code

Rahul-Analysis_of_Adversarial_Code

Chetan-Mining_Digital_Evidence_in_Microsoft_Windows

Chetan-Mining_Digital_Evidence_in_Microsoft_Windows

Chetan-Mining_Digital_Evidence_in_Microsoft_Windows

WHITEPAPER-7_years_of_Indian_Cyber_Law

WHITEPAPER-7_years_of_Indian_Cyber_Law

WHITEPAPER-7_years_of_Indian_Cyber_Law

Rohas-7_years_of_indian_cyber_laws

Rohas-7_years_of_indian_cyber_laws

Rohas-7_years_of_indian_cyber_laws

David-FPGA

Shreeraj-Hacking_Web_2

Shreeraj-Hacking_Web_2

Shreeraj-Hacking_Web_2

Dror-Crazy_toaster

Dror-Crazy_toaster

Dror-Crazy_toaster

Ajit-Legiment_Techniques

Ajit-Legiment_Techniques

Ajit-Legiment_Techniques

CostofWarinIraq

CostofWarinIraq

CostofWarinIraq

NR-golf-sept07

NR-golf-sept07

golf

longisland_golf_07

longisland_golf_07

longisland_golf_07

GolfLakeCity_002

GolfLakeCity_002

GolfLakeCity_002

More from guest66dc5f (20)

Os Timed Original

Os Timed Original

Os Timed Original

Control your entire house with your iPhone

Control your entire house with your iPhone

Control your entire house with your iPhone

Awesome car collection

Awesome car collection

Awesome car collection

Freaky car number plates

Freaky car number plates

Freaky car number plates

David-FPGA

Sunil-Hacking_firefox

Sunil-Hacking_firefox

Sunil-Hacking_firefox

Rahul-Analysis_of_Adversarial_Code

Rahul-Analysis_of_Adversarial_Code

Rahul-Analysis_of_Adversarial_Code

Chetan-Mining_Digital_Evidence_in_Microsoft_Windows

Chetan-Mining_Digital_Evidence_in_Microsoft_Windows

Chetan-Mining_Digital_Evidence_in_Microsoft_Windows

WHITEPAPER-7_years_of_Indian_Cyber_Law

WHITEPAPER-7_years_of_Indian_Cyber_Law

WHITEPAPER-7_years_of_Indian_Cyber_Law

Rohas-7_years_of_indian_cyber_laws

Rohas-7_years_of_indian_cyber_laws

Rohas-7_years_of_indian_cyber_laws

David-FPGA

Shreeraj-Hacking_Web_2

Shreeraj-Hacking_Web_2

Shreeraj-Hacking_Web_2

Dror-Crazy_toaster

Dror-Crazy_toaster

Dror-Crazy_toaster

Ajit-Legiment_Techniques

Ajit-Legiment_Techniques

Ajit-Legiment_Techniques

CostofWarinIraq

CostofWarinIraq

CostofWarinIraq

NR-golf-sept07

NR-golf-sept07

golf

longisland_golf_07

longisland_golf_07

longisland_golf_07

GolfLakeCity_002

GolfLakeCity_002

GolfLakeCity_002

Recently uploaded

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Dubai, often portrayed as a shimmering oasis in the desert, faces its own set of challenges, including the occasional threat of flooding. Despite its reputation for opulence and modernity, the emirate is not immune to the forces of nature. In recent years, Dubai has experienced sporadic but significant floods, testing the resilience of its infrastructure and communities. Among the critical lifelines in this bustling metropolis is the Dubai International Airport, a bustling hub that connects the city to the world. This article explores the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

AXA XL - Insurer Innovation Award Americas 2024

AXA XL - Insurer Innovation Award Americas 2024

AXA XL - Insurer Innovation Award Americas 2024

The Digital Insurer

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Dubai, known for its towering skyscrapers, luxurious lifestyle, and relentless pursuit of innovation, often finds itself in the global spotlight. However, amidst the glitz and glamour, the emirate faces its own set of challenges, including the occasional threat of flooding. In recent years, Dubai has experienced sporadic but significant floods, disrupting normalcy and posing unique challenges to its infrastructure. Among the critical nodes in this bustling metropolis is the Dubai International Airport, a vital hub connecting the world. This article delves into the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Strategies for Landing an Oracle DBA Job as a Fresher

Strategies for Landing an Oracle DBA Job as a Fresher

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Following the popularity of "Cloud Revolution: Exploring the New Wave of Serverless Spatial Data," we're thrilled to announce this much-anticipated encore webinar. In this sequel, we'll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you're building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

Keynote 2: APIs in 2030: The Risk of Technological Sleepwalk Paolo Malinverno, Growth Advisor - The Business of Technology Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

💥 You’re lucky! We’ve found two different (lead) developers that are willing to share their valuable lessons learned about using UiPath Document Understanding! Based on recent implementations in appealing use cases at Partou and SPIE. Don’t expect fancy videos or slide decks, but real and practical experiences that will help you with your own implementations. 📕 Topics that will be addressed: • Training the ML-model by humans: do or don't? • Rule-based versus AI extractors • Tips for finding use cases • How to start 👨‍🏫👨‍💻 Speakers: o Dion Morskieft, RPA Product Owner @Partou o Jack Klein-Schiphorst, Automation Developer @Tacstone Technology

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

UiPathCommunity

2024: Domino Containers - The Next Step. News from the Domino Container commu...

2024: Domino Containers - The Next Step. News from the Domino Container commu...

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

Recently uploaded (20)

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

AXA XL - Insurer Innovation Award Americas 2024

AXA XL - Insurer Innovation Award Americas 2024

AXA XL - Insurer Innovation Award Americas 2024

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

Strategies for Landing an Oracle DBA Job as a Fresher

Strategies for Landing an Oracle DBA Job as a Fresher

Strategies for Landing an Oracle DBA Job as a Fresher

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

2024: Domino Containers - The Next Step. News from the Domino Container commu...

2024: Domino Containers - The Next Step. News from the Domino Container commu...

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Varun-Subtle_Security_flaws

1. Varun Sharma Application Consulting and Engineering (ACE) Team, Microsoft India

2.

3.

4.

5.

6.

7.

8.

9.

10. Product 1 ‘s Site Product 2 ‘s Site Product 3 ‘s Site Central Payment Site Signed XML POST

11.

12. Book movie ticket Screen 1 for User 1

13. Book movie ticket Screen 2 for User 1 You have 7 minutes left Enter Payment details:- Name:- Credit Card Number:- Address:- … . Click to Book

14. Book movie ticket Screen 1 for User 2

15. Book movie ticket Screen 1 for User 2 after 7 minutes

16.

17.

Editor's Notes

I will be presenting five subtle and interesting flaws in applications.