SlideShare ist ein Scribd-Unternehmen logo
1 von 30
Hacking and Compliance in a Web 2.0 World ,[object Object],[object Object],[object Object]
$ whoami ,[object Object],[object Object],[object Object],[object Object]
$ cat ~/.plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Web 2.0 Frameworks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
The “kind of” - XSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Define Briefly ,[object Object],[object Object],[object Object],[object Object],[object Object]
XSS - The Bad, The Ugly ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],“ ><script>alert(‘dcash’)</script>
XSS Scenarios ,[object Object],[object Object],[object Object],[object Object]
Fixing XSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
More XSS Prevention ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Cross-Site Request Forgery ,[object Object],[object Object],[object Object]
CSRF++ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
CSRF GET ,[object Object],[object Object],[object Object],[object Object]
CSRF POST
GMail Analysis ,[object Object],[object Object],[object Object],[object Object]
Third-Party Components ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
What to Look For? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Poor Design = Poor Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Flash Security ,[object Object],[object Object],[object Object],[object Object]
Some Other Things... ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
And a few more... ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
One last thing ... ,[object Object],[object Object],[object Object],[object Object],[object Object]
Password Security 250 passwords later... 5 Minutes Later
Switching Gears ,[object Object]
We <3 Our Data ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Planning and Process ,[object Object],[object Object],[object Object],[object Object],[object Object]
Data Breach/Privacy Policy ,[object Object],[object Object],[object Object]
PCI ,[object Object],[object Object],[object Object],[object Object]
PCI If You Have To ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Thanks ,[object Object],http://xkcd.com/327/

Weitere ähnliche Inhalte

Was ist angesagt?

Web Server Web Site Security
Web Server Web Site SecurityWeb Server Web Site Security
Web Server Web Site Security
Steven Cahill
 

Was ist angesagt? (20)

Web security leeds sharp dot netnotts
Web security leeds sharp dot netnottsWeb security leeds sharp dot netnotts
Web security leeds sharp dot netnotts
 
Small Business Owners – Don’t Get Caught With Out Data Security.
Small Business Owners – Don’t Get Caught With Out Data Security.Small Business Owners – Don’t Get Caught With Out Data Security.
Small Business Owners – Don’t Get Caught With Out Data Security.
 
Designing for Privacy in Mobile and Web Apps - Interaction '14, Amsterdam
Designing for Privacy in Mobile and Web Apps - Interaction '14, AmsterdamDesigning for Privacy in Mobile and Web Apps - Interaction '14, Amsterdam
Designing for Privacy in Mobile and Web Apps - Interaction '14, Amsterdam
 
Browser Security by pratimesh Pathak ( Buldhana)
Browser Security by pratimesh Pathak ( Buldhana) Browser Security by pratimesh Pathak ( Buldhana)
Browser Security by pratimesh Pathak ( Buldhana)
 
Brute force
Brute forceBrute force
Brute force
 
Internet User Privacy
Internet User PrivacyInternet User Privacy
Internet User Privacy
 
Web site hacking;what does it mean
Web site hacking;what does it meanWeb site hacking;what does it mean
Web site hacking;what does it mean
 
Web Security
Web SecurityWeb Security
Web Security
 
Website hacking and prevention (All Tools,Topics & Technique )
Website hacking and prevention (All Tools,Topics & Technique )Website hacking and prevention (All Tools,Topics & Technique )
Website hacking and prevention (All Tools,Topics & Technique )
 
Word press security guard
Word press security guardWord press security guard
Word press security guard
 
Top Ten Web Hacking Techniques of 2012
Top Ten Web Hacking Techniques of 2012Top Ten Web Hacking Techniques of 2012
Top Ten Web Hacking Techniques of 2012
 
Online Self Defense - Passwords
Online Self Defense - PasswordsOnline Self Defense - Passwords
Online Self Defense - Passwords
 
Top Ten Web Hacking Techniques – 2008
Top Ten Web Hacking Techniques – 2008Top Ten Web Hacking Techniques – 2008
Top Ten Web Hacking Techniques – 2008
 
Web Server Web Site Security
Web Server Web Site SecurityWeb Server Web Site Security
Web Server Web Site Security
 
Effects of using IT
Effects of using ITEffects of using IT
Effects of using IT
 
Security Function
Security FunctionSecurity Function
Security Function
 
Greater Wheeling AITP Web Security
Greater Wheeling AITP Web SecurityGreater Wheeling AITP Web Security
Greater Wheeling AITP Web Security
 
Cyber Privacy & Password Protection
Cyber Privacy & Password ProtectionCyber Privacy & Password Protection
Cyber Privacy & Password Protection
 
The Ultimate Guide to Wordpress Security
The Ultimate Guide to Wordpress SecurityThe Ultimate Guide to Wordpress Security
The Ultimate Guide to Wordpress Security
 
Updated Mvc Web security updated presentation
Updated Mvc Web security updated presentationUpdated Mvc Web security updated presentation
Updated Mvc Web security updated presentation
 

Ähnlich wie StartPad Countdown 2 - Startup Security: Hacking and Compliance in a Web 2.0 World

Defcon9 Presentation2001
Defcon9 Presentation2001Defcon9 Presentation2001
Defcon9 Presentation2001
Miguel Ibarra
 
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wnedLayer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
fangjiafu
 
Application Security
Application SecurityApplication Security
Application Security
nirola
 
Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"
Jeremiah Grossman
 
Avoiding Cross Site Scripting - Not as easy as you might think
Avoiding Cross Site Scripting - Not as easy as you might thinkAvoiding Cross Site Scripting - Not as easy as you might think
Avoiding Cross Site Scripting - Not as easy as you might think
Erlend Oftedal
 
How not to suck at Cyber Security
How not to suck at Cyber SecurityHow not to suck at Cyber Security
How not to suck at Cyber Security
Chris Watts
 

Ähnlich wie StartPad Countdown 2 - Startup Security: Hacking and Compliance in a Web 2.0 World (20)

Defcon9 Presentation2001
Defcon9 Presentation2001Defcon9 Presentation2001
Defcon9 Presentation2001
 
B-sides Las Vegas - social network security
B-sides Las Vegas - social network securityB-sides Las Vegas - social network security
B-sides Las Vegas - social network security
 
You Spent All That Money And Still Got Owned
You Spent All That Money And Still Got OwnedYou Spent All That Money And Still Got Owned
You Spent All That Money And Still Got Owned
 
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wnedLayer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
 
Unusual Web Bugs
Unusual Web BugsUnusual Web Bugs
Unusual Web Bugs
 
Web Bugs
Web BugsWeb Bugs
Web Bugs
 
Seguridad Corporativa Con Internet Explorer 8(1)
Seguridad Corporativa Con Internet Explorer 8(1)Seguridad Corporativa Con Internet Explorer 8(1)
Seguridad Corporativa Con Internet Explorer 8(1)
 
Application Security
Application SecurityApplication Security
Application Security
 
Top 10 Web Hacks 2012
Top 10 Web Hacks 2012Top 10 Web Hacks 2012
Top 10 Web Hacks 2012
 
Securing Applications
Securing ApplicationsSecuring Applications
Securing Applications
 
Xss is more than a simple threat
Xss is more than a simple threatXss is more than a simple threat
Xss is more than a simple threat
 
Xss is more than a simple threat
Xss is more than a simple threatXss is more than a simple threat
Xss is more than a simple threat
 
Defending Against Attacks With Rails
Defending Against Attacks With RailsDefending Against Attacks With Rails
Defending Against Attacks With Rails
 
Owasp top 10 2013
Owasp top 10 2013Owasp top 10 2013
Owasp top 10 2013
 
Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"
 
Avoiding Cross Site Scripting - Not as easy as you might think
Avoiding Cross Site Scripting - Not as easy as you might thinkAvoiding Cross Site Scripting - Not as easy as you might think
Avoiding Cross Site Scripting - Not as easy as you might think
 
Ethical_Hacking_ppt
Ethical_Hacking_pptEthical_Hacking_ppt
Ethical_Hacking_ppt
 
How not to suck at Cyber Security
How not to suck at Cyber SecurityHow not to suck at Cyber Security
How not to suck at Cyber Security
 
The top 10 security issues in web applications
The top 10 security issues in web applicationsThe top 10 security issues in web applications
The top 10 security issues in web applications
 
Don't get stung - an introduction to the OWASP Top 10
Don't get stung - an introduction to the OWASP Top 10Don't get stung - an introduction to the OWASP Top 10
Don't get stung - an introduction to the OWASP Top 10
 

Mehr von Start Pad

Mehr von Start Pad (11)

StartPad Countdown 4 - Windows Azure
StartPad Countdown 4 - Windows AzureStartPad Countdown 4 - Windows Azure
StartPad Countdown 4 - Windows Azure
 
StartPad Countdown 5 - Google Geo: Mobile Mapping
StartPad Countdown 5 - Google Geo: Mobile MappingStartPad Countdown 5 - Google Geo: Mobile Mapping
StartPad Countdown 5 - Google Geo: Mobile Mapping
 
Crystal Ball for your Internet Startup
Crystal Ball for your Internet StartupCrystal Ball for your Internet Startup
Crystal Ball for your Internet Startup
 
StartPad Countdown 6 - ACLU 2.0: Demand Your dotRights
StartPad Countdown 6 - ACLU 2.0: Demand Your dotRightsStartPad Countdown 6 - ACLU 2.0: Demand Your dotRights
StartPad Countdown 6 - ACLU 2.0: Demand Your dotRights
 
How To Wrangle A Team To Build Your Company
How To Wrangle A Team To Build Your CompanyHow To Wrangle A Team To Build Your Company
How To Wrangle A Team To Build Your Company
 
StartPad Countdown 0 - Save the Programmer. Save the Planet.
StartPad Countdown 0 - Save the Programmer. Save the Planet.StartPad Countdown 0 - Save the Programmer. Save the Planet.
StartPad Countdown 0 - Save the Programmer. Save the Planet.
 
StartPad Countdown 3 - (Patent Pending)
StartPad Countdown 3 - (Patent Pending)StartPad Countdown 3 - (Patent Pending)
StartPad Countdown 3 - (Patent Pending)
 
StartPad Countdown 5 - The App Engine That Google Built
StartPad Countdown 5 - The App Engine That Google BuiltStartPad Countdown 5 - The App Engine That Google Built
StartPad Countdown 5 - The App Engine That Google Built
 
StartPad Countdown 7 - Extreme Makeover Web Edition
StartPad Countdown 7 - Extreme Makeover Web EditionStartPad Countdown 7 - Extreme Makeover Web Edition
StartPad Countdown 7 - Extreme Makeover Web Edition
 
StartPad Countdown 8 - Amazon Web Services and You
StartPad Countdown 8 - Amazon Web Services and YouStartPad Countdown 8 - Amazon Web Services and You
StartPad Countdown 8 - Amazon Web Services and You
 
StartPad Countdown 9 - Corporate Structures, Common Problems
StartPad Countdown 9 - Corporate Structures, Common ProblemsStartPad Countdown 9 - Corporate Structures, Common Problems
StartPad Countdown 9 - Corporate Structures, Common Problems
 

Kürzlich hochgeladen

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 

Kürzlich hochgeladen (20)

From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 

StartPad Countdown 2 - Startup Security: Hacking and Compliance in a Web 2.0 World

  • 1.
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 21.
  • 22.
  • 23. Password Security 250 passwords later... 5 Minutes Later
  • 24.
  • 25.
  • 26.
  • 27.
  • 28.
  • 29.
  • 30.