Alexander Pirker
101 Typical Security Pitfalls
#1about 3 minutes
Defining the context of application security
Security is not absolute and must be evaluated based on the application type, environment, data sensitivity, and performance constraints.
#2about 2 minutes
Understanding the impact of major vulnerabilities
Recent widespread vulnerabilities like Log4Shell and Spring4Shell demonstrate the critical need for proactive security in software development.
#3about 3 minutes
Preventing XSS by sanitizing on the backend
Client-side input sanitization is easily bypassed, so all user-provided data must be sanitized on the backend to prevent XSS attacks.
#4about 4 minutes
Preventing remote code execution from poor input validation
Failing to validate input parameters against an allowlist can lead to command injection, allowing an attacker to open a reverse shell.
#5about 4 minutes
Preventing denial of service attacks from service crashes
Supplying malformed data, like a public key of the wrong length, can trigger a panic in a library and cause a denial-of-service attack.
#6about 4 minutes
How data type downcasting can break cryptography
Implicitly downcasting a larger integer to a smaller type like a byte can lead to information leakage by causing index collisions.
#7about 4 minutes
Preventing information leakage from out-of-bounds memory reads
Failing to validate the length parameter in a memory copy operation can lead to an out-of-bounds read, leaking sensitive stack memory.
#8about 3 minutes
Four key principles for writing secure code
Developers should prioritize input data sanitation, careful data type selection, proper memory management, and graceful error handling.
#9about 1 minute
Q&A on common pitfalls and sanitization tools
The most common security pitfall is XSS from frontend bypasses, and DOMPurify is a recommended tool for HTML sanitization.
Related jobs
Jobs that call for the skills explored in this talk.
Matching moments
00:28 MIN
Why developers make basic cybersecurity mistakes
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
05:28 MIN
Common security failures beyond individual coding errors
Maturity assessment for technicians or how I learned to love OWASP SAMM
18:51 MIN
Five common cybersecurity mistakes developers make
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
33:08 MIN
Exploring specific web vulnerabilities and filtering issues
WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking
07:33 MIN
Common web application threats like injection and DoS
Security in modern Web Applications - OWASP to the rescue!
27:19 MIN
Key takeaways on IDE and developer tool security
You click, you lose: a practical look at VSCode's security
24:57 MIN
Key takeaways on prompt injection security
Manipulating The Machine: Prompt Injections And Counter Measures
27:01 MIN
Avoiding common pitfalls like CORS and security risks
Front-End Micro Apps
Featured Partners
Related Videos
33:29Programming secure C#/.NET Applications: Dos & Don'ts
Sebastian Leuer
30:54Cross Site Scripting is yesterday's news, isn't it?
Martina Kraus
28:01Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
Tino Sokic
27:32Security Pitfalls for Software Engineers
Jasmin Azemović
26:59Security in modern Web Applications - OWASP to the rescue!
Jakub Andrzejewski
1:58:48Software Security 101: Secure Coding Basics
Thomas Konrad
27:10Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
Sonya Moisset
58:19Typed Security: Preventing Vulnerabilities By Design
Michael Koppmann
Related Articles
View all articles
.png?w=240&auto=compress,format)
From learning to earning
Jobs that call for the skills explored in this talk.
IT-Security Engineer Awarness Training and Security Roadmap
Paris Lodron-Universität Salzburg
Microsoft Office
Embedded Security Engineer - Schwachstellenanalyse | Car IT | Secure Coding
Prognum Automotive GmbH
Ulm, Germany
Remote
DevSecOps Engineer Jr-Mid | Remote | *Attention - developers with a passion for security*
Punk Security Ltd.
Remote
€30-40K
Junior
Docker
Node.js
Kubernetes
+1