1.0 owaspkyivwinter2019 2019-02-02 2019-02-02 1 00:05 https://cfp.owaspukraine.org/owaspkyivwinter2019/schedule/ 2019-02-02T10:00:00+02:00 10:00 01:30 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-31-web-application-firewall-bypass-techniques-workshop https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/7MBSWZ/ false Workshop en A short demonstration of essential Web Application Firewall bypass techniques with 3 practical examples related to SQL Injection and XSS attacks. Для воркшопа нужно: доска, маркер, стакан воды, вайфай(интернет) (желательно чтобы пропускал трафик к таким ресурсам как ngrok), за пару дней до начало ивента разослать учасником письма с требованием для участия в воркшопе. Требования: - Зайти на ТГ канал до начало вокршопа: https://t.me/joinchat/AAAAAFA3ZGkcrhwb7JSrPA - Понимание что такое XSS и SQL injection - Kali Linux - Регистрация на таких ресурсах как https://www.root-me.org & https://lab.pentestit.ru - Хорошое настроение Bohdan Lukin 2019-02-02T11:40:00+02:00 11:40 01:30 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-29-subdomain-discovering-as-an-essential-part-of-the-reconnaissance-phase https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/VA9UAK/ false Workshop en In this presentation, I will talk about: DNS, DNS scrapping, DNS enumeration, and subdomain takeover. As a penetration tester or a bug bounty hunter, most of the times you are given a single domain or a set of domains when you start a security assessment. You’ll have to perform extensive reconnaissance to find interesting assets like servers, web applications, domains that belong to the target organization so that you can increase your chances of finding vulnerabilities. #####Requirements: * Linux based os (Kali Linux is Ok) * API Keys for: VirusTotal, Censys (use https://temp-mail.org) * Good mood #####Telegeram channel https://t.me/subd_enum Kostiantyn Sanduliak 2019-02-02T13:20:00+02:00 13:20 00:40 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-25-introduction-lstio-service-mesh https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/ZEVVV7/ false Talk en We will talk about Service Mesh and Istio. Istio is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio's control plane provides an abstraction layer over the underlying cluster management platform, such as Kubernetes, Mesos, etc. Stanislav Kolenkin 2019-02-02T14:50:00+02:00 14:50 00:40 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-26-owasp-top-10-a2-broken-authentication https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/EY33C3/ false Talk en Broken Authentication and what attack vectors it has. In this talk, I will demonstrate how important it is to put time and effort into security testing. I will introduce you to the Broken Authentication risk that is included in the OWASP Top-10. I will describe what attack vectors it has, how to understand if you are vulnerable to such attacks, and how to protect against them. The talk will be accompanied by practical examples of how to use the following tools to test the application against the Broken Authentication attacks: - Burp Suite - BeEF - Rainbowcrack Svyat Login 2019-02-02T15:40:00+02:00 15:40 00:40 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-27-email-as-an-initial-attack-vector https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/NUZV8K/ false Talk en Email as an element of attack kill-chain. Some interesting examples of phishing emails. Email as an initial (an in some occasions one and only) attack vector. With good preparation of the attacker and the lack of knowledge of the target, the attack has great chances for success. In this talk, we will discuss some key markers of dangerous emails, and some interesting examples of phishing emails. Artur Hil 2019-02-02T16:30:00+02:00 16:30 00:40 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-30-building-sql-firewall-insights-from-developers https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/CHTFRS/ false Talk en How SQL firewalls can help to protect databases from SQL injections: the main difference from WAFs, common usage scenarios, pros, and cons. Developing SQL firewall is a hard task – we will share insights about parsing SQL protocols, matching rules, hidden dangers of logging, best of configuration and usage patterns. Our general plan for talk: 1. SQL injections: what's that and how to protect against them. 2. Typical scenarios of fighting with injections: OWASP guide, WAF, SQL firewall. 3. WAF: pros, cons, why WAF is not enough. 4. SQL firewall: what is this, what are the main features of it. 5. How we built SQL firewall: - configuration and rules (allow, deny, ignore); - parsing SQL protocols; - pattern matching (WHERE, EQUAL, VALUE etc); - logging and masking requests; 6. SQL Firewall vs WAF. 7. Best use cases for SQL firewall. 8. Future improvements of SQL firewalls. 9. Outro. Artem Storozhuk 2019-02-02T17:20:00+02:00 17:20 00:40 Innohub (https://innohub.innovecs.com) owaspkyivwinter2019-28-application-threat-modeling https://cfp.owaspukraine.org/owaspkyivwinter2019/talk/9YNHDA/ false Talk en In this talk, I am going to walk the audience through the Threat Modeling introduction. The program will consist of the overview of popular Threat Modeling methodologies and available tools. Threat Modeling is an essential part of a secure software development process of any maturity. Building up a map of threats that are relevant for an application or system, measuring the impact and probability of these threats, and mapping existing and planned security controls to the related risks – is a crucial exercise that must be performed before the team hits the code and regularly after that. During the talk, we will design an imaginary piece of software that implements a business idea, and build a Threat Model that maps all planned security activities throughout the software development project that implements it. Vlad Styran