OWASP Foundation Courses

Beyond Takeover - Attacker's In. Now What?

Explore the aftermath of phishing attacks through a unique research perspective, uncovering attacker behaviors, account takeover dynamics, and essential cybersecurity insights for organizations.

• YouTube
• 49 minutes
• On-Demand
• Conference Talk

Handling of Security Requirements in Software Development Lifecycle

Explore a unified process for handling security requirements in large companies, focusing on SecurityRAT tool for automated requirement management and issue tracking integration.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

When Molehill Vulnerabilities Become Mountainous Exploits

Explore how seemingly minor vulnerabilities can escalate into major security threats through live demonstrations, emphasizing the importance of comprehensive code scanning and proactive security measures.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

An Overview of API Underprotection

Explores API security challenges, threats, and emerging technologies. Covers OAuth2, API keys, mobile app security, TLS pinning, and advanced techniques like app hardening and software attestation.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

WAFs FTW! A Modern DevOps Approach to Security Testing Your WAF

Explore modern DevOps approach to security testing Web Application Firewalls (WAFs) using Framework for Testing WAFs (FTW). Learn objective WAF evaluation, rapid prototyping, and continuous testing strategies.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

Federated Login CSRF

Explore federated login CSRF vulnerabilities in OpenID Connect and OAuth 2.0, examining attack scenarios, risks, and mitigation strategies for secure identity linking in web applications.

• YouTube
• 30 minutes
• On-Demand
• Conference Talk

An Agile Framework for Building GDPR Privacy and Data Protection Requirements into SDLC

Agile framework for integrating GDPR privacy and data protection requirements into software development lifecycle, using a tag-based approach to identify and implement necessary features efficiently.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

Androsia - A Tool for Securing In Memory Sensitive Data

Innovative tool for securing sensitive data in Android apps through static analysis and bytecode transformation, enhancing defense-in-depth even after compromise.

• YouTube
• 38 minutes
• On-Demand
• Conference Talk

Where We're Going, We Won't Need Passwords

Explore enterprise-wide multifactor authentication deployment, addressing technical challenges, user experience, and lessons learned for seamless workforce authentication across devices and legacy systems.

• YouTube
• 30 minutes
• On-Demand
• Conference Talk

Building Secure ASP.NET Core MVC Applications

Explore ASP.NET Core MVC security features, including XSS and CSRF protection. Learn to build robust web applications with modular architecture and cross-platform compatibility.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

Fixing Broken Enterprise Threat Models with OWASP Efforts - Commissioning AppSec Professionals for Real Change

Explore how OWASP projects can revolutionize enterprise threat modeling, addressing compliance issues, undefined attack surfaces, and risk distortions to create measurable security impact.

• YouTube
• 43 minutes
• On-Demand
• Conference Talk

Crafting the Next-Generation Man-in-the-Browser Trojan

Explore next-gen Man-in-the-Browser trojans, their evolution, and defense strategies. Learn about advanced attack techniques, client-side defenses, and future cybersecurity challenges in this comprehensive talk.

• YouTube
• 54 minutes
• On-Demand
• Conference Talk

Cookie Security - Myths and Misconceptions

Debunking cookie security myths and exploring lesser-known facts about cookie attributes, including recent browser improvements for enhanced web application protection.

• YouTube
• 49 minutes
• On-Demand
• Conference Talk

Differences Between Web Application Scanning Tools When Scanning for XSS and SQLi

Investigates differences between web application scanning tools for XSS and SQLi, addressing challenges in modern web architectures and suggesting improvements for effective vulnerability detection.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

Bug Bounty Programs - Successfully Controlling Complexity and Perpetual Temptation

Explore bug bounty programs with industry experts, covering implementation strategies, legal considerations, and best practices for effective vulnerability management and researcher collaboration.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk