Application Security Weekly Subscribe

Application security

Helping Secure OSS Software – Alvaro Munoz – ASW #189

March 21, 2022

Past research such as JNDI Injection, Unsafe deserialization, Struts RCEs
OSS security: CodeQL, Dependabot, collaboration between researchers and developers, OWASP Top Ten Proactive Controls, CVD for OSS

Segment Resources: - Write more secure code with the OWASP Top 10 Proactive Controls

Full episode and show notes

Announcements

We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!

Guest

Alvaro Munoz

Principal Security Researcher at GitHub

Alvaro Muñoz works as Principal Security Researcher with GitHub Security Lab team. Previously he worked as an Application Security Consultant helping top enterprises to deploy their application security programs. He is passionate about Web Application security where he has focused most of his research. Muñoz has presented at many Security conferences including BlackHat, DEFCON, RSA, OWASP AppSec EU and US, JavaOne, etc, and holds several infosec certifications, including OSCP, GWAPT, and CISSP.

Hosts

Senior Engineering Leader at AWS

Senior Cyber Advisor at Lawrence Livermore National Laboratory

Related

Application security

RCE from Iconv + PHP, Fuzzing a Codec, Fuzzing LLMs, Revisiting Recall – ASW #302

October 7, 2024

The many lessons to take away from a 24-year old flaw in glibc and the mastery in crafting an exploit in PHP, changing a fuzzer's configuration to find more flaws, fuzzing LLMs for prompt injection and jailbreaks, security hardening of baseband code, revisiting the threat models in Microsoft's Recall, and more!

Application security

The Future of Zed Attack Proxy – Simon Bennetts, Ori Bendet – ASW #302

October 7, 2024

Zed Attack Proxy has been a crucial web app testing tool for decades. It's also had a struggle throughout 2024 to obtain funding that would enable the tool to add more features while remaining true to its open source history. Simon Bennetts, founder of ZAP, and Ori Bendet from Checkmarx update us on that journey, share some exploration of LLM fuzzi...

Application security

More Car Hacks, CUPS Vulns, Microsoft’s SFI, Memory Safety, Password Complexity – ASW #301

September 30, 2024

More remote car control via web interfaces, an RCE in CUPS, Microsoft reduces attack surface, migrating to memory safety, dealing with dependency confusion, getting rid of password strength calculators, and more!