2020-014-Server Side Request Forgery defense, Tanya Janca, AppSec discussion

Tanya's AppSec Course

https://www.shehackspurple.dev/server-side-request-forgery-ssrf-defenses

https://www.shehackspurple.dev

Server-side request forgery - https://portswigger.net/web-security/ssrf

What are differences between Stored XSS and SSRF?

This requires a MITM type of issue?

Doesn't stored XSS get stored on the server?

What conditions must exist for SSRF to be possible?

What mitigations need to be in place for mitigation of SSRF? CORS? CSP?

Would a WAF or mod_security be effective?

Can it be completely mitigated or are there still ways around it?

Part2 -next week

Github actions - https://github.com/features/actions

How are these written?

It looks like a marketplace format? How do they maintain code quality?

What does it take setup the actions?

It looks like IFTTT for DevOps?

What kind of integrations does it allow for? Will it handle logins or API calls for you?

Is it moderated in some way? What's the acceptance criteria for these?

What are you trying to accomplish by using Github Actions? What are the benefits of using these over XX product?

What is gained by using this?

Mention twitch Channel and when (join the mailing list)

Github actions "Twitch.tv/shehackspurple"

Coaching, Project Management, Scrum Management

Alice and Bob learn Application Security - Wylie - Fall/Winter 2020

Links:

https://shehackspurple.dev

https://mailchi.mp/e2ab45528831/shehackspurple

https://twitter.com/shehackspurple

https://dev.to/shehackspurple

https://medium.com/@shehackspurple

https://www.youtube.com/shehackspurple

https://www.twitch.tv/shehackspurple

https://www.linkedin.com/in/tanya-janca

https://github.com/shehackspurple/

Tanya Janca

https://SheHacksPurple.dev

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec