Alexander Pirker
101 Typical Security Pitfalls
#1about 3 minutes
Defining the context of application security
Security is not absolute and must be evaluated based on the application type, environment, data sensitivity, and performance constraints.
#2about 2 minutes
Understanding the impact of major vulnerabilities
Recent widespread vulnerabilities like Log4Shell and Spring4Shell demonstrate the critical need for proactive security in software development.
#3about 3 minutes
Preventing XSS by sanitizing on the backend
Client-side input sanitization is easily bypassed, so all user-provided data must be sanitized on the backend to prevent XSS attacks.
#4about 4 minutes
Preventing remote code execution from poor input validation
Failing to validate input parameters against an allowlist can lead to command injection, allowing an attacker to open a reverse shell.
#5about 4 minutes
Preventing denial of service attacks from service crashes
Supplying malformed data, like a public key of the wrong length, can trigger a panic in a library and cause a denial-of-service attack.
#6about 4 minutes
How data type downcasting can break cryptography
Implicitly downcasting a larger integer to a smaller type like a byte can lead to information leakage by causing index collisions.
#7about 4 minutes
Preventing information leakage from out-of-bounds memory reads
Failing to validate the length parameter in a memory copy operation can lead to an out-of-bounds read, leaking sensitive stack memory.
#8about 3 minutes
Four key principles for writing secure code
Developers should prioritize input data sanitation, careful data type selection, proper memory management, and graceful error handling.
#9about 1 minute
Q&A on common pitfalls and sanitization tools
The most common security pitfall is XSS from frontend bypasses, and DOMPurify is a recommended tool for HTML sanitization.
Related jobs
Jobs that call for the skills explored in this talk.
Matching moments
02:26 MIN
Why developers make basic cybersecurity mistakes
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
03:27 MIN
Common security failures beyond individual coding errors
Maturity assessment for technicians or how I learned to love OWASP SAMM
05:37 MIN
Five common cybersecurity mistakes developers make
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
03:17 MIN
Exploring specific web vulnerabilities and filtering issues
WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking
02:52 MIN
Common web application threats like injection and DoS
Security in modern Web Applications - OWASP to the rescue!
02:28 MIN
Key takeaways on IDE and developer tool security
You click, you lose: a practical look at VSCode's security
02:13 MIN
Key takeaways on prompt injection security
Manipulating The Machine: Prompt Injections And Counter Measures
03:10 MIN
Avoiding common pitfalls like CORS and security risks
Front-End Micro Apps
Featured Partners
Related Videos
27:32Security Pitfalls for Software Engineers
Jasmin Azemović
33:29Programming secure C#/.NET Applications: Dos & Don'ts
Sebastian Leuer
1:58:48Software Security 101: Secure Coding Basics
Thomas Konrad
26:59Security in modern Web Applications - OWASP to the rescue!
Jakub Andrzejewski
30:54Cross Site Scripting is yesterday's news, isn't it?
Martina Kraus
29:47You click, you lose: a practical look at VSCode's security
Thomas Chauchefoin & Paul Gerste
28:01Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
Tino Sokic
27:10Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
Sonya Moisset
Related Articles
View all articles
.png?w=240&auto=compress,format)
From learning to earning
Jobs that call for the skills explored in this talk.
Peter Park System GmbH
München, Germany
Senior
Python
Docker
Node.js
JavaScript
Peter Park System GmbH
München, Germany
Intermediate
Senior
Python
Node.js
JavaScript
SYSKRON GmbH
Regensburg, Germany
Intermediate
Senior
.NET
Python
Kubernetes
Speech Processing Solutions
Vienna, Austria
Intermediate
CSS
HTML
JavaScript
TypeScript
JO Media Software Solutions GmBh
Brunn am Gebirge, Austria
Senior
CSS
Angular
JavaScript
TypeScript
doinstruct Software GmbH
Berlin, Germany
Intermediate
Senior
Node.js