BrakeSec Education Podcast 2020-014-Server Side Request Forgery defense, Tanya Janca, AppSec discussion
Tanya's AppSec Course
https://www.shehackspurple.dev/server-side-request-forgery-ssrf-defenses
https://www.shehackspurple.dev
Server-side request forgery - https://portswigger.net/web-security/ssrf
What are differences between Stored XSS and SSRF?
This requires a MITM type of issue?
Doesn't stored XSS get stored on the server?
What conditions must exist for SSRF to be possible?
What mitigations need to be in place for mitigation of SSRF? CORS? CSP?
Would a WAF or mod_security be effective?
Can it be completely mitigated or are there still ways around it?
Part2 -next week
Github actions - https://github.com/features/actions
How are these written?
It looks like a marketplace format? How do they maintain code quality?
What does it take setup the actions?
It looks like IFTTT for DevOps?
What kind of integrations does it allow for? Will it handle logins or API calls for you?
Is it moderated in some way? What's the acceptance criteria for these?
What are you trying to accomplish by using Github Actions? What are the benefits of using these over XX product?
What is gained by using this?
Mention twitch Channel and when (join the mailing list)
Github actions "Twitch.tv/shehackspurple"
Coaching, Project Management, Scrum Management
Alice and Bob learn Application Security - Wylie - Fall/Winter 2020
Links:
https://mailchi.mp/e2ab45528831/shehackspurple
https://twitter.com/shehackspurple
https://medium.com/@shehackspurple
https://www.youtube.com/shehackspurple
https://www.twitch.tv/shehackspurple
https://www.linkedin.com/in/tanya-janca
https://github.com/shehackspurple/
Tanya Janca
Check out our Store on Teepub! https://brakesec.com/store
Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com
#Brakesec Store!:https://www.teepublic.com/user/bdspodcast
#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3
#RSS: https://brakesec.com/BrakesecRSS
#Youtube Channel: http://www.youtube.com/c/BDSPodcast
#iTunes Store Link: https://brakesec.com/BDSiTunes
#Google Play Store: https://brakesec.com/BDS-GooglePlay
Our main site: https://brakesec.com/bdswebsite
#iHeartRadio App: https://brakesec.com/iHeartBrakesec
#SoundCloud: https://brakesec.com/SoundcloudBrakesec
Comments, Questions, Feedback: bds.podcast@gmail.com
Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon
https://brakesec.com/BDSPatreon
#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir
#Player.FM : https://brakesec.com/BDS-PlayerFM
#Stitcher Network: https://brakesec.com/BrakeSecStitcher
#TuneIn Radio App: https://brakesec.com/TuneInBrakesec