Polyglot Security Code Review

Two-Day Interactive (Classroom) Training - OWASP New Zealand Day 2024

Abstract

Join our intensive, two-day code review training! Tailored for pentesters, AppSec engineers, and senior developers, this dynamic training delves into the nuances of identifying and mitigating vulnerabilities in diverse programming languages, including Java, Ruby, Golang, Python, and PHP.

Target Audience

Penetration Testers, Code Reviewers, and Application Security Engineers
Senior Developers with an understanding of common security vulnerabilities

Course Details

Dates: Tuesday and Wednesday, 3-4 September 2024

Time: 8:45 a.m. to 5:30 p.m. (NZST)

Instructor: Louis Nyffenegger (PentesterLab)

Course Fee: NZ $1,000.00 (plus GST and ticketing fees)

Registration Site: https://events.humanitix.com/owaspnz2024-training

Maximum Enrolment: 36 attendees

Prerequisites - What Students Should Bring

A laptop with Internet access and Docker installed

What Students Will Receive

A one-year subscription to PentesterLab PRO

Course Description

Join our intensive, two-day code review training! Tailored for pentesters, appsec engineers and senior developers, this dynamic training delves into the nuances of identifying and mitigating vulnerabilities in diverse programming languages, including Java, Ruby, Golang, Python, and PHP.

Our approach is hands-on and case study-driven, utilizing real bugs to illustrate key concepts in each section. By leveraging multiple languages, we aim at providing re-usable patterns as well as covering language specific knowledge and gotchas.

The workshop emphasizes practical skills, ensuring that you leave with not only theoretical knowledge but also the ability to apply these techniques effectively in your code reviews. Perfect for those looking to elevate their code review skills to a professional level, our training offers a unique opportunity to enhance your expertise in a collaborative and dynamic environment.

Attendees will also get to enjoy one-year access to PentesterLab PRO to keep learning after the training.

Course Outline

Day One

Introduction
- Why get Into Security Code Review?
- Previous Language Knowledge
- Manual Review versus Automatic Tools
- Improvement, Weakness, and Vulnerability
- Train Your Code Review Muscles
- The Right Incentive
Reading Code
- Methodology
- What to Look for
- Non-Obvious Patterns
Keeping Notes
- What to Write
- How to Keep Notes
Architecture of Web Applications
- Routing
- MVC
- User-Controlled Inputs
Data
- Data Types and Web Applications
- Type Comparison
- Injections
- Serialisation and Deserialisation
- String Interpolation
- XML Entities Attacks
- Assumptions and Data
- How Data Is Accessed
Patterns
- Bad Default
- Filtering
- Time-of-Check Time-of-Use (TOCTOU)
- Common Patterns

Day Two

Gotchas
- Golang
- Java
- Ruby
- Python
- Others
CVE Analysis
- Methodology
- Example: An Interesting CVE
Tools
- Text Editor
- Docker
- Git
- SemGrep
- Debugger
Deep Dive
- Authentication (Registration, Password Storage, Login, Password Reset)
- Authenticity
Strategies
- Code Review Methodologies
- Picking a Methodology
Remediation
Conclusion
- Wrapping It Up
- Creating Habits
- Last Advice

Your Instructor

Louis Nyffenegger is a seasoned security engineer and the founder of PentesterLab, a platform dedicated to teaching Web penetration testing. With over a decade of experience in cybersecurity, Louis has focused on penetration testing, architecture analysis, and code reviews. He also launched a YouTube channel, AppSecSchool, further extending his passion for education in application security.