Traditional patching has failed to scale - it's time for a new approach. This hands-on workshop teaches you to eliminate entire bug classes with modern browser security features instead of endlessly reacting to reports. Instead of firefighting the same issues, you'll learn how Content-Security-Policy v3, Trusted Types, and Sec-Fetch-Metadata go beyond traditional OWASP recommendations to prevent vulnerabilities at scale.
You'll work with a training app that's already secured, but we'll go further. By applying advanced browser defenses, testing effectiveness, and enforcing security at scale, you'll experience firsthand how modern web standards protect both new and legacy systems.
This isn't just about fixing issues - it's about scaling security across an organization. We'll explore measuring adoption across hundreds of services, automating enforcement, and applying defense-in-depth beyond single vulnerabilities.
Through interactive group challenges, you'll tackle real-world vulnerabilities, enforce modern safeguards, and transform how you approach web security. Whether you're a developer, security engineer, or architect, you'll leave with practical tools and a proactive security mindset - moving from patching to prevention.
Outline:Javan Rasokat is a DevOps Security Specialist at Sage, where he joined five years ago to lead Product Security for Central Europe and now supports products globally, contributing on the standardisation of security controls. He discovered his passion for security early in his career while identifying and reporting vulnerabilities, which led him to transition from full-stack web and mobile engineering into security. On the side, he lectures Secure Coding at DHBW University in Germany, and has shared his research and workshops at conferences including DEFCON, OWASP Global AppSec, and Blackhat.
Im Workshop vermitteln wir zunächst, was der Cyber Resilience Act (CRA) ist: Wir erklären, dass er eine EU-Verordnung ist, die Produkte mit digitalen Elementen EU-weit reguliert, und dass er am 10. Dezember 2024 in Kraft tritt, mit Meldepflichten ab dem 11. September 2026 und voller Geltung ab dem 11. Dezember 2027.
Wir schauen uns die essenziellen Anforderungen an Hersteller an: Sicherheit durchgängig im Produktlebenszyklus („security-by-design“), Risikobewertung, sichere Updates, Zugriffskontrollen, Schwachstellenmanagement, und wie Dokumentation und SBOMs ausgestaltet sein müssen - unterstützt durch die technische Richtlinie TR-03183 des BSI als praktischer Leitfaden.
Außerdem erarbeiten wir, was das Ganze für End-kund:innen und Nutzer bedeutet: klare Produkt- und Sicherheitshinweise, transparente Sicherheitsupdates, Kontaktpunkte für Sicherheit (PSIRT / SPOC), einen nachvollziehbaren Supportzeitraum und wie Unternehmen konkret eine Lücke („Gap“) zwischen dem aktuellen Status und CRA-Konformität schließen können.
Da das Workshop-Material recht theoretisch ist, soll mit Diskussionen und Beispielen der Teilnehmer gearbeitet werden, um Fragen zu diskutieren und den Workshop interaktiver zu gestalten. Viele Fragen des CRA sind in der Praxis noch nicht abschließend geklärt. Je nach Hintergrund der Teilnehmer und Zeitverlauf können wir einmal den Umgang mit Meldungen eines Herstellers oder das Schwachstellenhandling in einem PSIRT unter dem Cyber Resilience Act durchspielen.
Da der CRA ein grundlegender Standard bedeutet, wird sich Gelegenheit ergeben zu diskutieren, welche Produkte zukünftig unter den CRA fallen, welche Rollen im CRA mit welchen Verantwortungen einhergehen, aber auch wie sich Informationen, die Hersteller auf Basis des CRAs an Ihre Kunden bereitstellen müssen, in die eigenen Prozesse integrieren lassen.
Michael Helwig is a cybersecurity strategist and expert working on a wide range of product and cybersecurity topics with a background in secure software development. He is the co-founder of a security consulting firm that helps clients across industries implement product security programs, adopt DevSecOps, and achieve compliance with various standards.
This workshop aims to introduce Security Professionals, Developers, Architects, and Product Managers to integrating AI assistance into their threat modeling workflows. In this session, participants will learn how to leverage AI for diagramming, threat identification, and countermeasure recommendations to speed up threat model analysis.
To bring these concepts to life, the workshop includes a guided case study on a Digital Wallet / Payment App, where participants will use AI tools to generate a data flow diagram, identify threats using STRIDE, propose mitigations mapped to industry standards, and summarize findings for business stakeholders. This integrated exercise provides an engaging, end-to-end view of how AI can support—but not replace—human judgment in threat modeling.
While participants should have a working knowledge of Generative AI and LLM concepts and tools (e.g., prompt engineering), no prior experience with threat modeling is required.
Georges Bolssens started coding in the early 1990s and shifted to application security in 2017. A passionate teacher and experienced developer, he is known for making complex topics understandable through clear analogies. As an Application Security Consultant at Toreon, Georges assists clients in developing strong threat models for their digital assets. He has also conducted threat modeling training at OWASP, Black Hat, and Troopers, sharing his expertise with audiences around the world.
Generative AI is supposed to make our lives easier. But what if it's really just coding us straight into a new Dark Age? We hand over our systems to AI agents, only to watch them invent backdoors nobody asked for. Developers are left with the glamorous job of bug janitors, while attackers get new exploits. It's hard not to feel like we are front-row spectators to the collapse of digital civilization. This talk shows how these risks are multiplying, and how the public debate around security often misses the point, making it even harder to fix what is broken. Maybe what we are really witnessing is the world's biggest live demo of the digital apocalypse. But sometimes you have to watch everything burn down before you can rebuild it better.
Eva Wolfangel is a journalist, author, speaker and moderator. She works for ZEIT, Deutschlandfunk, Technology Review, Reportagen and many others. Her focus is on combining complex topics with creative storytelling to reach a broad audience.
In 2020 she received the German Reporterprize, in 2019/20 she was a Knight Science Journalism Fellow at MIT in Boston, in 2018 she was awarded European Science Journalist of the Year. She speaks and writes on topics such as artificial intelligence, virtual reality, cybersecurity and the ethics of technology.
Her book "Ein falscher Klick" about cybercrime and cyberwar was published in fall 2022 with Penguin Randomhouse.
With the increasing reliance on third-party software components, ensuring their security against known vulnerabilities has become a daily challenge for individuals and organizations. Despite the availability of a variety of tools and databases, we found all of them fall short when applied to real-world scenarios - raising questions about their effectiveness, generalizability, and practical utility.
Starting from our perspective as penetration testers, we identified three main problems with existing solutions in vulnerability identification:
In order to solve these challenges, we developed the open-source tool search_vulns. It leverages information from multiple data sources and uses text comparison techniques and CPEs in combination to increase accuracy in software identification. Due to this approach, it can even automatically generate CPEs that have yet to be published. Together with its custom logic for version comparison, this further enhances the quality of results. Finally, search_vulns provides a fine-granular export of results in different formats.
In conclusion, this talk aims to simplify the surprising complexity of finding known vulnerabilities in software. To do so, we discuss common challenges in mapping software names to CPEs, e.g. for product rebrandings, single-version vulnerabilities and yet to be published software versions. In addition, we present an approach using multiple data sources in combination to enrich CVE data with information on known exploits, likelihood of exploitability (EPSS) and other data sources. Finally, we present search_vulns as open-source tool.
Dustin Born is a senior security consultant and penetration tester at usd AG, an information security company based in Germany with the mission #moresecurity. He focuses on pentests of web applications, cloud environments and mobile applications.
Matthias Göhring is security consultant and Head of usd HeroLab, the department specializing in technical security assessments. In addition, he holds lectures at TU Darmstadt and Hochschule Darmstadt on ethical hacking and penetration testing. In previous scientific work, he focused on network and communication security as well as software security.
PDFs are considered static and trustworthy - but in fact, they are far more dynamic than most users realize. With XML Forms Architecture (XFA), Adobe introduced a powerful extension back in 1999 that is used in millions of forms worldwide.
It allows dynamic layouts, scripts, network communication, and even file access - opening up a huge, previously unexplored attack surface. In addition, PDFs support JavaScript functions and actions that can dynamically change the contents of PDFs. This enables various attacks on digital signatures. The presentation for German OWASP Day is divided into two main parts.
Sören Borgstedt is a research assistant and doctoral candidate working with Vladislav Mladenov at the NDS Chair at RUB. His research focuses on document security, particularly PDF documents. He holds a master's degree in computer science from TU Dortmund.
Titus Vollbracht is a research assistant and doctoral candidate working with Christian Mainka at the ROSES Chair at BUW. His research focuses on the security of digital documents. He already dealt with dynamic PDF files in his master's thesis at RUB and is now expanding on this topic in his doctoral thesis.
Security teams often inherit their organisation's structure - for better or worse. The way you design your AppSec programme and choose your team topology can determine whether security becomes a trusted enabler or a frustrating bottleneck.
In this story-driven session, we follow Alex, who begins as the only security person in a 50-person startup. At first, Alex builds a centralised AppSec team, finding it effective for control but slow to scale. As the company grows to hundreds of employees, bottlenecks appear, and burnout looms. Alex experiments with embedded security engineers, Security as a Platform, and a Security Champions network, learning the trade-offs of each approach along the way.
Javan Rasokat is a DevOps Security Specialist at Sage, where he joined five years ago to lead Product Security for Central Europe and now supports products globally, contributing on the standardisation of security controls. He discovered his passion for security early in his career while identifying and reporting vulnerabilities, which led him to transition from full-stack web and mobile engineering into security. On the side, he lectures Secure Coding at DHBW University in Germany, and has shared his research and workshops at conferences including DEFCON, OWASP Global AppSec, and Blackhat.
Vanessa Sutter is a Senior Security Operations Specialist at Frontify with a background as a full-stack engineer. She discovered her passion for security while taking the lead on secure practices within her engineering team, later contributing to initiatives such as the company's Bug Bounty Program. Alongside her role, she trains apprentices, teaches at a vocational school, and serves as an expert for the Swiss final apprenticeship project (IPA).
Companies within the European Union are increasingly required to be able to issue and process electronic invoices according to EU standards. For example, since January 2025, companies in Germany have been required to support electronic invoices in B2B contexts.
While it is desirable to standardize invoice data formats, the EU standards have severe problems. They are overly and needlessly complicated, and security was not given much consideration. An unfortunate design choice to use a problematic "standard" (XSLT 2/3) only supported by a single implementation with inherent security problems makes security vulnerabilities in electronic invoicing software even more likely.
The EU standard allows multiple redundant XML data formats to encode electronic invoices. XML processing has several well-known, inherent security problems, most notably file exfiltration via XML eXternal Entity (XXE) attacks.
It appears that XML security was not considered during the creation of these standards. Neither the standardization documents nor the information found on various government and EU web pages contain any information about avoiding XML security flaws.
Therefore, unsurprisingly, security vulnerabilities in software processing these electronic invoices are very common.
Hanno Böck works as a freelance journalist and IT security researcher. In the past, he has uncovered numerous security vulnerabilities, including the ROBOT attack, weaknesses in STARTTLS, and implementation flaws in AES-GCM.
Die von LangSec beschrieben grundlegenden Sicherheitsprinzipien erklären die Hauptursachen vieler Sicherheitslücken und wie man diese beheben kann. LangSec sieht die anhaltende Schwachstellen-Epidemie in Software als eine Folge der ad-hock Entwicklung von Code, der Ein- und Ausgaben verarbeitet. Gemäß LangSec besteht der Schlüssel zur Entwicklung vertrauenswürdiger Software, die mit potenziell bösartigen Eingaben korrekt umgeht, darin alle gültigen oder erwarteten Eingaben und Ausgaben als formale Sprache zu behandeln. Dementsprechend müssen die Routinen zur Verarbeitung von Eingaben und Ausgaben als Parser beziehungsweise Unparser für diese Sprache behandelt werden und auch dementsprechend entwickelt werden. In diesem Vortrag möchte ich LangSec und die Implikationen für unsere tägliche Arbeit in AppSec vorstellen ohne in die Tiefen der Theoretischen Informatik und des Compilerbaus abzudriften.
Lars Hermerschmidt war mal Pentester und hat sich gefragt, warum er überall XSS findet. Daraufhin hat er sich in seiner Doktorarbeit damit befasst, das Injection Problem allgemein zu lösen. Seit 2016 bringt er Entwickler:innen dieses und anderes AppSec-Wissen näher als Trainer, Coach oder aktuell als Security Champion Programm Lead bei der REWE digital.
Web application firewalls are often seen as a hindrance when going live, as perimeter WAFs can clash with GitOps-driven platforms. Empowering development teams with an application-centric WAF setup allows them to run and tune the WAF throughout the entire development lifecycle. It also enables full integration into any CI/CD pipeline or GitOps approach, reducing late surprises during deployment.
In this talk, we demonstrate the application-centric approach with Envoy Proxy, OWASP Coraza, and the OWASP Core Rule Set (components are examples and interchangeable; focus is on principles and selection criteria), and take you along our real-world journey - highlighting the challenges and lessons learned. What you'll take away: We show where this reusable reference design reduces friction and where it backfires, and we outline the governance and guardrails needed to make it work in practice.
Lukas Funk has 10+ years of experience designing, integrating, and operating web application firewalls. As a Security Solution Architect at United Security Providers, he helps organizations turn WAF/WAAP into a foundational building block of web application defense. Lukas focuses on OWASP-aligned controls, policy-as-code, and GitOps for Kubernetes to reduce false positives and release friction.
Die Zukunft der Authentifizierung ist passwortlos - Passkeys sind die zentrale Technologie. Dieser Vortrag unterstützt Entwickler:innen bei der Einführung von Passkeys im Unternehmen und hilft bei der Entscheidung zwischen Eigenentwicklung, SDK oder Passkey-as-a-Service-Lösungen. Sie lernen, wie Recovery-Flows und Fallback-Mechanismen nutzerfreundlich gestaltet werden, wie Passkeys sicher geräte- und plattformübergreifend geteilt werden können und welche Sicherheitsstufe sie gegenüber traditionellen Verfahren bieten. Praxisnahe User Stories und konkrete Beispiele zeigen typische Stolperfallen und helfen Ihnen, die Vorteile von Passkeys optimal zu kommunizieren.
Martina Kraus ist Expertin für Websicherheit und Application Security Engineer. Sie integriert Sicherheits-Best-Practices in alle Phasen der Softwareentwicklung. Als Google Developer Expert (GDE) teilt sie ihr Wissen auf internationalen Konferenzen und schreibt gerade an einem Buch zur Authentifizierung und Autorisierung in Web-Applikationen.
The OWASP secureCodeBox project aims to provide a unified way to run and automate open-source scanning tools like nmap, nuclei, zap, ssh-audit, and sslyze to continuously scan the code and infrastructure of entire organizations.
This allows setting up automated scans that will regularly scan internal networks and internet-facing systems for vulnerabilities. The SCB also allows defining rules to automatically start more in-depth scans based on previous findings, e.g., to start a specialized SSH scan if a port scan discovers an open SSH port.
Scan results can be uniformly handled with prebuilt hooks, e.g. to send out alerts via messaging tools, or to ingest the findings into vulnerability management systems like OWASP DefectDojo.
Jannik Hollenbach is one of the project leads of the OWASP secureCodeBox and newly also the co-project lead of the OWASP JuiceShop project. In his work life, he's working on writing, operating, and securing software, often in and around Kubernetes.
Mit WebAuthn sollte das Passwort im Web abgelöst werden: einheitliche, sichere, handhabbare Authentifizierung für alle! Großes Alleinstellungsmerkmal sollte die Unmöglichkeit von Phishing-Angriffen sein. Mit der Weiterentwicklung in Form von Passkeys wurden einige Usability-Verbesserungen vorgenommen, um die breite Adaption zu ermöglichen. Dabei wurden einige Sicherheitsprinzipien von WebAuthn aufgeweicht.
Dieser Vortrag beschäftigt sich mit der Sicherheit von Passkeys, insbesondere der Möglichkeit für Phishing-Angriffe. Wir erläutern die Möglichkeiten eines Angreifers, mittels Spear Phishing Zugang zu Passkey Credentials zu bekommen, und welche Voraussetzung dafür gegeben sein muss. Außerdem demonstrieren wir eine praktische Möglichkeit in begrenztem Rahmen für solche Angriffe und diskutieren Gegenmaßnahmen.
Die Teilnehmenden lernen, welche Sicherheitsprinzipien von WebAuthn für Passkeys weiterhin gelten, und welche nicht. Sie erfahren, wieso Passkeys nicht mehr komplett phishing-proof sind und wie sie diese Abwägung für den eigenen Einsatz von Passkeys bewerten können.
Michael Kuckuk ergänzt sein Masterstudium der Informatik an der Technischen Uni München durch seine praktische Arbeit als werkstudentischer Fullstack Entwickler bei inovex. Während sein tägliches Brot zwar Themen wie Code-Qualität oder UX sind, achtet er stets darauf, dass Privacy und Security nicht zu kurz kommen.
In this presentation, we will highlight how threat modeling, as a proactive measure, can increase security in DevOps projects.
We will introduce OWASP Cumulus, a threat modeling card game designed for threat modeling the Ops part of DevOps processes. This game (in combination with similar games like Elevation of Privilege or OWASP Cornucopia) enables DevOps teams to take the security responsibility for their project in a lightweight and engaging way.
In his role as a Senior Consultant at TNG Technology Consulting, Christoph Niehoff develops software products for his clients on a daily basis. As a full-stack developer, he lives and breathes DevOps, overseeing all steps of the development cycle. The security of the products is particularly close to his heart. He is the project lead of the threat modeling card game OWASP Cumulus.
Threat modeling stands at a critical juncture. While essential for creating secure systems, it remains mostly manual, handcrafted, and often too slow for today's development cycles. At the same time, automation and AI offer new levels of speed and scalability— but how much can we rely on them?
This talk explores the tension between automation and human expertise in threat modeling. We'll dissect the traditional threat modeling process—scoping, modeling, threat identification, risk analysis, and mitigation—and perform a step-by-step gap analysis to identify what can realistically be automated today, what cannot, and why.
We'll dive into:
We will ground this analysis with examples from organizations and academic research that aim to scale threat modeling without compromising depth or quality, drawing parallels to how other activities, such as SAST and DAST scanning, evolved.
Attendees will walk away with a practical roadmap for integrating automation without undermining the human insight threat modeling still requires.
This talk isn't a tool pitch. It's a candid, experience-based view of where automation can meaningfully accelerate threat modeling—and where the human must remain firmly in the loop.
Georges Bolssens began coding in the early 1990s and turned to application security in 2017. A passionate teacher and seasoned developer, he is known for making complex topics accessible through clear analogies. As an Application Security Consultant at Toreon, Georges helps clients build robust threat models for their digital assets. He has also delivered threat modeling trainings at OWASP, Black Hat, and Troopers, sharing his expertise with audiences worldwide.
Sebastien Deleersnyder
tbd
tbd
Do you always read the documentation before using a function in your languages' standard library? This talk explores the attack surface of a special feature in PHP which is easy to misuse with unforseen consequences. The `extract` function allows to replace the value of local variables named after the keys in an array. Calling it with user-controlled input allows the attacker to change arbitrary variables in the program. The documentation warns against the dangers of using it with untrusted data, but our large-scale analysis on 28.325 PHP projects from GitHub shows, that this warning is ignored.
The talk walks through the process of identifing `extract`-based vulnerabilities and how they might have ended up the way they are by looking at the surrounding code. After introducing different levels of attacker-control guided by concrete exploits, listeners gain an intuition on what to look out for while reviewing code.
Attending this talk, the audience will learn:
Jannik Hartung is a Ph.D candidate in the Institute for Application Security at the Technische Universität Braunschweig with work focussing on code analysis and vulnerability exploitation. He enjoys teaching hacking skills and the hacker's mindset to aspiring students in multiple security labs.
Additionally, he is an active open source developer, currently maintaining the exploit development framework pwntools and contributing to other related tools like pwndbg and gdb as well as others. In his spare time, he is actively participating in Capture the Flag (CTF) IT-Security competitions in multiple international teams. When he's not in front of a screen, he likes bouldering and singing.
Model Context Protocol (MCP) is the latest hot topic in cybersecurity. Business wants it (AI is the new mantra), developers are excited (new toys, new code), and security teams are left to make it safe—often with already packed schedules. Let's treat it like just another Tuesday. Like many shiny new technologies (remember the early days of cloud?), MCP is being built with a “features first, security later” mindset. As a fresh piece of tech, it blends novel vulnerabilities with familiar, well-known ones. If you're an early adopter, it's important to accept that MCP and its current implementations are imperfect—and to be ready for that. In this talk, we'll dive into the real-world challenges companies are facing with MCP and equip you with practical remediations.
We'll cover topics such as:
Mateusz Olejarka is a Principal Security Consultant. Over 10 years of experience in IT security. His main focus is web application penetration testing. He has performed more than 90 application security trainings. Previously worked as a software developer, building software for the financial sector. He has been a speaker at various conferences including Black Hat Asia, CONFidence, Hacktivity. Former OWASP Poland board member. A casual bug bounty hunter, listed in the Halls of Fame of Adobe, Algolia, GM, Jet, Netflix, Tesla, Twitter, Uber, and Yahoo.
Dawid Nastaj IT Security Consultant Professional with almost 5 years of experience in IT security. Throughout his career, he has had the opportunity of managing, configuring, and working with various security systems. His skills encompass areas such as SIEM, WAF and NIDS. As a result, he possesses a comprehensive understanding of data protection and IT infrastructure. Currently focusing on threats related to LLM and it's integrations. Awarded for discovering a total of 18 CVEs, active member of Bug Bounty programs - contributed to uncovering 16 CVEs including 3 critical and 9 high severity in the area of LLM security.
Browser extensions are a powerful part of the Web ecosystem as they extend browser functionality and let users personalize their online experience. But with higher privileges than regular web apps, extensions bring unique security and privacy risks. Much like web applications, vulnerabilities often creep in, not just through poor implementation, but also through gaps in developer awareness and ecosystem support.
In this talk, we share insights from a recent study in which we interviewed and observed 21 extension developers across the world [1] as they worked on security and privacy-related tasks that we designed based on our prior works and observations [2, 3]. Their live decision-making revealed common misconceptions, unexpected pain points, and ecosystemic obstacles in the extension development lifecycle. Extending beyond our published results, we plan to highlight some of the untold anecdotes, insecure development practices, their threat perception, the design-level challenges, as well as the misconceptions around them.
The audience will take away the following items from the presentation/discussion:
References:
Shubham Agarwal a final year Ph.D student in the Secure Web Applications Group (SWAG) at the CISPA Helmholtz Center for Information Security & Saarland University, where he is supervised by Dr.-Ing. Ben Stock.
His research interests include Application Security & Data Privacy. His currently focus on the the client-side security of Web applications, browser extensions and large-scale vulnerability detection.
He will continue his research as post-doctoral researcher at MPI-SP, Bochum starting September 2025 at SPRING Lab, headed by Carmela Troncoso.
We hacked 7 of the16 publicly-accessible YC X25 AI agents. This allowed us to leak user data, execute code remotely, and take over databases. All within 30 minutes each. In this session, we'll walk through the common mistakes these companies made and how you can mitigate these security concerns before your agents put your business at risk.
Rene Brandel is the Cofounder & CEO of Casco. Before Casco, he was the Head of Product at AWS and inventor of "Kiro" - AWS' agentic IDE. He has a long-standing passion for AI, cloud, and developer tools. In fact, he won Europe's largest hackathon in 2016 with a voice-to-code agent before generative AI became a common-place technology.
As a CISO (or any other security expert) in the area of AI, you can find yourself in increasingly challenging and sometimes bizarre AI-related situations not unlike Alice's adventures in Wonderland.
Depending on whom you speak to, people either have high (inflated?) expectations about the (magic?) benefits of AI for security efforts, or try to explain why "AI security Armageddon" is looming... and that is just the security part of the story. All other areas in your organization are heavily using or experimenting with AI (e.g., vibe coding, automation, decision making, etc.), challenging (or ignoring) established security practices.
This talk tells the story of the daily experience of dealing with AI as a CISO in a cloud-application startup. Which experiments failed or were successful, which advice is helpful, what is difficult to apply in practice, which questions are still open...
The motivation for this talk is to start a conversation among security experts on how we can shape a secure AI future and not get pushed into the role of being seen as "hindering" AI progress.
Holger Mack's enthusiasm for the security topic started back in the 1990s while studying for an MSc. in Information Security at Royal Holloway, University of London. Holger is convinced that security, if applied correctly and appropriately, is a key enabler for successful business applications. In this capacity, he has spent most of his career in the middle between business needs and security - with a special interest in the impact of new developments (e.g., PKI, cloud, AI).
After working for SAP in different capacities including Head of SAP HANA Security, Holger currently works as Head of Security at Everest Systems GmbH.
Coding Assistants wie Github Copilot, Cursor oder Claude versprechen einen Effizienzboost für die Softwareentwicklung. Doch welchen Einfluss hat die Nutzung dieser Tools auf die Software Security?
Dieser Vortrag analysiert die Vor- und Nachteile von Coding Assistants in Hinblick auf die Sicherheit des entstehenden Codes. Er gibt einen Überblick über die aktuelle Studienlage und die Benchmarks zu den verschiedenen Modellen und diskutiert die Ergebnisse. Neben der Bedeutung von eingebrachten Schwachstellen im Code selbst werden Risiken wie Slopsquatting, Model Poisoning und Rules File Backdoors erläutert. Zuletzt gibt der Vortrag Empfehlungen zu Best Practices für die Nutzung von Coding Assistants: von der richtigen Konfiguration und Nutzung über Richtlinien zum Review und Testen von solchem Code.
Clemens Hübner beschäftigt sich seit über 15 Jahren mit der Schnittmenge von Softwareentwicklung und Security. Nach Tätigkeiten als Software Developer sowie im Penetration Testing ist er seit 2018 als Security Engineer bei inovex. Dort begleitet er heute Entwicklungsprojekte auf Konzeptions- und Implementierungsebene, schult Kolleg:innen und Kund:innen und berät zu DevSecOps. Als Speaker wird er auf Techkonferenzen im In- und Ausland zu praktischen Themen der Anwendungssicherheit eingeladen.
Der Cyber Resilience Act, kurz CRA, ist eine neue Verordnung der EU und tritt im Dezember 2027 vollständig in Kraft. Das Kernelement der Verordnung ist die Softwaresicherheit für alle so genannten „Produkte mit digitalen Elementen“, die auf dem EU-Markt kommerziell angeboten werden. Diese umfassen sowohl vernetzte Hardware-Produkte, in denen Firmwares laufen, als auch reine Softwareprodukte. Die Anforderungen an die Software-Hersteller erstrecken sich von grundsätzlichem „Security by Design“ und „Secure by Default“, über Bedrohungsanalysen der Software bis hin zu verpflichtendem Patching und Schwachstellenmanagement.
Die Themen klingen irgendwie familiär? Kein Wunder, denn eine ganze Reihe von Projekten aus dem OWASP-Ökosystem sind geradezu prädestiniert zum Einsatz im Kontext des CRAs. Nicht nur, dass mit CycloneDX einer der zwei de-facto SBOM-Standards aus OWASP heraus entstanden ist - auch Frameworks wie OWASP SAMM oder Tools wie Dependency-Track können ganz entscheidende Rollen für die Umsetzung von Supply-Chain-Security und SDLC-Prozessen spielen.
In diesem Talk schauen wir uns die Anforderungen der Verordnung genauer an und blicken dann auf Schnittstellen zu OWASP-Projekten. Dies soll am Ende helfen, sowohl für die Seite der Hersteller ein besseres Bild für OWASP zu erzeugen, als auch von OWASP-Seite aus zielgenauer auf CRA-Verpflichtete zugehen zu können. Je mehr Menschen sich in den Themen wiederfinden und Zusammenarbeit entstehen kann, desto besser.
Dominik Pataky ist seit vielen Jahren in der Software- und Netzwerk-Security unterwegs. Das Mapping von Gesetzen und Compliance-Regeln auf technische Implementierung begleitet ihn mittlerweile seit über fünf Jahren. Nach seiner Position in der Informationssicherheit im Frankfurter Finanzwesen machte er sich als IT-Consultant selbständig und übernahm später beim SCS die Position als PO für Security & Operations. Nun fokussiert er sich gänzlich auf den CRA und baut Software-Lösungen für deutsche Unternehmen. Er ist außerdem OWASP-Member und ein großer Freund von freier open-source Software.
Web application scanners are popular and effective black-box testing tools, automating the detection of vulnerabilities by exploring and interacting with user interfaces. Despite their effectiveness, these scanners struggle with discovering deeper states in modern web applications due to their limited understanding of workflows. This study addresses this limitation by introducing YuraScanner, a task-driven web application scanner that leverages large-language models (LLMs) to autonomously execute tasks and workflows.
YuraScanner operates as a goal-based agent, suggesting actions to achieve predefined objectives by processing webpages to extract semantic information. Unlike traditional methods that rely on user-provided traces, YuraScanner uses LLMs to bridge the semantic gap, making it web application-agnostic. Using the XSS engine of Black Widow, YuraScanner tests discovered input points for vulnerabilities, enhancing the scanning process's comprehensiveness and accuracy.
We evaluated YuraScanner on 20 diverse web applications, focusing on task extraction, execution accuracy, and vulnerability detection. The results demonstrate YuraScanner's superiority in discovering new attack surfaces and deeper states, significantly improving vulnerability detection. Notably, YuraScanner identified 12 unique zero-day XSS vulnerabilities, compared to three by Black Widow. This study highlights YuraScanner's potential to revolutionize web application scanning with its automated, task-driven approach.
Aleksei Stafeev is PhD Student in the Application Security group at CISPA, Germany. Formerly, an Application Security Specialist at Kaspersky. Building fully automated web security scanners by day and hacking hardware by night.
Der Kurzvortrag stellt den aktuellen Stand der OWASP Top 10:2025 vor, mit etwas Glück haben wir bis dahin schon mehr...
Torsten Gigler ist:
OWASP Juice Shop went through some significant renovation and enhancements over the last year in order to keep current with the underlying Node.js and Angular frameworks. MultiJuicer was entirely rewritten in GoLang and is now faster and more reliable than ever before. All Juice Shop side-projects have been migrated to TypeScript and brought to a common stack for testing and code linting.
But the team did not only clean up and refactor behind the scenes. There are also lots of exciting new features and enhancements available, such as:
Of course the popular Juice Shop Success Pyramid™ will be back with beyond-crazy Docker image download stats and other usage figures!
Björn Kimminich works as Product Group Lead Application Ecosystem at Kuehne+Nagel, responsible - among other things - for the Application Security program in the corporate IT. He is an OWASP Lifetime Member, project leader of the OWASP Juice Shop, and a co-chapter leader for the OWASP Germany Chapter. Björn also currently chairs the OWASP Project Committee.