Apr 14, 2020
Tanya's AppSec Course
Server-side request forgery - https://portswigger.net/web-security/ssrf
What are differences between Stored XSS and SSRF?
This requires a MITM type of issue?
Doesn’t stored XSS get stored on the server?
What conditions must exist for SSRF to be possible?
What mitigations need to be in place for mitigation of SSRF? CORS? CSP?
Would a WAF or mod_security be effective?
Can it be completely mitigated or are there still ways around it?
Part2 -next week
Github actions - https://github.com/features/actions
How are these written?
It looks like a marketplace format? How do they maintain code quality?
What does it take setup the actions?
It looks like IFTTT for DevOps?
What kind of integrations does it allow for? Will it handle logins or API calls for you?
Is it moderated in some way? What’s the acceptance criteria for these?
What are you trying to
accomplish by using Github Actions?
What are the benefits of using these over XX product?
What is gained by using this?
Mention twitch Channel and when (join the mailing list)
Github actions “Twitch.tv/shehackspurple”
Coaching, Project Management, Scrum Management
Alice and Bob learn Application Security - Wylie - Fall/Winter 2020
Check out our Store on Teepub! https://brakesec.com/store
Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email firstname.lastname@example.org
#Youtube Channel: http://www.youtube.com/c/BDSPodcast
#iTunes Store Link: https://brakesec.com/BDSiTunes
#Google Play Store: https://brakesec.com/BDS-GooglePlay
Our main site: https://brakesec.com/bdswebsite
#iHeartRadio App: https://brakesec.com/iHeartBrakesec
Comments, Questions, Feedback: email@example.com
Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon
#Player.FM : https://brakesec.com/BDS-PlayerFM
#Stitcher Network: https://brakesec.com/BrakeSecStitcher
#TuneIn Radio App: https://brakesec.com/TuneInBrakesec