Preview Mode Links will not work in preview mode

Apr 14, 2020

Tanya's AppSec Course

Server-side request forgery -

What are differences between Stored XSS and SSRF? 

This requires a MITM type of issue?

Doesn’t stored XSS get stored on the server?

What conditions must exist for SSRF to be possible?

What mitigations need to be in place for mitigation of SSRF? CORS? CSP?

Would a WAF or mod_security be effective?

Can it be completely mitigated or are there still ways around it?

Part2 -next week


Github actions -

How are these written? 

It looks like a marketplace format? How do they maintain code quality?

What does it take setup the actions?

It looks like IFTTT for DevOps?

What kind of integrations does it allow for? Will it handle logins or API calls for you?

Is it moderated in some way? What’s the acceptance criteria for these?

What are you trying to accomplish by using Github Actions?
What are the benefits of using these over XX product?

What is gained by using this?


Mention twitch Channel and when (join the mailing list)

Github actions “”


Coaching, Project Management, Scrum Management


Alice and Bob learn Application Security - Wylie - Fall/Winter 2020


Tanya Janca


Check out our Store on Teepub!

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email

#Brakesec Store!:




#Youtube Channel:

#iTunes Store Link:

#Google Play Store:

Our main site:

#iHeartRadio App:


Comments, Questions, Feedback:

Support Brakeing Down Security Podcast by using our #Paypal OR our #Patreon

#Twitter@brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM :

#Stitcher Network:

#TuneIn Radio App: