| title | displaytext | layout | tab | order | tags |
|---|---|---|---|---|---|
meetings |
Chapter Meetings |
true |
2 |
belgium |
This chapter meeting will take place at E&Y in Diegem.
Kouterveldstraat 7B 001, 1831 Diegem
- 18h00-18h30: Welcome and refreshments
- 18h30-18h40: OWASP Update
- 18h40-19h30: JWT security and exploitation (by Louis Nyffenegger, founder of PentesterLab)
- 19h30-19h45: Break
- 19:45-20h45: Breaking and securing OAuth 2.0 in frontends (by Dr. Philippe De Ryck, Founder of Pragmatic Web Security)
- 21:00: Close
Our chapter meetings are open for everyone, and attendance is free of charge. We ask you to register on Meetup in order to provide you with last-minute updates, if needed.
Registration: https://www.meetup.com/nl-NL/belgium-owasp-meetup-group/events/303275104/{:target="_blank"}
Abstract: Nowadays, JSON Web Tokens (JWTs) are ubiquitous, serving as session tokens, OAuth tokens, or simply as a means to pass information between applications or microservices. However, by design, JWTs contain numerous security and cryptography pitfalls that can lead to serious vulnerabilities. In this talk, we will explore how to exploit some of these issues. We'll begin by examining some well-known vulnerabilities, such as the 'none' algorithm and brute-forcing or guessing the HMAC secret. Then, we'll move on to more recent issues, including how an RSA public key can be computed from multiple signatures to exploit algorithm confusion, and how a similar attack can be executed against ECDSA. We will also delve into exploiting weaknesses in the kid, jku, and x5u headers. Finally, we'll discuss how to leverage CVE-2022-21449 to bypass the signature mechanism entirely.
About Louis Nyffenegger: Louis Nyffenegger is a seasoned security engineer and the founder of PentesterLab, a platform dedicated to teaching web penetration testing. With over a decade of experience in cybersecurity, Louis has focused on penetration testing, architecture analysis, and code reviews. He also launched a YouTube channel, AppSecSchool, further extending his passion for education in application security.
Breaking and securing OAuth 2.0 in frontends (by Dr. Philippe De Ryck, Founder of Pragmatic Web Security)
Abstract: Everyone agrees that Cross-Site Scripting (XSS) is a real threat to browser-based applications, yet many underestimate its true power. Common practices like using Single Page Applications as OAuth 2.0 clients, with techniques such as refresh token rotation, fail to account for real-world attackers.
This talk will demonstrate two concrete hacks against frontend OAuth 2.0 clients, highlighting the underlying vulnerabilities. We will explore how to address these security shortcomings by introducing structural solutions like the Backend-for-Frontend pattern. By the end of this session, you will be fully up to speed with the latest updates to the "OAuth 2.0 for Browser-based Apps" specification, co-authored by the presenter. You will walk away with a solid understanding of OAuth 2.0 security in frontends and best practices for securing sensitive applications.
About Dr. Philippe De Ryck: Philippe De Ryck specializes in making web security accessible to developers and architects, leveraging his Ph.D. from KU Leuven to inform his comprehensive understanding of security challenges. As the founder of Pragmatic Web Security, he provides practical security training and consulting services to organizations worldwide. His online course platform offers a self-paced approach to learning about security. Philippe also actively helps shape OAuth 2.0 best practices as the co-author of the best practices for browser-based apps specification. Philippe is recognized as a Google Developer Expert, acknowledging his contributions to web application and API security. He also organizes SecAppDev, an annual week-long application security course in Belgium.