🧪 Experimental Feature

Focus Areas are an experimental feature that groups related content by tags. This page and its functionality may change as we refine the categorization system.

Web Application Security

Security for web applications, APIs, and web services

137

Total Entries

103

Contributors

134

Unique Tags

115

Related Tags

All Entries (137 total, sorted by date)

Date	Type	Conference	Title	Speaker(s)	Tags
2025-08-07	Tool demo	Blackhat	Frogy 2.0 - Automated external attack surface analysis toolkit	Chintan Gurjar	attack-surface vulnerability-assessment asset-management+2
2025-08-07	Tool demo	Blackhat	Q-TIP (QR Code Threat Inspection Platform)	Rushikesh D Nandedkar	incident-response web-security vulnerability-management+2
2025-08-06	Tool demo	Blackhat	Damn Vulnerable Browser Extension (DVBE): Unmask the risks of your Browser Supplements	Abhinav Khanna, Krishna Chaganti	web-security secure-coding pentesting+3
2025-08-06	Tool demo	Blackhat	Open-Source API Firewall by Wallarm - Advanced Protection for REST and GraphQL APIs	Satinder Khasriya	api-security web-security owasp+1
2025-08-06	Tool demo	Blackhat	SmuggleShield - Protection Against HTML Smuggling	Dhiraj Mishra	web-security malware-detection browser-security+2
2024-11-26	Talk	Blackhat	Critical Exposures: Lessons from a Decade of Vulnerability Research	Nikhil Shrivastava	vulnerability-management sql-injection pentesting+2
2024-11-15	Talk	C0c0n	PCI 4.0, Javascript Security for product security teams	Anand Kumar Ganesan, Mohammad Arif	web-application-security
2024-08-30	Talk	Hitb Sec Conf	Exploiting the In-Vehicle Browser: A Novel Attack Vector in Autonomous Vehicles	Ravi Rajput	web-security pentesting exploitation+4
2024-08-10	Talk	Defcon	Sneaky Extensions: The MV3 Escape Artists	Vivek Ramachandran, Shourya Pratap Singh	web-security pentesting vulnerability-management
2024-06-27	Talk	Troopers	The Hidden Dangers Lurking in Your Pocket – Pwning Apple Wallet ecosystem and its apps	Priyank Nigam	mobile-security pentesting api-security+2
2023-08-12	Tool demo	Defcon	Open Source API Security for devsecops	Ankush Jain, Ankita Gupta 1	api-security devsecops ci-cd+3
2023-08-11	Talk	Defcon	Generative Adversarial Network (GAN) based autonomous penetration testing for Web Applications	Ankur Chowdhary	web-security xss application-pentesting+3
2023-08-11	Tool demo	Defcon	vAPI : Vulnerable Adversely Programmed Interface	Tushar Kulkarni	api-security owasp authorization+1
2023-08-06	Talk	C0c0n	Mitigating SSRF at scale the right way with IMDSv2!	Ayush Priya	web-security api-security aws+3
2023-08-06	Talk	C0c0n	A Secure Privacy-Preserving Lightweight Authentication Scheme for Internet of Medical Things	Panchami V, Mahima Mary Mathews	authentication privacy embedded-security+1
2023-05-11	Tool demo	Blackhat	APKHunt \| OWASP MASVS Static Analyzer	Mrunal Chawda, Sumit Kalaria	owasp
2022-09-24	Talk	C0c0n	Raining CVEs on Wordpress plugins with Semgrep	Shreya Pohekar, Syed Sheeraz Ali	web-security static-analysis sast+2
2022-09-24	Talk	C0c0n	Web3 Security - Security in MetaVerse, and the new world of web3	Rohit Srivastwa	blockchain-security web3 decentralized-systems+3
2022-09-23	Talk	C0c0n	Securing your APIs for a cloud native future	Navendu Pottekkat	api-security secure-development devsecops
2022-09-23	Talk	C0c0n	Threats Landscape and Intelligence of API & Shield to protect	Navaneethan M	api-security threat-landscape threat-hunting+1
2022-09-08	Tool demo	Nullcon	ZaaS: [OWASP] ZAP As A Service - Continous Security For 20K+ APIs	Rohit Sehgal, Varun Kakumani	owasp
2022-08-12	Talk	Defcon	Stop worrying about Nation-States and Zero-Days; let’s fix things that have been known for years	Vivek Ponnada	secure-coding vulnerability-management devsecops+1
2021-11-13	Talk	C0c0n	Exploiting 2A(Authentication and Authorization) Vulnerabilities of Web Application	Gayatri Nayak	web-security authentication authorization+2
2021-11-13	Talk	C0c0n	Server-side javascript Injection	Kavisha Sheth	web-security secure-coding web-pentesting
2021-11-13	Talk	C0c0n	Enhancing An Multi-Factor Authentication (MFA) through Behavioural Biometrics	Kiran Kumar Pg	authentication mfa security-architecture
2021-08-05	Tool demo	Blackhat	reNgine: An Automated Reconnaissance Framework	Yogesh Ojha	web-app-sec
2020-12-10	Tool demo	Blackhat	reNgine: an automated reconnaissance Framework	Yogesh Ojha	web-appsec
2020-11-21	Talk	App Sec Indonesia	Learn how to find and exploit race conditions in web apps with OWASP TimeGap Theory	Abhi M Balakrishnan	web-security owasp application-pentesting+2
2020-10-01	Tool demo	Blackhat	OWASP Python Honeypot	Sri Harsha Gajavalli	web-security owasp pentesting+1
2020-09-18	Talk	C0c0n	Web Application hacking with WebZGround	Parveen Yadav, Narendra Kumar	web-security web-pentesting pentesting+3
2020-08-09	Talk	Defcon	Running an appsec program with open source projects	Vandana Verma Sehgal	owasp secure-development devsecops+3
2020-03-06	Tool demo	Nullcon	Wolverine	Furqan Khan, Siddharth Anbalahan	linux secure-coding web-application-security+3
2020-03-06	Tool demo	Nullcon	Hachi	Parmanand Mishra	att&ck blueteam rest-api+1
2019-09-27	Talk	C0c0n	Stepping into Password Less Economy	Ajit Hatti	authentication identity-management secure-development+1
2019-09-23	Talk	Rootcon	Identity crisis: war stories from authentication failures	Vishal Chauhan	authentication identity-management vulnerability-assessment+3
2019-08-11	Talk	Defcon	Exploiting and Securing iOS Apps using OWASP iGoat	Swaroop Yermalkar	mobile-security ios-security application-pentesting+4
2019-08-08	Talk	Defcon	Phishing in the cloud era	Ashwin Vamshi, Abhinav Singh	phishing api-security web-security+2
2019-08-08	Tool demo	Defcon	Hachi: An Intelligent threat mapper	Parmanand Mishra	att&ck blueteam rest-api+1
2019-03-28	Tool demo	Blackhat	OWASP Nettacker: Automated Penetration Testing Framework	Sri Harsha Gajavalli	network-pentesting vulnerability-assessment firewall+3
2018-12-06	Tool demo	Blackhat	Astra: Automated Security Testing For REST APIs	Sagar Popat, Harsh Grover	api pentest rest-api+1
2018-10-05	Talk	C0c0n	DomGoat - the DOM Security Playground	Lavakumar Kuppan	xss web-application-security
2018-09-27	Talk	Rootcon	Defending cloud Infrastructures with Cloud Security Suite	Shivankar Madaan	cloud aws infrastructure+5
2018-08-12	Talk	Defcon	Last mile authentication problem: Exploiting the missing link in end-to-end secure communication	Siddharth Rao	cryptography web authentication+2
2018-08-11	Tool demo	Defcon	Sh00t—An open platform for manual security testers & bug hunters	Pavan Mohan	pentest bug-hunting opensource+3
2018-08-09	Tool demo	Blackhat	OWASP Offensive Web Testing Framework	Viyat Bhalodia	owasp pentest web+1
2018-08-09	Tool demo	Blackhat	rastrea2r (reloaded!): Collecting & Hunting for IOCs with Gusto and Style	Sudheendra Bhat	opensource incident-response rest-api+1
2018-08-08	Tool demo	Blackhat	Astra: Automated Security Testing For REST APIs	Ankur Bhargava, Prajal Kulkarni, Sagar Popat	pentest api rest-api+2
2017-08-19	Talk	C0c0n	Trust, the foundation of Digital Mastery	Sunil Varkey	identity-management authentication risk-management+2
2017-08-18	Talk	C0c0n	Cloud_Security Suite - One stop tool for auditing cloud infrastructure	Shivankar Madaan, Jayesh Chauhan	cloud aws infrastructure+5
2017-07-29	Tool demo	Defcon	Fuzzapi	Abhijeth Dugginapeddi, Lalith Rallabhandi, Srinivas Rao	fuzzing rest-api pentest+3
2017-07-27	Tool demo	Blackhat	Fuzzapi - Fuzzing Your RESTAPIs Since Yesterday	Lalith Rallabhandi, Abhijeth Dugginapeddi, Srinivas Rao	fuzzing api rest-api+3
2017-06-26	Tool demo	Blackhat	DiffDroid	Anto Joseph	android pentest web-application-security+1
2017-06-23	Talk	Hackinparis	Injecting Security into Web apps with Runtime Patching and Context Learning	Ajin Abraham	web blueteam secure-development+6
2017-05-23	Talk	Phdays	Injecting security into web apps in the runtime	Ajin Abraham	web blueteam secure-development+6
2017-03-03	Talk	Nullcon	Injecting Security into Web apps with Runtime Patching and Context Learning	Ajin Abraham	web blueteam secure-development+6
2017-01-25	Talk	Owasp App Sec California	DASTProxy: Don’t let your automated security testing program stall on crawlInstead focus on business context	Kiran Shirali	dynamic-analysis dast devsecops+3
2017-01-25	Talk	Owasp App Sec California	OCSP Stapling in the Wild	Devdatta Akhawe	web-security vulnerability-management security-architecture+1
2016-10-07	Talk	Deepsec	Inside Stegosploit	Saumil Shah	web-security exploitation pentesting+1
2016-08-19	Talk	C0c0n	Esoteric XSS Payloads	Riyaz Walikar	xss redteam
2016-08-19	Talk	C0c0n	Kill the password - A new era of authentication	Tamaghna Basu	authentication iam security-architecture+1
2016-07-01	Talk	Hackinparis	DIFFDroid - Dynamic Analysis Made Easier for Android	Anto Joseph	android pentest web-application-security+1
2016-03-15	Talk	Groundzerosummit	Web App Security	Harpreet Singh, Himanshu Sharma, Nipun Jaswal	web-security api-security secure-coding+3
2015-11-05	Talk	Ground Zero Summit	Sanctioned to Hack: Your SCADA HMIs Belong to Us!	Aditya K Sood	ics-security web-security vulnerability-management+3
2015-11-05	Talk	Ground Zero Summit	XSS - The art of evading web application filters!	Anirudh Anand	xss web
2015-09-11	Talk	44 Con	Stegosploit – Drive-by Browser Exploits using only Images	Saumil Shah	web strganography redteam+2
2015-08-07	Talk	Defcon	Hacker’s Practice Ground	Lokesh Pidawekar	pentesting ethical-hacking vulnerability-assessment+2
2015-08-01	Talk	C0c0n	Understanding the known : A deep look at OWASP A9 : Using Components with Known Vulnerabilities	Anant Shrivastava	web owasp blueteam
2015-05-28	Talk	Hitb Sec Conf	Stegosploit: Hacking With Pictures	Saumil Shah	redteam steganography web+1
2015-03-27	Talk	Syscan	Stegosploit - Hacking with Pictures	Saumil Shah	web strganography redteam+2
2015-03-26	Tool demo	Blackhat	OWASP Xenotix XSS Exploit Framework	Ajin Abraham	owasp xss blueteam+3
2015-02-06	Talk	Nullcon	Pentesting a website with million lines of Javascript	Lavakumar Kuppan, Ahamed Nafeez	web-application-security pentest web+1
2015-01-27	Talk	Owasp App Sec California	The Emperor’s New Password Manager: Security Analysis of Web-based Password Managers	Devdatta Akhawe	web-security xss csrf+3
2014-08-21	Talk	Usenix	The Emperor’s New Password Manager: Security Analysis of Web-based Password Managers	Devdatta Akhawe	web-security xss csrf+3
2014-03-27	Talk	Blackhat	JS Suicide: Using JavaScript Security Features to Kill JS Security	Ahamed Nafeez	web-application-security redteam csrfguard+1
2014-03-15	Talk	Hitb Sec Conf	JS Suicide: Using Javascript Security Features to Kill Itself	Ahamed Nafeez	web-application-security
2014-02-15	Tool demo	Nullcon	OWASP Xenotix XSS Exploit Framerwork	Ajin Abraham	owasp xss blueteam+3
2014-02-14	Talk	Nullcon	o’Dea Assertions - Untwining the Security of the SAML Protocol	Achin Kulshrestha	authentication web browser+4
2014-02-14	Talk	Nullcon	phoneypdf: A Virtual PDF Analysis Framework	Kiran Bandla	pdf analysis web-application-security+4
2013-11-21	Talk	Appsec Usa	Wassup MOM? Owning the Message Oriented Middleware	Gursev Singh Kalra	api-security vulnerability-management secure-coding+1
2013-11-07	Talk	Ground Zero Summit	Malware for Firefox Mobile OS	Shantanu Gawde	firefox-os mobile
2013-09-27	Talk	C0c0n	Lets Play - Applanting on new Grounds	Ajit Hatti	android redteam csrf+1
2013-09-27	Talk	C0c0n	Snake Bites	Anant Shrivastava	secure-coding web pentest+1
2013-08-15	Talk	Usenix	Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness	Devdatta Akhawe	web-security security-awareness security-architecture+3
2013-08-01	Tool demo	Blackhat	OWASP Xenotix XSS Exploit Framework	Ajin Abraham	owasp xss blueteam+3
2013-07-31	Talk	Blackhat	Clickjacking revisited: A perceptual view of UI security	Devdatta Akhawe	clickjacking ui blueteam+1
2013-07-31	Talk	Blackhat	Javascript static security analysis made easy with JSPrime	Nishant Das Patnaik, Sarathi Sabyasachi Sahoo	web-application-security analysis blueteam
2013-03-15	Tool demo	Blackhat	OWASP Xenotix XSS Exploit Framework	Ajin Abraham	owasp xss blueteam+3
2013-03-14	Talk	Blackhat	Lets play - Applanting	Ajit Hatti	mobile redteam csrf+2
2013-03-01	Talk	Nullcon	Detecting and Exploiting XSS Vulnerabilities and Xenotix XSS Exploitation Framework	Ajin Abraham	xss redteam web
2013-03-01	Talk	Nullcon	CSRF Finder as a Mozilla Addon	Piyush Pattanayak	csrf web blueteam
2013-03-01	Talk	Nullcon	Inception of graphical passwords	Rishi Narang	infrastructure authentication
2013-03-01	Talk	Nullcon	Automating JavaScript Static Analysis	Lavakumar Kuppan	web-application-security web pentest+1
2012-12-01	Talk	Clubhack	Detecting and Exploiting XSS with Xenotix XSS Exploit Framework	Ajin Abraham	xss redteam web
2012-12-01	Talk	Clubhack	XSSshell	Vandan Joshi	xss web shell
2012-10-26	Talk	App Sec Usa	XSS & CSRF with HTML5 - Attack, Exploit and Defense	Shreeraj Shah	xss csrf
2012-10-25	Talk	App Sec Usa	Cross Site Port Scanning	Riyaz Walikar	web-security vulnerability-management owasp+1
2012-10-11	Talk	Hitb Sec Conf	XSS & CSRF strike back – Powered by HTML5	Shreeraj Shah	redteam csrf web+5
2012-09-28	Talk	Nullcon	Alert(/xss/) - How to catch an XSS before someone exploits / reports it?	Ahamed Nafeez	web-security xss secure-coding+2
2012-08-03	Talk	C0c0n	Evil JavaScript	Bishan Singh	redteam web-application-security
2012-07-26	Talk	Blackhat	HTML5 top 10 threats – Stealth Attack and Silent Exploits	Shreeraj Shah	web redteam cors+6
2012-07-14	Talk	Hope	Advancements in Botnet Attacks and Malware Distribution	Aditya K Sood	malware botnet web-security+2
2012-03-15	Talk	Nullcon	An App(le) a day keeps the wallet away	Antriksh Shah	pentesting web-security api-security+1
2012-03-14	Talk	Blackhat	HTML5 top 10 threats – Stealth Attack and Silent Exploits	Shreeraj Shah	web redteam cors+6
2012-02-15	Talk	Nullcon	Content sniffing Algorithm bypassing techniques and possible attack vectors	Anil Aphale, Chaitany Kamble	redteam web xss+3
2012-02-15	Talk	Nullcon	Ra.2 Blackbox DOM-based XSS scanner	Nishant Das Patnaik, Sarathi Sabyasachi Sahoo	xss web blueteam+1
2012-02-15	Talk	Nullcon	Javascript static analysis with IronWASP	Lavakumar Kuppan	web-application-security web pentest+1
2012-02-15	Talk	Nullcon	Node.js: The good, bad and ugly	Bishan Singh	web-application-security redteam blueteam+1
2011-12-04	Talk	Clubhack	DOM XSS – Encounters of the 3rd Kind	Bishan Singh	xss dom redteam+1
2011-10-07	Talk	C0c0n	Password Less Authentication, Authorization	Srikar Sagi	authentication authorization iam
2011-09-19	Talk	Brucon	Step-by-Step for Software Security (that anyone can follow)	Pravir Chandra	software-security secure-development devsecops+4
2011-09-07	Talk	Securitybyte	Social Web & Privacy – An evolving world	Bala Sathiamurthy, Aridaman Tripathi	privacy data-protection api-security+3
2011-09-06	Talk	Securitybyte	Application Security Strategies	K K Mookhey	secure-coding secure-development web-security+3
2011-09-06	Talk	Securitybyte	Enabling Un-trusted Mashups	Bishan Singh	web-security xss csrf+4
2011-09-06	Talk	Securitybyte	Security Threats on Social Networks	Nithya Raman	social-engineering web-security security-awareness+2
2011-08-03	Talk	Blackhat	Reverse Engineering Browser Components: Dissecting and Hacking Silverlight, HTML 5 and Flex	Shreeraj Shah	reverse-engineering web ajax+6
2011-05-20	Talk	Hitb Sec Conf	Next Generation Web Attacks – HTML 5, DOM(L3) and XHR(L2)	Shreeraj Shah	web redteam cors+6
2011-02-25	Talk	Nullcon	(secure) SiteHoster – Disable XSS & SQL Injection	Abhishek Kumar	xss sqli blueteam+2
2010-11-11	Talk	Blackhat	Attacking with HTML5	Lavakumar Kuppan	web-security xss web-pentesting+1
2010-10-13	Talk	Hitb Sec Conf	Hacking a Browser’s DOM – Exploiting Ajax and RIA	Shreeraj Shah	web redteam web-application-security+5
2010-07-29	Talk	Blackhat	Hacking Browser’s DOM - Exploiting Ajax and RIA	Shreeraj Shah	redteam web dom+2
2010-07-01	Talk	Hitb Sec Conf	Top 10 Web 2.0 Attacks and Exploits	Shreeraj Shah	web redteam cors+6
2010-06-18	Talk	Syscan	REVERSE ENGINEERING WEB 2.0 APPLICATIONS	Shreeraj Shah	reverse-engineering web ajax+6
2010-03-15	Talk	Blackhat	400 Apps in 40 Days	Nish Bhalla	vulnerability-management risk-management application-pentesting+2
2009-05-19	Talk	Syscan	Securing Enterprise Applications	Shreeraj Shah	blueteam web web-application-security+13
2008-10-29	Talk	Hitb Sec Conf	Top 10 Web 2.0 Attacks	Shreeraj Shah	blueteam web-application-security ajax+8
2008-08-21	Talk	Owasp App Sec India	AppSec For Managers	Nish Bhalla	appsec owasp web+1
2008-08-20	Talk	Owasp App Sec India	Application Security Trends & Challenges	Kamlesh Bajaj	web owasp appsec
2008-08-20	Talk	Owasp App Sec India	Web 2.0 Attacks - Next Generation Threats on the Rise	Shreeraj Shah	redteam blueteam purpleteam+4
2008-08-20	Talk	Owasp App Sec India	Building Enterprise AppSec Program	Nish Bhalla	web appsec case-study
2008-08-20	Talk	Owasp App Sec India	Web Application Security: Too Costly To Ignore	Rajesh Nayak	appsec web blueteam
2008-04-16	Talk	Hitb Sec Conf	Securing Next Generation Applications â€“ Scan, Detect and Mitigate	Shreeraj Shah	blueteam web-application-security ajax+8
2008-02-20	Talk	Blackhat	Scanning Applications 2.0 - Next Generation Scan, Attacks and Tools	Shreeraj Shah	redteam blueteam purpleteam+4
2007-11-20	Talk	Deepsec	Web 2.0 Application Kung-Fu - Securing Ajax & Web Services	Shreeraj Shah	web ajax web-application-security+1
2007-09-06	Talk	Hitb Sec Conf	Hacking Ajax and Web Services â€“ Next Generation Web Attacks on the Rise	Shreeraj Shah	web redteam ajax+1
2007-04-05	Talk	Hitb Sec Conf	WEB 2.0 Hacking – Defending Ajax and Web Services	Shreeraj Shah	web redteam blueteam+3
2007-03-15	Talk	Blackhat	Exploit-Me Series – Free Firefox Application Penetration Testing Suite Launch	Nish Bhalla, Rohit Sethi	web-security xss sql-injection+4
2006-08-02	Talk	Blackhat	SQL Injections by Truncation	Bala Neerumalla	web-security sql-injection secure-coding+1

🧪 Experimental Feature

Web Application Security

Top Contributors

Related Tags (21)

All Entries (137 total, sorted by date)