When Data Becomes Code: A Jumpstart for Web Security Testing

At the the heart of many security attacks is the possibility that a malicious user provides carefully crafted data which goes on to be interpreted by a virtual machine. In technical terms, such a manipulation is called an injection attack. An example would be someone providing malicious data in place of an input as innocent as a book id, but resulting in disclosure of user names and passwords.

This workshop explores in the simplest possible manner, how and why such attacks work. It takes the participants through practical demonstration of such malicious payload crafting. Rather than teaching them payloads which they can cram, it helps them in building such payloads and then applying this knowledge to understand others.

All in all, this workshop would result in a strong foundation for attendees in web application security testing, on which they can build further towards limitless opportunities.