{"id":303,"date":"2023-06-19T19:14:05","date_gmt":"2023-06-19T19:14:05","guid":{"rendered":"https:\/\/3.85.236.57\/?page_id=303"},"modified":"2024-07-13T04:35:21","modified_gmt":"2024-07-13T04:35:21","slug":"com-appsec-community","status":"publish","type":"page","link":"https:\/\/saintcon.org\/com-appsec-community\/","title":{"rendered":"COM – AppSec Community"},"content":{"rendered":"

\"\"<\/p>\n

\n

Brought to you by<\/small>
sketrik <\/strong>and l4wke
<\/strong><\/p>\n<\/div>\n

Applications run everything, and we run the Applications. Join us!<\/h2>\n
\n

Looking to get your feet wet in code security?<\/strong> Hacked a thousand applications but never actually fixed one?<\/em> The AppSec Community teaches how to find and fix vulnerabilities<\/em> in both running sites and source code. Attendees will have an opportunity to identify vulnerabilities via walkthroughs of known vulnerabilities and exploits, discover common security flaws in code, take application security tools for a spin, or participate in fixing a nuanced security edge case. Whether a beginner or an experienced pro, the AppSec Community will upgrade your abilities in both finding and fixing flaws.<\/strong><\/p>\n<\/div>\n

Everything you need to know…<\/h3>\n
\n

In the Application Security Community, where we show the importance of keeping your application code secure. \u00a0We will run through practices on how to identify, fix, and prevent vulnerabilities in running applications and source code. In addition, we will show you how to evaluate your application security program, use common application security tools, and model threats to your applications.
<\/span><\/p>\n

What we will teach:<\/h4>\n

The AppSec community is back with more tools, more content, and more challenges!<\/span><\/p>\n

We will guide attendees in the finding and fixing vulnerabilities, through manual processes and use of SAST<\/strong>, DAST<\/strong>, and SCA<\/strong> tools. Sample vulnerable repositories will be provided for attendees to learn and practice the use of these tools.<\/p>\n

Static Application Security Testing (SAST):<\/strong> Use tools such as FluidAttacks and Snyk to identify vulnerabilities in code, and learn how to remediate them<\/span><\/p>\n

Dynamic Application Security Testing (DAST):<\/strong> Use tools such as OWASP ZAP to analyze a running application for security misconfigurations<\/span><\/p>\n

Software Composition Analysis (SCA):<\/strong> Use tools such as Google’s <\/span>osv.dev<\/span><\/a> to identify vulnerable third party components of an application<\/span><\/p>\n

Once you’ve found a vulnerability, learn how to use Git to submit a fix through a pull request.<\/span><\/p>\n

If you’ve never written any code in your life, don’t worry! We’ll have an introductory AppSec challenge for you to learn something about AppSec without having to learn how to write code.<\/span><\/p>\n

What should I bring?<\/span><\/h4>\n

Participants will not need to bring any equipment to learn, we will have a limited number of workstations available to share.<\/span><\/p>\n

For the best experience you should bring the following equipment when visiting the AppSec Community:<\/span><\/p>\n