Location: Novotel, 4 Whitehall quay LS1 4HR, LEEDS, Tel (+44)113/242644

Schedule:

6:00 for 6:15 start

6:15 - 6:30

OWASP Chapter intro. OWASP membership and charter.

Jason Alexander - OWASP Leeds/Northern Chapter Board Member

6:30 - 7:15

Context  Application Tool (CAT)

The presentation will start with an overview of the new CAT application and demonstrating how the tool can be used in all aspects of manual web application testing.  The aim to provide delegates with a high level understand of the capability of CAT.,

Michael Jordon - Principal Security Consultant, Context Information Security 

7:15 - 8:00

OWASP O2 Platform 

The O2 Platform is focused on automating application security knowledge and workflows. It is specifically designed for developers and security consultants to be able to perform quick, effective and thorough source code-driven application security reviews (blackbox + whitebox). In addition to the manual findings created/discovered by security consultants, the OWASP O2 Platform allows the easy consumption of results from multiple OWASP  projects and commercial scanning tools. This allows security consultants to find, exploit and automate (via Unit Tests) security vulnerabilities usually dismissed by the community as impossible to find/recreate. More importantly, it provides security consultants a mechanism to: (a) "talk" with developers (via UnitTest),  (b) give developers a way to replicate + "check if it's fixed" the vulnerabilities reported and (c) engage in a two-way conversion on the best way to fix/remediate those vulnerabilities.

Dinis Cruz - OWASP O2 Project Leader and security consultant

8:00 - finish

"how I met your girlfriend"

The discovery and execution of entirely new classes of attacks executed from the Web in order to meet your girlfriend. This includes newly discovered attacks including HTML5 client-side XSS (without XSS hitting the server!), PHP session hijacking and weak random numbers (accurately guessing PHP session cookies), browser protocol confusion (turning a browser into an SMTP server), firewall and NAT penetration via Javascript (turning your router against you), remote iPhone Google Maps hijacking (iPhone penetration combined with HTTP man-in-the-middle), extracting extremely accurate geolocation information from a Web browser (not using IP geolocation), and more.

Samy Kamkar - Internationally renowned security researcher