OWASP Czech Chapter Meeting

Czech chapter OWASP team

Dear OWASP fellows,
It’s our pleasure to inform you that the next local chapter meeting will be held on May 11th 2023 at Ataccama  Prague

Ataccama Software, s.r.o.

<p>Dear OWASP fellows,</p><p>It’s our pleasure to inform you that the next local chapter meeting will be held on May 11th 2023 at <a href="https://goo.gl/maps/26EPbgdovU15DepcA" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Ataccama Software, Sokolovská 685/136f, Invalidovna, 186 00 Praha 8</a>.</p><p>This time we prepared for you  an evening event with three speakers and  online CTF. The admission is as usual free of charge.</p><p></p><h2>Schedule</h2><p>17:45  - Doors opening</p><p>1﻿8:00 - Opening ceremony with OWASP chapter leaders</p><p>18:15 - Michal Špaček: Trusted Types and DOM XSS</p><p>19:00 - Fedotkin Zakhar: They are dangerous… so better hack this</p><p>20:00 - Marek Tóth: Session Hijacking on web portal Seznam.cz </p><p>21:00 - Announcing winners of the CTF, networking</p><h2></h2><h2>Information about the CTF</h2><p>We’ve prepared a short, beginner friendly CTF with some real-life challenges. CTF will be online. Every registered user will receive the link on May 11th morning by the email. There&#x27;s gonna be small prices for the winners (best three) who will be present on the chapter meeting during the winners announcement.</p><h3>CTF led by TunaSec.cz team</h3><ul><li><p><strong>Filip Holec</strong> - Leader of educational Ethical Hacking, Linux or Python workshops and Co-Founder of https://engeto.cz</p></li><li><p><strong>Martin Zember</strong> - 15 years of experience in pentesting, Founder of https://zembered.com</p></li><li><p><strong>Petr Skyva</strong> - Cyber-Security @ FI MUNI, Cloud Architect @ Cleverlance</p></li><li><p><strong>Kamil Vavra</strong> - Hacker, Bug Bounty hunter (https://vavkamil.cz), AppSec Engineer @ Printify</p></li></ul><h2></h2><h2>Information about the speakers and talks</h2><h3>Michal Špaček</h3><p>Michal is a software developer and an application security engineer who&#x27;s on a mission to show developers and everyone else how &amp; why to write secure code. He started building web sites and apps during the &quot;First browser war&quot; when &quot;Best viewed in Netscape&quot; logos were still a thing. Michal has worked for Skype, reporting aggregator report-uri.com, and some others and is currently doing security in Shoptet.</p><p><strong>Trusted Types and DOM XSS</strong></p><p>Let&#x27;s talk about XSS (yeah, still), and particularly the DOM-based XSS type. This one happens in your browser and in your browser only and luckily, browsers also offer something to put stop to it: Trusted Types. I&#x27;ll explain how it works and what to expect when hunting for bugs, and why Trusted Types are a Good Thing™️, unlike previous browser-based defense like the XSS Auditor. We&#x27;ll also talk about CSP reporting, mostly because you enable Trusted Types with a CSP header (yeah, I know). I&#x27;ve also built a demo application so you can have a lot of fun laughing at my CSS skills.</p><p></p><h3>Fedotkin Zakhar</h3><p>Fedotkin Zakhar (d4d) is a software security researcher with a 10-year experience. There are a number of vulnerabilities discovered by Zakhar in open-source libraries, HTTP clients or 3-rd party extensions primarily written using Java, C++, and PHP programming languages.</p><p><strong>They are dangerous… so better hack this</strong></p><p>Hard-coded credentials typically create a significant hole that allows an attacker to bypass the authentication that has been configured by the software administrator. In this topic we will talk about HTTP cookies signing algorythms and how they can be exploited to get unathorised access to the application and in worst-case scanario get a remote code execution.</p><p></p><h3>Marek Tóth</h3><p>Marek Tóth is a vulnerability researcher at Excello. He is highly interested in web application security. He spends his free time finding and reporting vulnerabilities, recently mostly to Czech companies.</p><p><strong>Session Hijacking on web portal Seznam.cz</strong></p><p>In 2020, I have spoken at OWASP Czech Chapter Meeting about Session Hijacking vulnerability on Seznam.cz. In this talk I will show another method of stealing a user&#x27;s session that I recently found. The talk will be presented in Czech language!</p><p></p><p>Additional information</p><ul><li>If using public transportation you can go to the metro station Invalidovna which is a short distance from the office. For cars there are paid parking lots in the street Molákova.</li><li>There will be some snacks and soft drinks prepared for you during the event!</li><li>Unless stated otherwise, talks will be in English and the recordings will be available online ( with speakers&#x27; permission) after the convention.</li></ul>

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

OWASP Czech Chapter Meeting

More events from Czech chapter OWASP team

Follow organizers to get events picked for you

OWASP Czech Chapter Meeting

More events from Czech chapter OWASP team

Follow organizers to get events picked for you

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.