OWASP London Chapter

This event is kindly hosted by Civo Tech Junction and sponsored by Black Duck . There is limited seating available for in-person attendees. Registration required.
This event will be live-streamed on YouTube.
Recordings will be available on the OWASP London YouTube channel.

Venue Location: Civo Tech Junction, First Floor, 32-37 Cowper Street, London, EC2A 4AW
Nearest Tube: Old Street (Northern Line), Cowper Street exit - 1 min walk
Doors Open at 6pm for registration, pizza, drinks and networking. The talks start at 6:30pm (we start on time!).

TALKS:

OWASP Introduction, Welcome and News - Sam Stepanyan, Andra Lezza, Sherif Mansour - OWASP London Chapter Leaders

"Server-Side Cross-Site Scripting" - Balazs Bucsay

Cross-Site Scripting is no longer a new or hot topic, but as new technologies are introduced rapidly, and with the expansion of cloud solutions and containerisation, classic vulnerabilities may take on new forms. Server-Side XSS is an unusual method to execute malicious payloads on the server rather than the client.
The talk includes multiple demos that walk the audience through an attack chain utilising multiple vulnerabilities and misconfigurations to escalate privileges, and to transform a seemingly benign vulnerability into a powerful tool for cloud account takeover. In addition to explaining the issue with Server-Side XSS, its limitations and capabilities will also be discussed. Recommendations will be provided to prevent others from making the same mistakes that are already widespread.

"Securing the Software Supply Chain in the Age of AI, Malware, and Compliance" - Matthew Brady

Modern development teams rely heavily on third-party code, AI-generated content, and rapid release cycles—making the software supply chain a growing target for attackers. At the same time, security teams are expected to manage increasing compliance demands and prevent threats like dependency confusion and malicious packages, all without slowing down developers. This talk focuses on how AppSec teams can build practical, scalable approaches to securing the software supply chain, drawing from real-world challenges and lessons learned across the industry.

RAFFLE - win a prize kindly donated by our sponsors!

SPEAKERS

Balazs Bucsay

Balazs Bucsay is the founder & CEO of Mantra Information Security that offers a variety of consultancy services in the field of IT Security. With decades of offensive security experience he is focusing his time mainly on research in various fields including red teaming, reverse engineering, embedded devices, firmware emulation and cloud. He gave multiple talks around the globe (Singapore, London, Melbourne, Honolulu) on different advanced topics and released several tools and papers about the latest techniques. He has multiple certifications (OSCE, OSCP, OSWP) related to penetration testing, exploit writing and other low-level topics and degrees in Mathematics and Computer Science. Balazs thinks that sharing knowledge is one of the most important things, so he always shares it with his peers. Because of his passion for technology he starts the second shift right after work to do some research to find new vulnerabilities.

Matthew Brady

Matthew has a unique combination of technical knowledge with commercial awareness in many areas including Software Application Security, DevOps and software development lifecycle solutions and services across multiple vertical markets. Matthew currently leads a team of Solution Engineers in EMEA and is subject matter expert in Black Duck supply chain solutions. Prior to that he has worked for CISCO/AppDynamics and Hewlett Packard Enterprise.

TICKETS:

OWASP meetups are free and open to anyone interested in application security. Please note that you MUST book your place to be admitted to the event by the building security.

CODE OF CONDUCT: