The Hacker’s Guide to Session Hijacking in Java EE

Broken authentication and session management is among the most prominent security vulnerabilities, according to OWASP’s list of top 10 security risks. Many developers assume that it works out of the box in Java EE. Unfortunately, that’s not actually the case. Even though Java EE provides support for secure authentication and session management, it’s still developers’ responsibility to use it correctly. In live demos in this session, you’ll learn how to hijack a session by exploiting common security vulnerabilities on the client side, on the server side, and in transport. You’ll also find out about common mistakes and omissions related to authentication and session management, along with the ways to protect your applications with Java EE mechanisms.

Speakers: Patrycja Wegrzynowicz

Patrycja Wegrzynowicz is a software visionary and expert specialized in automated software engineering and Java technologies. She is the founder and CTO of Yonita, Inc., a California-based start-up with focus on automated detection and refactoring of software defects, including security vulnerabilities, performance and concurrency anti-patterns, and database issues.


Patrycja is a regular speaker at major academic as well as industrial conferences, including JavaOne, Devoxx, JavaZone, OOPSLA, ASE, and others. She is associated with University of Warsaw where she is finalizing PhD in Computer Science.
Patrycja's interests focus on patterns and anti-patterns in software along with automated software engineering, particularly static and dynamic analysis techniques to support program verification, comprehension, and optimization.


You can follow her on Twitter at @yonlabs.