Alvaro Munoz's guest appearances

Alvaro Munoz

Security Weekly Podcast Network (Video)

Application Security Weekly (Video)

Hacker Talk

OwlTail

In this episode of Hacker Talk: One of the most powerful newer static analysis tool is CodeQL.   By converting your code base into a Codeql database, you can now write   queries in a read-only way, in order to find security vulnerabilities    and problems in you Code-base.  We wanted to know more about this declarative language called "CodeQL". Straight from Github's Security Lab, we are joined by Alvaro Munoz!   Alvaro, is a Security Researcher, Leads a team of researchers that leverage Codeql to find and model vulnerabilities at Github, with a background in research related to finding remote code execution bugs through deserialization.    Tune in as we get to hear the ins and out of CodeQL, how to get started, when Codeql was used to find a vulnerability in a public Covid-19 system, how to find vulnerabilities with Codeql and a lot more!    Topics covered: Learning to thing outsite the box by playing Capture the flag CodeQL declarative languages  Static code analysis Getting a broad view of the source code Writing queries with CodeQL to find vulnerabilities    Modeling vulnerabilities with CodeQL The learning curve of CodeQL Quering github repositories for vulnerabilities  Write codeql for a large amount of repositories with lgtm(use it goes before it goes EOL) Linters vs codeql CodeQL integrated with continuous integration pipelines Get started with Codeql Submit your codeql queries to Github Security Lab's Bug bounty Best practices for writing queries     Thinking of the code as a database with codeql Finding vulnerabilities in Covid-19 systems Best pratices for CodeQL  Reduce false possitives  CodeQL with nvim(neovim)     Improving vim by creating a more interactive development enviroment alternative, "neovim". LSP integration with neovim.   CodeQL with Emacs Remote code execution bugs found with CodeQL.   Bugs found in Radar Covid App Patterns leading to remote code execution    Auditing javascript frameworks CodeQL vs other static analysis tools Capture the flag codeql challanges The future of CodeQL   External links: https://lgtm.com/   https://github.com/pwntester   https://neovim.io/ https://en.wikipedia.org/wiki/Language_Server_Protocol https://en.wikipedia.org/wiki/Semgrep  Covid 19 tracing app - https://securitylab.github.com/research/securing-the-fight-against-covid19-through-oss/ - https://threatpost.com/german-covid-19-contact-tracing-vulnerability-rce/161419/  Github Security Lab web site: https://securitylab.github.com/  Join Github Security Lab Slack Channel:  https://join.slack.com/t/ghsecuritylab/shared_invite/zt-120w4vby8-_O9u9k2hPfgbju1tddBPcg  https://twitter.com/pwntester Bounty program: https://securitylab.github.com/bounties/ https://codeql.github.com/ https://codeql.github.com/docs/codeql-overview/ http://www.pwntester.com/ https://en.wikipedia.org/wiki/Abstract_syntax_tree https://en.wikipedia.org/wiki/Control_flow_analysis https://github.com/github/codeql-learninglab-actions https://github.com/anticomputer/emacs-codeql/  Special thanks too: We want to give a huge thanks to Github's Security Lab Team for making this episode a reality!

In this episode of Hacker Talk: One of the most powerful newer static analysis tool is CodeQL.   By converting your code base into a Codeql database, you can now write   queries in a read-only way, in order to find security vulnerabilities    and problems in you Code-base. We wanted to know more about this declarative language called "CodeQL". Straight from Github's Security Lab, we are joined by Alvaro Munoz!   Alvaro, is a Security Researcher, Leads a team of researchers that leverage Codeql to find and model vulnerabilities at Github, with a background in research related to finding remote code execution bugs through deserialization.   Tune in as we get to hear the ins and out of CodeQL, how to get started, when Codeql was used to find a vulnerability in a public Covid-19 system, how to find vulnerabilities with Codeql and a lot more! Topics covered: Learning to thing outsite the box by playing Capture the flag CodeQL declarative languages  Static code analysis Getting a broad view of the source code Writing queries with CodeQL to find vulnerabilities    Modeling vulnerabilities with CodeQL The learning curve of CodeQL Quering github repositories for vulnerabilities Write codeql for a large amount of repositories with lgtm(use it goes before it goes EOL) Linters vs codeql CodeQL integrated with continuous integration pipelines Get started with Codeql Submit your codeql queries to Github Security Lab's Bug bounty Best practices for writing queries     Thinking of the code as a database with codeql Finding vulnerabilities in Covid-19 systems Best pratices for CodeQL  Reduce false possitives  CodeQL with nvim(neovim)     Improving vim by creating a more interactive development enviroment alternative, "neovim". LSP integration with neovim.   CodeQL with Emacs Remote code execution bugs found with CodeQL.   Bugs found in Radar Covid App Patterns leading to remote code execution    Auditing javascript frameworks CodeQL vs other static analysis tools Capture the flag codeql challanges The future of CodeQL External links: <a href="https://lgtm.com/" rel="nofollow" target="_blank">https://lgtm.com/  </a> <a href="https://github.com/pwntester " rel="nofollow" target="_blank">https://github.com/pwntester </a> <a href="https://neovim.io/" rel="nofollow" target="_blank">https://neovim.io/</a> <a href="https://en.wikipedia.org/wiki/Language_Server_Protocol" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Language_Server_Protocol</a> <a href="https://en.wikipedia.org/wiki/Semgrep" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Semgrep</a> Covid 19 tracing app - <a href="https://securitylab.github.com/research/securing-the-fight-against-covid19-through-oss/" rel="nofollow" target="_blank">https://securitylab.github.com/research/securing-the-fight-against-covid19-through-oss/</a> - <a href="https://threatpost.com/german-covid-19-contact-tracing-vulnerability-rce/161419/" rel="nofollow" target="_blank">https://threatpost.com/german-covid-19-contact-tracing-vulnerability-rce/161419/</a> Github Security Lab web site: <a href="https://securitylab.github.com/" rel="nofollow" target="_blank">https://securitylab.github.com/</a> Join Github Security Lab Slack Channel:  <a href="https://join.slack.com/t/ghsecuritylab/shared_invite/zt-120w4vby8-_O9u9k2hPfgbju1tddBPcg" rel="nofollow" target="_blank">https://join.slack.com/t/ghsecuritylab/shared_invite/zt-120w4vby8-_O9u9k2hPfgbju1tddBPcg</a> <a href="https://twitter.com/pwntester" rel="nofollow" target="_blank">https://twitter.com/pwntester</a> Bounty program: <a href="https://securitylab.github.com/bounties/" rel="nofollow" target="_blank">https://securitylab.github.com/bounties/</a> <a href="https://codeql.github.com/" rel="nofollow" target="_blank">https://codeql.github.com/</a> <a href="https://codeql.github.com/docs/codeql-overview/" rel="nofollow" target="_blank">https://codeql.github.com/docs/codeql-overview/</a> <a href="http://www.pwntester.com/" rel="nofollow" target="_blank">http://www.pwntester.com/</a> <a href="https://en.wikipedia.org/wiki/Abstract_syntax_tree" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Abstract_syntax_tree</a> <a href="https://en.wikipedia.org/wiki/Control_flow_analysis" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Control_flow_analysis</a> <a href="https://github.com/github/codeql-learninglab-actions" rel="nofollow" target="_blank">https://github.com/github/codeql-learninglab-actions</a> <a href="https://github.com/anticomputer/emacs-codeql/" rel="nofollow" target="_blank">https://github.com/anticomputer/emacs-codeql/</a> Special thanks too: We want to give a huge thanks to Github's Security Lab Team for making this episode a reality!

CodeQL with Alvaro Munoz

Past research such as JNDI Injection, Unsafe deserialization, Struts RCEs - OSS security: CodeQL, Dependabot, collaboration between researchers and developers, OWASP Top Ten Proactive Controls, CVD for OSS   Segment Resources: - [Write more secure code with the OWASP Top 10 Proactive Controls]  https://github.blog/2021-12-06-write-more-secure-code-owasp-top-10-proactive-controls/ - [An analysis on developer-security researcher interactions in the vulnerability disclosure process]  https://github.blog/2021-09-09-analysis-developer-security-researcher-interactions-vulnerability-disclosure/ - [Building security researcher and developer collaboration]  https://www.securitymagazine.com/articles/97066-how-to-build-security-researcher-and-software-developer-collaboration - [Coordinated vulnerability disclosure (CVD) for open source projects]  https://github.blog/2022-02-09-coordinated-vulnerability-disclosure-cvd-open-source-projects/ - [GitHub Advisory Database now open to community contributions]  https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/ - [Blue-teaming for Exiv2: creating a security advisory process]  https://github.blog/2021-11-02-blue-teaming-create-security-advisory-process/     Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw189

Past research such as JNDI Injection, Unsafe deserialization, Struts RCEs - OSS security: CodeQL, Dependabot, collaboration between researchers and developers, OWASP Top Ten Proactive Controls, CVD for OSS Segment Resources: - [Write more secure code with the OWASP Top 10 Proactive Controls] <a href="https://github.blog/2021-12-06-write-more-secure-code-owasp-top-10-proactive-controls/" rel="nofollow" target="_blank"> https://github.blog/2021-12-06-write-more-secure-code-owasp-top-10-proactive-controls/</a> - [An analysis on developer-security researcher interactions in the vulnerability disclosure process] <a href="https://github.blog/2021-09-09-analysis-developer-security-researcher-interactions-vulnerability-disclosure/" rel="nofollow" target="_blank"> https://github.blog/2021-09-09-analysis-developer-security-researcher-interactions-vulnerability-disclosure/</a> - [Building security researcher and developer collaboration] <a href="https://www.securitymagazine.com/articles/97066-how-to-build-security-researcher-and-software-developer-collaboration" rel="nofollow" target="_blank"> https://www.securitymagazine.com/articles/97066-how-to-build-security-researcher-and-software-developer-collaboration</a> - [Coordinated vulnerability disclosure (CVD) for open source projects] <a href="https://github.blog/2022-02-09-coordinated-vulnerability-disclosure-cvd-open-source-projects/" rel="nofollow" target="_blank"> https://github.blog/2022-02-09-coordinated-vulnerability-disclosure-cvd-open-source-projects/</a> - [GitHub Advisory Database now open to community contributions] <a href="https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/" rel="nofollow" target="_blank"> https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/</a> - [Blue-teaming for Exiv2: creating a security advisory process] <a href="https://github.blog/2021-11-02-blue-teaming-create-security-advisory-process/" rel="nofollow" target="_blank"> https://github.blog/2021-11-02-blue-teaming-create-security-advisory-process/</a> Visit <a href="https://www.securityweekly.com/asw" rel="nofollow" target="_blank">https://www.securityweekly.com/asw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/asw189" rel="nofollow" target="_blank">https://securityweekly.com/asw189</a>