Cover art for Top TEND to Your Code

WPA3-KCIA Radio · Single

Top TEND to Your Code

Jarrett Heintz · 3:13

  • Build It Right
  • Identity & Access
  • Everything, A to Z
  • Identity Hour
Play on WPA3-KCIA Radio

Lyrics

  1. Now this is a story of hacks that unfold,
  2. Where five little flaws let attackers get bold.
  3. So listen up close, while these bugs are exposed—
  4. It’s time to Top TEND to your code!
  5. (A quote, a number, and a dash... and suddenly, they’re admin. Let’s talk SQL Injection!)
  6. I made a login form, looked sharp and neat,
  7. But let folks type commands in the password seat.
  8. They typed: “quote one equals one — semi colon — dash dash,”
  9. The system said “welcome admin,” then cleared the cache.
  10. I should’ve used safe queries—locked that load,
  11. No raw text in commands—Top TEND to your code!
  12. OWASP Top TEND to your code, threats in our sight,
  13. Tend that stack, keep your bits locked tight.
  14. Check inputs, defaults changed, friend,
  15. Strict auth (say: aw-thhh) and WAF (say: whaff) defend—Top TEND to your code!
  16. (Someone dropped a script in your chatbox—users click it, and poof! Cross-site scripting in the house!)
  17. I made a comment wall so folks could cheer,
  18. But didn’t block scripts—now that’s unclear.
  19. They dropped a script tag, just a little thing,
  20. Now every user loads a hacker’s bling.
  21. Their cookies flew, their sessions cracked,
  22. One tag did it—I got hacked!
  23. Escape your output, don’t trust what’s shown—Top TEND to your code!
  24. (Two tabs. One’s your bank. One’s a meme. One just made a transfer. Cross-site request forgery alert!)
  25. I was watching memes and paying my bills,
  26. Didn’t know both tabs could bring such thrills.
  27. The meme site hid a form and fired a trick,
  28. My browser said “yes” and sent it quick.
  29. The bank thought I made the move—it never knew,
  30. That other tab just slipped right through.
  31. Tokens and SameSite keep you in control—Top TEND to your code!
  32. (“Fetch anything,” they said. So the attacker sent the vault address. SSRF just walked in the back door!)
  33. My image bot said, “I’ll grab that file,”
  34. But the link they gave was full of guile.
  35. “Go fetch this vault”—bot said “okay,”
  36. And brought back secrets the same old day.
  37. It wasn’t meant to reach that zone,
  38. Now someone’s mining from my home.
  39. Limit what you fetch, and lock those roads—Top TEND to your code!
  40. (No MFA, no alerts, no clue. And now… no data. Let’s talk auth and monitoring.)
  41. No second factor, weak passcode,
  42. Logs turned off to lighten the load.
  43. The breach began and no one knew,
  44. Alerts were silent, nothing flew.
  45. Lock it down, light up your zone—
  46. Don’t leave your system out there alone.
  47. Watch it, log it, and enforce the mode—Top TEND to your code!
  48. OWASP Top TEND to your code, threats in our sight,
  49. Tend that stack, keep your bits locked tight.
  50. Check inputs, defaults changed, friend,
  51. Strict auth (aw-thhh) and WAF (whaff) defend—Top TEND to your code!