This week, Zac sits down with Jullian Gerhart. Jullian is a Managing Consultant at NCC Group, which specializes in application security and application security pentesting. Jullian is also a contributor to the Application Defense Alliance (https://appdefensealliance.dev/) working to create a standardized framework for securing applications in the Google Play and Apple App Stores. Zac and Jullian discuss the current state of application security, their favorite web application security vulnerability (LOVE LIVE IDOR), and we get a great story from Jullian about compromising extremely sensitive information from an unsecured API.
Episode Summary
In Episode 19 of War Stories, host Zac Davis sits down with Jullian Gerhart, a Managing Consultant at NCC Group who specializes in application security testing and contributes to the App Defense Alliance. They talk about his path from wanting to build video games to breaking web applications, why Burp Suite is still the tool to beat, how IDOR vulnerabilities work, and an API finding that exposed real credentials during an acquisition review.
Jullian's interest in technology started with playing Super Mario 64 with his dad and dreaming of building games. He worked at eBay before moving into offensive security, joining the team led by Michael Sviben (hear Michael in Episode 9). His favorite tool is Burp Suite, the web proxy most application testers rely on. He also explains insecure direct object references (IDOR), where an application trusts an ID in a request without checking whether the user should be allowed to see that record.
His war story comes from a merger and acquisition security assessment, where the buyer had only a few weeks to understand the target's security across internal, external, and application testing. The target was a UK transportation company that connected customers with local taxi services. Its publicly facing API returned what looked like test data, but it was real: plaintext email credentials for the taxi companies on the platform. The first one they tried logged in without multifactor authentication.
In This Episode
- Jullian Gerhart's path from game development dreams and eBay to application security
- Why Burp Suite remains the leading web application testing tool
- Insecure direct object references (IDOR) explained
- Security assessments during mergers and acquisitions
- API data exposure, plaintext credentials, and missing MFA
What Is Your API Really Exposing?
APIs often return more data than anyone intended. SEVN-X runs application and API security testing and penetration tests, including fast-turnaround assessments for mergers and acquisitions. Talk with our team about scoping a test for your organization.
