Arsenal

• August 9, 2026 Arsenal Offensive Security AppSec Village — DEF CON 2026 Lenin Alevski MX ROP for the Web: Smuggling XSS, SQLi, and Web Shells Past Every WAF Using Compression Dictionaries

  Compression Dictionary Transport (RFC 9842) shipped in Chrome 130+ in 2025. Any JavaScript asset designated as a dictionary becomes a set of gadgets an attacker can chain into responses that bypass signature-based WAFs and IDSes. gadget-scanner is the a tool to evaluate that surface: drop in a candidate dictionary and a payload, and it reports how much of the payload hides inside backreferences and how much leaks as literal bytes on the wire. At the table you will score real-world JS libraries as attack primitives, generate the DCB blob with brotli -D, and watch the side-by-side: the raw bytes a WAF would see vs. the payload a browser would execute

  ResearchersLenin Alevski MX

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 7, 2026 Arsenal AppSec & Supply Chain AppSec Village — DEF CON 2026 Filipi Pires BR Drogonsec: SAST + SCA + Secrets + IaC in one open-source scanner

  Drogonsec is an open-source, high-performance security scanner built for developers and CI/CD pipelines. In a single run, it combines four analysis engines: SAST for 20+ languages, SCA for dependency CVEs, secret detection with 50+ patterns (AWS, GCP, GitHub, JWTs, SSH keys), and IaC misconfiguration analysis for Terraform and Kubernetes, all mapped to OWASP Top 10:2025 and CWE, with CVSS 3.1 scoring and SARIF output for GitHub and Azure DevOps integration.

  This Arsenal session will demo Drogonsec scanning real-world repositories live, showing findings across all four engines, explaining rule design decisions, and showcasing how teams can extend it with custom YAML rules. Attendees leave with a running tool they can drop into their pipelines the same day.

  ResearchersFilipi Pires BR

  Presented at AppSec Village — DEF CON 2026

  View official session