VIScon Workshop: Code-Blooded: .NET Security Forensic Lab
Event start time 10.10.2026 14:00
Event end time 10.10.2026 17:00
This event is only available for VIScon Symposium or Hackathon participants, as well as Helpers! Please sign up for one of these events first!
You start with a vulnerable .NET application and a simple question: what went wrong? Using Semgrep and VSCode, you hunt for vulnerabilities and stress-test AI-generated fixes against real OWASP vectors. Do they actually hold up, or do they introduce new flaws? In Part 2, you switch into attacker mode and execute a live supply chain attack by corrupting the .NET service container via Dependency Injection.
Abstract: Part 1: Forensic Analysis & AI Security Fixes We start with a prepared, vulnerable .NET application. Using Semgrep for automated static analysis (SAST) and VSCode with the C# Dev Kit, participants deep-dive into the source code to identify vulnerabilities. A key focus: critically evaluating AI-generated security fixes. We assess together whether suggestions from models like GitHub Copilot or ChatGPT hold up against complex OWASP vectors - or whether they silently introduce new architectural flaws.
Part 2: Supply Chain Attack & Defense Before going on the offensive, we examine .NET Dependency Injection internals: how the framework resolves dependencies and why registration order matters. We then demonstrate a supply chain attack by overwriting service registrations via Dependency Injection - enabling runtime code manipulation without any changes to the source code. Participants then work in groups to develop their own strategy to compromise the Part 1 application through DI manipulation. We close with forensic detection techniques and countermeasures: Source Mapping, Deterministic Builds, and NuGet Package Signing.
Additional slots might become available later on. Please use the waiting list!
The VSETH General Privacy Policy applies to this event.
Details and Prerequisites
Workshops may require items VIScon cannot provide (e.g., a Laptop) which you have to bring with you or to set up something (e.g., install software) that would otherwise take up a significant chunk of the workshop. You may also need knowledge in certain fields (e.g., how to program in a specific language). All of this information can be found in the following paragraphs, so you can decide whether you want/can participate in this workshop, or not.
What you have to bring to the workshop:
- A Laptop with VSCode installed.
What you have to do before the workshop:
Nothing.
Knowledge requirements(/recommendations) for this workshop:
Nothing.
FAQ
Why can't I sign up for this workshop?
If you signed up for the main event after the early access deadline (8:00pm, 18th of September), you can sign up from the 21st of September. But don't worry, we will send you a reminder when the sign up opens. Early access is our way to thank early supporters!
The fine print
By participating you agree that pictures and videos can be taken of you that could be used for VIS-Purposes (VISIONEN, Instagram, etc)
By participating, you agree to adhere by the VIS Code of Conduct
Every participant is responsible for their own insurance
All statements are made without guarantee
In general, there are no refunds
Event organisers
Main event organiser Kaushik Vempati