The war between web application attackers and defenders have never ended. In reality, it is getting more and more severe. Looking at the tremendous ways of defending web applications, why attackers are still winning?

"Not knowing your enemy, a victory will always follow with another loss."

Real world attackers and bug bounty hunters are extremely capable nowadays. I'll go through some of the most interesting ones. You will probably be surprised with the determination and innovations that the attackers have to make the attacks work.

"To win without jeopardy, be familiar with yourself and your enemy."

I will explore some common ways of defending. Some are ugly and bad fixes. Why some of those are not usable at large. Why some solutions are overkilling. And what the misconceptions are. Looking through the attacker's lens, I will present a few viable, usable and effective defensive techniques that developers have often overlooked.