Automating Web Application Bug Hunting
summary
Tool demo of an automation platform that discovers and enriches an organization’s web assets, creates entity graphs and runs recursive scans to enumerate applications and misconfigurations. Demonstrates intrigue core with task-based sources (GitRob, Shodan, Sonar), ident fingerprinting for app/version detection and CVE matching, a DNSgrep binary search for fast domain asset pulls, and a Google Calendar check that finds public calendars. Runs from Docker, aggregates S3 and vuln findings, and warns that aggressive modules (turbo intruder, mass scanning) can knock over servers.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:38Web Security Tools
- 3:49Challenges in Testing
- 5:57Asset Management
- 8:08Intrigue Concept
- 9:34Core Functionality
- 12:45Entity Exploration
- 15:44Fingerprinting
- 18:06DNS Scanning
- 20:27Attack Surface Analysis
- 22:33Automated Testing
- 24:23SaaS Misconfigurations
- 27:24Platform Demo
- 29:17Conclusion
related talks
35mAI-Powered Bug Hunting
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
09mAutomated Application Security Testing
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
46mThe Bug Hunter's Methodology 2.0
39mAutomating myself out of a job...
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively