Matt Smith
summary
Claims that moving security into the dev cycle finds issues earlier, saves money, and frees pen testers for harder work. Demonstrates OWASP ZAP (proxy, spider, passive/active scans, contexts, sessions, forced-user auth), Burp mention, a vulnerable WordeNinja demo app, and automation via a REST API and Jenkins plugin. Shows a scan starting in six seconds to start a scan and an active scan accidentally submitting the signup endpoint repeatedly resulting in 1,500+ fake users created. Reports and CI integration work end-to-end.
AI-written summary · about
chapters (6)
- 0:00ZAP and security in development
- 13:29Live demo of OWASP ZAP
- 28:13Configuring scope and contexts
- 35:48Running scans with user privileges
- 45:51Automating security testing with CI
- 55:14Q&A
related talks
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
36mLet's take baby steps to security testing
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
44mHack Yourself: Intro to pentesting with ZAP
52mApplication Security at DevOps Speed and portfolio scale
46mSecurity DevOps - Staying Secure In Agile Projects
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
45mSecurity Testing with OWASP ZAP in CI/CD