Open Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
summary
Demonstration runs an automated pipeline that proxies Selenium-driven UI tests through headless ZAP using its REST API, performing scan-as-you-surf active scans. Tools used: OWASP ZAP, Selenium, Jenkins and Docker integration. Automated run finds multiple confirmed issues—SQL injection, reflected and persistent XSS, and a path‑traversal via the file uploader—and generates HTML/JSON reports. All actions are scripted, evidence is captured, and the automation is practical for nightly CI rather than per-commit.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 16:21Application Security Testing
- 18:15Interactive Application Security Testing
- 27:02Active Scanning
- 30:46Configuration
- 32:37Plugins
- 36:52Crawlers
- 38:02Business Data
- 40:02Automation
- 43:52ZAP
- 50:12Attack Mode
- 52:57CSRF Tokens
- 57:12False Positives
related talks
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
36mLet's take baby steps to security testing
45mAutomated Security Testing in a DevOps world
45mSecurity Testing with OWASP ZAP in CI/CD
35mAutomated Security Testing
43mDevSecOps on steroids - Powered by your Selenium tests
36mSecurity Test Driven Development (STDD) Using Selenium/Appium
41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And Security