Open Source Pentesting and Security Analysis Tools: the DevOps way
summary
Live demo attacks a deliberately vulnerable marathon app and finds SQL injection, reflected and stored XSS, and path traversal, with over 30 XSS instances and automated scans issuing ~900 requests. Automation uses ZAP API and a scan-as-you-surf workflow driven by recorded UI tests (Selenium or Zest), runs headless in Docker, plugs into Jenkins, and emits JSON/HTML reports. CI example breaks the build on threshold violations — the pipeline and reporting actually work end to end.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:44Introduction in the Training
- 15:37Persistent Cross-Site Scripting Vulnerabilities
- 22:50Dynamic Application Security Testing
- 31:52Order of Requests
- 40:59Path Traversal
- 45:40Command Line Interface
related talks
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
45mAutomated Security Testing in a DevOps world
57mEnterprise Ethical Hacking Cloud Applications
36mLet's take baby steps to security testing
52mAppSec at DevOps Speed and Portfolio Scale
52mApplication Security at DevOps Speed and portfolio scale
44mHack Yourself: Intro to pentesting with ZAP
43mDevSecOps on steroids - Powered by your Selenium tests