No Size Fits All: Empowering Engineers with Custom Application Security tests
summary
Demonstrates creating a few-line custom tests using Semgrep for static checks and Nuclei for dynamic probes, with concrete examples: a rule that finds missing authorization decorators across a Python class, a taint-flow rule that catches unsanitized use of run_ping, and a Semgrep flow that detects use of vulnerable 7-Zip extract_all only when actually invoked. Dynamic templates fuzz username regex, trigger an SSRF via interactsh, and reproduce a race by sending 3 concurrent requests to redeem a coupon. Shows CI/CD integration on push to main and notes Semgrep’s cross-file limitations.
AI-written summary · about
chapters (8)
- 0:00Custom security testing challenges
- 3:00Generic tools fall short
- 10:28Semgrep static analysis
- 18:30Third-party library vulnerabilities
- 21:42Nuclei dynamic analysis
- 33:53CI/CD security scans
- 36:23Automate security testing
- 39:54Key takeaways
related talks
36mEffective SAST: Secure Code Analysis in the CI/CD
26mSecurity Automation For GraphQL
57mShift Left Security with the Security Test Pyramid
32mSAST and Sensibility: A Rubyist’s Guide to Static...
46mInsecure Expectations
52mApplication Security at DevOps Speed and portfolio scale
32mCatch Me If You can : Continuous Delivery vs. Security Assurance
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...