Automating Security Testing with Functional Testing Test Cases
summary
Built a pipeline that integrates IronWASP with Selenium so functional test cases drive a blackbox scanner, which noticeably increases coverage but hits problems: thousands of payloads per parameter, stale test data, session/CSRF breakage and much longer scans. Migrates attention to IAST taint tracking (hooks into runtime APIs to spot SQLi, unsafe hashing, and data exfil to third parties) and to RASP-in-browser protection for attacks like Magecart. Recommends IAST/RASP plus traditional scanners because each misses different classes of issues.
AI-written summary · about
chapters (6)
- 0:00Introduction and speaker background
- 7:46Combining functional tests with security scanning
- 12:45Introduction to IAST and its advantages
- 26:53Security in CI/CD pipelines and attack monitoring
- 37:18Comparing IAST with DAST and RASP
- 42:56Q&A and tool integration discussion
related talks
55mAutomating Security Testing with the OWTF
43mDevSecOps on steroids - Powered by your Selenium tests
47mRollercoaster of Security Automation
39mAutomating myself out of a job...
17mManual versus automated penetration testing on AWS
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
36mSecurity Test Driven Development (STDD) Using Selenium/Appium
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux