OWASP Code Pulse and Attack Surface Detector
summary
Two open source tools are demonstrated with concrete results: OWASP Code Pulse instruments server bytecode (Java and .NET) to provide real-time code coverage and linelevel feedback, while Attack Surface Detector parses source to enumerate endpoints and parameters and feeds Burp and ZAP for smarter crawling. A sample raises controller coverage from 46% to 75% after proceeding with discovered endpoints, and an unlinked endpoint updateCourseCredits is found. A CLI emits JSON so teams can keep source private yet automate feeding dynamic scanners.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:25Agenda
- 3:18Whitehat penetration testing
- 4:18Penetration testing workflow
- 6:37Attack surface
- 7:14Open window
- 7:29Web applications
- 8:23Code Pulse
- 9:29What is Code Pulse
- 10:13How Code Pulse works
- 11:20Coverage scenario
- 14:17Live demonstration
- 21:43The problem
- 22:09The solution
- 23:00How it works
- 23:13Supported frameworks
- 23:23Available today
- 23:36Attack Surface Detector
- 26:36Complex Application
- 27:23Commandline Interface
- 28:06Questions
- 28:50QA
related talks
48mMonitoring Application Attack Surface and Integrating Security into DevOps
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
45mLeveraging Projects and Tools to Transform Your SDLC
58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
49mAn overview of available opensource tools to secure your Java code
38mFree security resources that your competitors use!
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless