Automated Security Testing

on YouTube ↗35m

" summary

Shows how to combine the Zed Attack Proxy (ZAP) with Selenium-based browser automation to run automated dynamic security scans that fit into Continuous Integration. Covers adapting existing Selenium test suites, using ZAP for automated security analysis, and wiring the results into CI to get fast feedback on common web-app security issues.

AI-written summary · about

" chapters (12)

1. 0:00Intro
2. 0:29Why the interest in Security?
3. 2:52Security Tools
4. 4:35Zed Attack Proxy (ZAP)
5. 6:58Getting Started with ZAP
6. 7:49Beyond Passive Scanning
7. 9:10Converting Browser Tests
8. 18:02Integrating ZAP into the build
9. 19:11False Positives/Negatives
10. 20:41Build Integration - Stage 1
11. 23:56Conclusion
12. 28:52utomated Security Testing

" related talks

• 41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And SecurityPeter Hauschulz · OWASP Global AppSec Amsterdam 2019
• 21mAutomated Security Scanning in Payment Card IndustryMichal Buczko · HUSTEF 2018
• 36mLet's take baby steps to security testingChristina Thalayasingam · SeleniumConf London 2019
• 33mAutomated Security Scanning in Payment Card IndustryMichal Buczko · TestCon Vilnius 2018
• 45mSecurity Testing with OWASP ZAP in CI/CDSimon Bennetts · Codemotion Amsterdam 2017
• 01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slidelessChristian Nils Schneider · DevOps Conference 2018
• 47mAutomated Security Scanning in Payment IndustryMichal Buczko · QA Fest 2018
• 58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack ProxyBen Walther · AppSec California 2014