Security Test Driven Development (STDD) Using Selenium/Appium

on YouTube ↗36m

" summary

Pipeline compiles and deploys to Tomcat, runs FindBugs for SAST then launches a Selenium-driven OWASP ZAP proxy for DAST, records traffic and triggers an active scan; Jenkins + Maven orchestrate the flow and a custom filter reduces false positives so teams get a condensed report. Demo surfaces six probable SQL injection instances from dynamic testing, outputs actionable bug tickets, and can run in Docker or via ZAP spidering without test scripts; Splunk and Wireshark are used for forensic log checks.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to security
2. 2:52The need for automated testing
3. 5:15TDD for security testing
4. 6:49Security tools demo
5. 10:43Analysis and reporting
6. 14:59Agile integration
7. 17:17Tool recommendations
8. 19:28Q&A session
9. 26:21False positives and filtering
10. 29:42Conclusion and DevOps

" related talks

• 43mDevSecOps on steroids - Powered by your Selenium testsMatthias Zax · Selenium Conf 2022
• 36mLet's take baby steps to security testingChristina Thalayasingam · SeleniumConf London 2019
• 01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slidelessChristian Nils Schneider · DevOps Conference 2018
• 45mAutomated Security Testing in a DevOps worldKevin Wittek · Greach 2019
• 35mAutomated Security TestingAlan Parkinson · SeleniumConf 2012 London
• 58mOpen Source Pentesting and Security Analysis Tools: the DevOps wayChristian Nils Schneider · DevOpsCon Spring 2019
• 45mSecurity Testing with OWASP ZAP in CI/CDSimon Bennetts · Codemotion Amsterdam 2017
• 21mAutomated Security Scanning in Payment Card IndustryMichal Buczko · HUSTEF 2018