Can I Touch You There? Tools and Techniques for Security Testing
summary
Research finds about 15–20% of issues are trivial to detect with tools, common failures include cookies not flagged secure, client-side password checks bypassed via API, libraries with known CVEs and sessions not fully invalidated. Live examples include token in localStorage edited to change role to admin, mobile app sending SQL over plain HTTP, and a payments bug where negative amount input turns into credited funds. Recommended tooling: OWASP guides, ZAP/Burp, MobSF, JuiceShop and Hack The Box for practice.
AI-written summary · about
chapters (15)
- 0:00Start
- 7:35Challenges of Security Testing
- 9:33Testers vs pentesters
- 10:26Myth or truth?
- 11:09My hypothesis!
- 11:40Think like a hacker!
- 16:41Local storage
- 19:36Demo - manipulate app logic
- 20:54Ask yourself a question!
- 23:13Fresh from the oven!
- 25:26Security Shepherd
- 26:20ZAP with Jenkins
- 27:54Serverless what?
- 31:06Hack The Box platform
- 33:04OWASP Juice Shop
related talks
43mSecurity Testing Tools: Can I Touch You There?
27mHow to Start Security Testing Without Fear
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
27mCommon Application Security Mistakes that Enable Automated Attacks
30mWeb Security Engineering - Protect all layers of your project
01h 04mWeb Security And You
42mHack Me If You Can
55mBreaking and Fixing Web Application Security