Automated Application Security Testing
summary
StackHawk runs an active dynamic scanner against running HTTP apps and APIs, claims to find OWASP Top 10 bugs and finish most scans under 10 minutes, and places the scanner close to the app so it can run in CI/CD and on localhost or unpublished environments. Configuration lives with the project as a yaml that lives with the code, scans run in docker containers, findings include request/response details and a curl replay to reproduce and triage into Jira or notify Slack/Datadog.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:30Overview
- 1:05How does Stackhawk work
- 3:38Demo
- 4:00Summary
- 4:27Output
- 4:40Web Browser
- 5:19Post Method
- 5:33Request Response
- 5:54Validate
- 6:08Stackhawk Configuration
- 7:59Outro
related talks
09mAutomated Application Security Testing
09mAutomated Application Security Testing with StackHawk
09mAutomated Application Security Testing with StackHawk
09mAutomated Application Security Testing
08mAutomated Security Testing for JS Apps & Underlying APIs
15mDev-first API and application security testing
07mSecurity Testing for GraphQL Backed Applications
09mAutomated Application Security Testing