Archery - BlackHat Asia 2018

You’re tasked with ‘doing AppSec’ for your company and you’ve got more apps and issues than you know how to deal with. How do you make sense of the different tools outputs for all your different apps? DefectDojo can be your one source of truth and become the heart of your AppSec automation program. DefectDojo grew out of a Product Security program 8 years ago and was created by AppSec people for AppSec people. In this talk, you’ll learn about DefectDojo and how to make the most of the many features it offers including its REST-based API. DefectDojo can be your one source of truth for discovered security vulnerabilities, report generation, aggregation of over 80 different security tools, inventory of applications, tracking testing efforts and metrics on the AppSec program. DefectDojo was the heart of an AppSec automation effort that saw an increase in assessments from 44 to 414 in two years. Don't you want 9.4 times more output from your AppSec program? It's time to ditch spreadsheets and get DefectDojo.

Automating security test using Selenium and OWASP ZAP - Practical DevSecOps

Mohammed A. Imran

In Practical DevSecOps - DevSecOps Live online meetup, you’ll learn Automating security tests using Selenium and OWASP ZAP. Join Srinivas, Red Team Member at Banking Industry, also Offensive Security Certified Professional(OSCP) and Offensive Security Certified Expert(OSCE. He will cover Automating security tests using Selenium and OWASP ZAP. In this intriguing meetup, you will learn: 1. Introduction to automated vulnerability scans and their limitations. 2. A short introduction to how functional tests can be useful in performing robust security tests. 3. Introduction to selenium and OWASP ZAP 4. Proxying selenium tests through OWASP ZAP 5. Invoking authenticated active scans using OWASP ZAP 6. Obtaining scan reports … and more useful takeaways!

Peeling the Onion: Making Sense of the Layers of API Security

APIs are everywhere. Any business with a mobile app, modern web apps (SPAs), using the cloud, doing a digital transformation, integrating with business partners, running microservices or using kubernetes has APIs. There's a good foundation of AppSec knowledge out there - thanks in part to OWASP but API Security isn't exactly the same as AppSec. Additional complexity is part of the landscape with multiple competing API technologies like REST, gRPC and GraphQL plus stakeholders spread across multiple parts of the business. How to do you make sense of API Security landscape? This talk will cover the three fundamental areas to consider, the various chess pieces and the many ways those pieces can be put on your API chessboard. The goal is for you to leave knowing how to map out your API Security landscape and reach a state of solid API Security.

N Different Strategies to Automate OWASP ZAP - OWASP APPSec BUCHAREST - Oct 1...

https://www.owasp.org/index.php/OWASP_Bucharest_AppSec_Conference_2017#tab=Conference_0101_talks In this talk we will explore the many different ways of automating security testing with the OWASP Zed Attack Proxy and how it ties to an overall Software Security Initiative. Over the years, ZAP has made many advancements to its powerful APIs and introduced scripts to make security automation consumable for mortals. This talk is structured to demonstrate how ZAP's API, and scripts could be integrated with Automated Testing frameworks beyond selenium, Continuous Integration and Continuous Delivery Pipelines beyond Jenkins, scanning authenticated parts of the application, options to manage the discovered vulnerabilities and so on with real world case studies and implementation challenges. This is a demonstration oriented talk that explains OWASP ZAP automation strategies for Security Testing by example.

OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

OWASP ZAP API Automation

Thivya Lakshmi

N Different Strategies to Automate OWASP ZAP - Cybersecurity WithTheBest - Oct 15 2017 http://cybersecurity.withthebest.com In this talk we will explore the many different ways of automating security testing with the OWASP Zed Attack Proxy and how it ties to an overall Software Security Initiative. Over the years, ZAP has made many advancements to its powerful APIs and introduced scripts to make security automation consumable for mortals. This talk is structured to demonstrate how ZAP's API, and scripts could be integrated with Automated Testing frameworks beyond selenium, Continuous Integration and Continuous Delivery Pipelines beyond Jenkins, scanning authenticated parts of the application, options to manage the discovered vulnerabilities and so on with real world case studies and implementation challenges.

OpenSourceSecurityTools - UPDATEDSparsh Raj

ATT&CKcon 2.0 2019 - Tracking and measuring your ATT&CK coverage with ATT&CK2...

Mauricio Velazco

“Sensu and Sensibility” - The Story of a Journey From #monitoringsucks to #mo...

Puppet

BlackHat 2014 OWASP ZAP Turbo Talk

BSides Manchester 2014 ZAP Advanced Features

IcingaCamp Stockholm - How to make your monitoring shut up

Icinga

Careful - APIs Inside: Testing and Monitoring for App Development

3scale

Owasp zapColdFusionConference

OWASP 2013 EU Tour Amsterdam ZAP Intro

OWASP DefectDojo - Open Source Security Sanity

The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...

DroidConTLV

2014 ZAP Workshop 1: Getting Started

Automating Web Application Security Testing With OWASP ZAP DOT NET API - Tech...

JoinSEC 2013 London - ZAP Intro

Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin

Merging Security with DevOps - An AppSec Perspective

JavaOne 2014 Security Testing for Developers using OWASP ZAP

An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...

Serverless Technology (Functions as a Service) is fast becoming the next "big thing" in the world of distributed applications. Organizations are investing a great deal of resources in this technology as a force-multiplier, cost-saver and ops-simplification cure-all. Especially with widespread support from cloud vendors, this technology is going to only become more influential. However, like everything else, Serverless apps are subject to a a wide variety of attack possibilities, ranging from attacks against access control tech like Function Event Injection, JWTs, to NoSQL Injection, to exploits against the apps themselves (deserialization, etc) escalating privileges to other cloud component. On the other hand GraphQL (API Query Language) is the natural companion to serverless apps, where traditional REST APIs are replaced with GraphQL to provide greater flexibility, greater query parameterization and speed. GraphQL is slowly negating the need for REST APIs from being developed. Combined with Serverless tech/Reactive Front-end frameworks, GraphQL is very powerful for distributed apps. However, GraphQL can be abused with a variety of attacks including but not limited to Injection Attacks, Nested Resource Exhaustion attacks, Authorization Flaws among others. This talk presents a red-team perspective of the various ways in which testers can discover and exploit serverless and/or GraphQL driven applications to compromise sensitive information, and gain a deeper foothold into database services, IAM services and other other cloud components. The talk will have some demos that will demonstrate practical attacks and attack possibilities against Serverless and GraphQL applications.

Jason Kent - AppSec Without Additional Tools

centralohioissa

Automated Vulnerability Assessment and Management

ITEM

My talk will be about an automated way of Vulnerability Assessment and Management that includes a real-time demo of the Archery tool, how to use it for Vulnerability Assessment Automation and Management. We'll discuss how we can utilize open-source tools to perform vulnerability assessment in a robust way and manage them using Archery tool. Archery is an open-source vulnerability assessment and management tool that helps developers and pentesters to perform scans and manage vulnerabilities. It uses popular open-source tools and also supports commercial tools to perform comprehensive scanning for web application and network. It also performs web application dynamic authenticated scanning and covers the whole applications by using selenium. The developers can also utilize the tool for implementation of their DevOps CI/CD environment.

What's hot

OWASP 2014 AppSec EU ZAP Advanced Features

N Different Strategies to Automate OWASP ZAP - Cybersecurity WithTheBest - Oc...

OpenSourceSecurityTools - UPDATEDSparsh Raj

ATT&CKcon 2.0 2019 - Tracking and measuring your ATT&CK coverage with ATT&CK2...

Mauricio Velazco

“Sensu and Sensibility” - The Story of a Journey From #monitoringsucks to #mo...

Puppet

BlackHat 2014 OWASP ZAP Turbo Talk

BSides Manchester 2014 ZAP Advanced Features

IcingaCamp Stockholm - How to make your monitoring shut up

Icinga

Careful - APIs Inside: Testing and Monitoring for App Development

3scale

Owasp zapColdFusionConference

OWASP 2013 EU Tour Amsterdam ZAP Intro

OWASP DefectDojo - Open Source Security Sanity

The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...

DroidConTLV

2014 ZAP Workshop 1: Getting Started

Automating Web Application Security Testing With OWASP ZAP DOT NET API - Tech...

JoinSEC 2013 London - ZAP Intro

Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin

Merging Security with DevOps - An AppSec Perspective

JavaOne 2014 Security Testing for Developers using OWASP ZAP

An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...

What's hot (20)

OWASP 2014 AppSec EU ZAP Advanced Features

N Different Strategies to Automate OWASP ZAP - Cybersecurity WithTheBest - Oc...

OpenSourceSecurityTools - UPDATED

ATT&CKcon 2.0 2019 - Tracking and measuring your ATT&CK coverage with ATT&CK2...

“Sensu and Sensibility” - The Story of a Journey From #monitoringsucks to #mo...

BlackHat 2014 OWASP ZAP Turbo Talk

BSides Manchester 2014 ZAP Advanced Features

IcingaCamp Stockholm - How to make your monitoring shut up

Careful - APIs Inside: Testing and Monitoring for App Development

Owasp zap

OWASP 2013 EU Tour Amsterdam ZAP Intro

OWASP DefectDojo - Open Source Security Sanity

The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...

2014 ZAP Workshop 1: Getting Started

Automating Web Application Security Testing With OWASP ZAP DOT NET API - Tech...

JoinSEC 2013 London - ZAP Intro

Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin

Merging Security with DevOps - An AppSec Perspective

JavaOne 2014 Security Testing for Developers using OWASP ZAP

An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...

Similar to Archery - BlackHat Asia 2018

Jason Kent - AppSec Without Additional Tools

centralohioissa

Automated Vulnerability Assessment and Management

ITEM

AppSec in an Agile World

David Lindner

In the ever-evolving, fast-paced Agile development world, application security has not scaled well. Incorporating application security and testing into the current development process is difficult, leading to incomplete tooling or unorthodox stoppages due to the required manual security assessments. Development teams are working with a backlog of stories—stories that are typically focused on features and functionality instead of security. Traditionally, security was viewed as a prevention of progress, but there are ways to incorporate security activities without hindering development. There are many types of security activities you can bake into your current development lifecycles—tooling, assessments, stories, scrums, iterative reviews, repo and bug tracking integrations—every organization has a unique solution and there are positives and negatives to each of them. In this slide deck, we go through the various solutions to help build security into the development process.

Building an Open Source AppSec Pipeline - 2015 Texas Linux Fest

Manual JavaScript Analysis Is A Bug

Lewis Ardern

When performing security assessments or participating in bug bounties, there is generally a methodology you follow when assessing source-code or performing dynamic analysis. This involves using tools, reviewing results and understanding what you should be testing for. Reviewing modern web applications can be quite challenging, and this talk will go into details on how we can automate the boring (but necessary parts) and how to set a roadmap of what should be focused on when dealing with modern JavaScript applications.

we45 DEFCON Workshop - Building AppSec Automation with Python

Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...

apidays

Security Vulnerabilities in your APIs Lukáš Ďurovský, Staff Software Engineer at Thermo Fisher Scientific Apidays Helsinki & North 2024 - Connecting Physical and Digital: Sustainable APIs for the Era of AI, Super and Quantum Computing (May 28 and 29, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

ZAP @FOSSASIA2015

Sumanth Damarla

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

Quality assurance engineer #JobShadowDay #XWikiAndreea-Zenovia Popescu

Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection

Neel Pathak

[Wroclaw #5] OWASP Projects: beyond Top 10

OWASP

Application security in a hurry webinar

kdinerman

OWASP AppSec EU - SecDevOps, a view from the trenches - Abhay Bhargav

s its biggest bottleneck and security is becoming the most pervasive bottleneck in most DevOps practices. Teams are unable to come up with security practices that integrate into the DevOps lifecycle and ensure continuous and smooth delivery of applications to customers. In fact, security failures in DevOps amplify security flaws in production as they are delivered at scale. If DevOps should not be at odds with security, then we must find ways to achieve the following on priority: - Integrate effective threat modeling into Agile development practices - Introduce Security Automation into Continuous Integration - Integrate Security Automation into Continuous Deployment While there are other elements like SAST and Monitoring that are important to SecDevOps, my talk will essentially focus on these three elements with a higher level of focus on Security Automation. In my talk, I will explore the following, with reference to the topic: - The talk will be replete with anecdotes from personal consulting and penetration testing experiences. - I will briefly discuss Threat Modeling and its impact on DevOps. I will use examples to demonstrate practical ways that one can use threat modeling effectively to break down obstacles and create security automation that reduces the security bottleneck in the later stages of the DevOps cycle. - I firmly believe that Automated Web Vulnerability Assessment (using scanners) no matter how tuned, can only produce 30-40% of the actual results as opposed to a manual application penetration test. I find that scanning tools fail to identify most vulnerabilities with modern Web Services (REST. I will discuss examples and demonstrate how one can leverage automated vulnerability scanners (like ZAP, through its Python API) and simulate manual testing using a custom security automation suite. In Application Penetration Testing, its impossible to have a one size-fits all, but there’s no reason why we can’t deliver custom security automation to simulate most of the manual penetration testing to combine them into a custom security automation suite that integrates with CI tools like Jenkins and Travis. I intend to demonstrate the use a custom security test suite (written in Python that integrates with Jenkins), against an intentionally vulnerable e-commerce app. - My talk will also detail automation to identify vulnerabilities in software libraries and components, integrated with CI tools. - Finally, I will (with the use of examples and demos) explain how one can use “Infrastructure as Code” practice to perform pre and post deployment security checks, using tools like Chef, Puppet and Ansible.

What Good is this Tool? A Guide to Choosing the Right Application Security Te...

Kevin Fealey

Abstract: Choosing the right Application Security Testing (AST) tool can be challenging for any security program, and after rolling it out, discovering the real security value it brings can be downright discouraging. No single tool can solve all of all of your security problems, but unfortunately, that is exactly how many of them are marketed. This is compounded by sales teams who convince executive leadership that security programs should be built around their tools, rather than fitting each tool within a well-planned security program. The primary takeaways from this talk are: • An understanding the real value of each type of AST tool (SAST, DAST, IAST); • How to leverage your tools for better security visibility and process efficiency; • Steps to find the right tool for your security program; • Keys to finding the best stage of the SDLC to implement each tool type within your security program; • How to integrate new tools with your existing DevOps or Agile environments and processes Additional Takeaways: • Examine the strengths and limitations of SAST, DAST, and IAST tools • Learn how to choose the right tools for your security program • Discover how to seamlessly integrate your tools into existing DevOps and Agile environments and processes • Provide security visibility to developers, managers, and executives by enhancing your existing technology • Learn to use your tools to improve the efficiency of security tasks that are currently manual

ProdSec: A Technical Approach

Jeremy Brown

What happens when a company either doesn’t fully empower the Security team, or have one at all? Stuff like Goto fail, Equifax, unsandboxed AVs and infinite other buzz, or yet to be buzzed, words describe failures of not adequately protecting customers or services they rely on. Having a solid security team enables a company to set a bar, ensure security exists within the design, insert tooling at various stages of the process and continuously iterate on such results. Working with the folks building the products to give them solutions instead of just problems allows one to scale, earn trust and most importantly be effective and actually ship. There’s a whole security industry out there with folks wearing every which hat you can think of. They have influence and the ability to find a bug one day and disclose it the next, so companies must adapt both engineering practices and perspectives in order to ‘navigate the waters of reality’ and not just hope one doesn’t take a look at their product. Having processes in place that reduce attack surface, automate testing and set a minimum bar can reduce bugs therefore randomization for devs therefore cost of patching and create a culture where security makes more sense as it demonstratively solves problems. Nvidia is evolving in this space. Focused on the role of product security, I’ll go through the various components of a security team and how they each interact and complement each other, commodity and niche tooling as well as how relationships across organizations can give one an edge in this area. This talk balances the perspective of security engineers working within a large company with the independent nature of how things work in the industry. Attendees will walk away with a breadth of knowledge, an inside view of the technical workings, tooling and intricacies of finding and fixing bugs and finding balance within a product-first world.

Making security-agile matt-tesauro