My talk will be about an automated way of Vulnerability Assessment and Management that includes a real-time demo of the Archery tool, how to use it for Vulnerability Assessment Automation and Management. We'll discuss how we can utilize open-source tools to perform vulnerability assessment in a robust way and manage them using Archery tool. Archery is an open-source vulnerability assessment and management tool that helps developers and pentesters to perform scans and manage vulnerabilities. It uses popular open-source tools and also supports commercial tools to perform comprehensive scanning for web application and network. It also performs web application dynamic authenticated scanning and covers the whole applications by using selenium. The developers can also utilize the tool for implementation of their DevOps CI/CD environment.

1. Automated Vulnerability
Assessment and
Management

2. whoami!
• Bug Hunter on Internet – disclosed vulnerability @Google, @Facebook,
@Twitter etc.
• I’m Anand Tiwari
• Pentester – WebApp, MobApp & Network
• Working @ Philips Healthcare on Securing Medical Devices.
• 5+ Years of Experience in InfoSec.
• I love Automation for repeated work.

3. agenda
•What is Vulnerability Assessment & Management.
•Archery - Open Source VA/VM Tool.
•Challenges in VA/VM.
•How Archery works ?
•Automated Web Application Dynamic Scanning.
•Demo time.
•Roadmap
•How to Contribute ?
•Q/A

4. Source - Google
Vulnerability Assessment.

5. Vulnerability Management.
Source - Google

7. Challenges in VA/VM
• Multiple scanners.
• Manage huge list of vulnerabilities.
• Analysis and removing false positive.
• Prioritising vulnerabilities.
• Tracking vulnerability mitigation.
• Organizing Periodic scans.

8. Archery - Open Source VA/VM Tool.
• Open Source Vulnerability Assessment and Management Tool.
• Automate Vulnerability Scanners.
• Vulnerability data Dashboard.
• Helping you on Managing & Prioritising Vulnerabilities.
• Useful for Pentesters & Developers.
• Easy to integrate in CI/CD environment.
• Build in Python using Django.

9. How Archery works ?
Scanners
Archery Result Parsing
Archery Database
ZAP Data
Burp Data
OpenVAS Data
Dashboard

10. Web Application Dynamic Authenticated scanning.
Input URL
Cookies db
ZAP Replacer
ZAP Scanner
Selenium Webdriver

11. Demo

12. Roadmap
• More open source and commercial tool plugin support.
• API Scanning and management.
• Mobile Vulnerability Management.
• Vulnerability PoC pictures.
• Cloud security scanning.
• Reporting Format.

13. How to Contribute ?
• Test Archery Tool
• Write scanners plugin or suggest us scanner
support.
• Use / Promote / write about the tool.
• Report issue & feedback @ https://github.com/
archerysec/archerysec/issues

14. Documentation
• http://www.archerysec.info
• https://archerysec.github.io/archerysec/
• https://archerysec.github.io/archerysecapi/

15. Contact
• Twitter - https://twitter.com/archerysec
• Facebook - https://www.facebook.com/
ArcherySec/
• GitHub - https://github.com/archerysec/