Download to read offline
Uploaded bySoluto
Hacking like a FED
The document discusses various cybersecurity testing techniques, focusing on dynamic and static analysis security testing tools like OWASP ZAP and Nodejsscan. It highlights the risks of common vulnerabilities such as cross-site scripting (XSS) and cross-site request forgery (CSRF), along with mitigation strategies. The author emphasizes the importance of input sanitization and the need to integrate security testing into continuous integration processes.
Hacking like a FED
- 1. Hacking Like aFED Omer Levi Hevroni @omerlh @SolutoEng
- 2. Every line ofcode can introduce a new security issue @omerlh
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11. @omerlh Dynamic Analysis SecurityTesting https://www.zaproxy.org/
- 12. @omerlh What Zap does? •Inspecting request and response • Run scan rules: ○ Cookies misconfiguration ○ Security HTTP Headers ○ Mixed Content ○ And many more
- 13. @omerlh Leveraging End toEnd Tests
- 14.
- 15. @omerlh Running in theCI • Run e2e tests • Proxy through Zap • Fail the build
- 16.
- 17.
- 18.
- 19. @omerlh Cross Site RequestForgery (CSRF)
- 21.
- 22. @omerlh Mitigating CSRF • UsingSameSite attribute • Adding Anti-CSRF token https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross- Site_Request_Forgery_Prevention_Cheat_Sheet.md
- 23. @omerlh Static Analysis SecurityTesting https://github.com/ajinabraham/NodeJsScan
- 24. @omerlh Running it inthe CI Target Folder Repot file
- 25.
- 26. @omerlh Failing the build Gluefile Repot file
- 27.
- 28.
- 29.
- 30.
- 31.
- 32.
- 33. @omerlh Mitigating NoSQLi • Nevertrust user input • Input Sanitization
- 34.
- 35.
- 36. @omerlh What if oneof this packages is vulnerable?
- 37. @omerlh Running in theCI https://snyk.io/docs/github/
- 38.
- 39.
- 40. @omerlh Cross Site Scripting •Code injection • Usually, very high risk
- 41.
- 42. @omerlh We can seethe original GitHub issue!
- 43.
- 44.
- 45.
- 46. @omerlh Mitigating XSS • Nevertrust user input • Input sanitization • Security headers • React is not immune to XSS! https://github.com/OWASP/CheatSheetSeries/blob/master/che atsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md
- 47.
- 48.
- 49. @omerlh Tool Type ToolName Ease of Use Packages Scanning Snyk Easy Static Analysis NodeJSScan Medium Dynamic Analysis OWASP Zap Hard https://wp.me/pakmvi-3g Tools Summary
- 50. @omerlh Feedback is muchappreciated!
- 51.
- 52.
- 53. Thank You Omer LeviHevroni April 2019 @omerlh http://jobs.soluto.com/