Automated security testing

Automated Security Testing
OWASP Israel 2017 Chapter Meeting
3 April 2017
http://goo.gl/sphN9w

Demo: Building Security Testing from
existing automation tests

Agenda
Approaches to Application Security Testing
Building Blocks
Live demo
Future plans

About me
Software Developer and Security Evangelist at Soluto
26yrs old
Writing code for the last 8 years
@omerlh: Github/Twitter

Approaches to Application Security Testing
Static: Code analysis - Checkmarx (our host :))
Dynamic: Live analysis
Integrated: Combination of Static and Dynamic

Building Blocks

ZAP - Zed Attack Proxy
“The OWASP Zed Attack Proxy (ZAP) is one of the world’s most
popular free security tools”
API/cli
Active Scan Mode (spider)
Passive Scan Mode

“WebdriverIO lets you control a browser or a mobile application
with just a few lines of code.”
Simple Selenium binding for JS
Very popular framework for automation testing
Webdriver.io

Docker
“Docker is the world’s leading software container platform”
“Using containers, everything required to make a piece of
software run is packaged into isolated containers”

OWASP Mutillidae
“free, open source, deliberately vulnerable web-application”
Used to demonstrate ZAP Capabilities
Docker image

Putting it all together...

Demo Setup
Selenium
Hub
ChromeTest Code MutilidaeZAP Proxy

Live Demo
All the code is available at Github

Comparison with Zap Active Scan
Better coverage of the tested app
Take advantage of existing tests
No additional setup - baseline scan
Mixed tests types - automation and security

Future Plans
Alerts processing - see this issue
Use Jenkins plugin? (we are using TeamCity)
Dedicated security tests
Integrate Active Scan (XSS Dom plugin)
SSL/HSTS
Mobile/Certificate pinning override

Questions?
We are hiring!
Checkout our blog

Automated security testing

Recommended

Recommended

More Related Content

More from Soluto

More from Soluto (16)

Recently uploaded

Recently uploaded (20)

Automated security testing

Editor's Notes