Catching_Low_Hanging_Fruits.pdf

Johanna on OWASP-ZAP during Amsterdam secure software development meetup 22-6-2018

Transcript

1. Catching Low Hanging Fruits How attack proxies and automation can help you catch those before the pentester (or attacker!) does Johanna Curiel
2. Confidential Customized for Lorem Ipsum LLC Version 1.0 TOC What are easy to catch vulnerabilities? Quick and Dirty proxies Automation is your friend Putting all together About me : just a little Why you should care!
3. About me A Developer turned Security Engineer. Passionate about Security OWASP contributor Working as Security Engineer @Mobiquity
4. Low hanging fruits: Easy to catch vulnerabilities You do unit tests ...right? You test your code...right? Why not quick and dirty security tests?
5. Catching Low hanging vulnerabilities: Pentester doing Script Kiddie work CVE’S XSS SQL INJECTIONS RFI… PATH TRAVERSAL.. YOU NAME IT!
6. Quick and Dirty ATTACK Proxies: Pentester’s best friends
7. Quick and Dirty ATTACK Proxies: Pentester’s best friends
8. Dev team should do it too... Catch CVE’s: OWASP DEPENDENCY CHECK Catch OWASP TOP TEN Vulnerabilities: Burp/ZAP
11. Demo, and more online!
12. THANK YOU johanna.curiel@owasp.org https://www.owasp.org/index.php/Main_Page https://www.owasp.org/index.php/OWASP_Dependency_Check https://zaproxy.blogspot.com/2016/02/#Contributor