Bulletproof Your Software: The Magic of Security Autotests

How to automate the validation of vulnerabilities after they've been fixed by developers. Create security autotests in just a few clicks.

Transcript

1. Bulletproof Your Software The Magic of Security Autotests Elmir Iskanderov
2. $ whoami - Elmir Iskanderov linkedin.com/in/iskanderov; - 4 years in cybersecurity; - Application Security Engineer at Cossack Labs; - Specialized in WEB, API, Infrastructure and Cloud penetration testing; - Automatization enjoyer. Cossack Labs - UK/Ukraine data security solutions company. Practical data security and software security in industries where security is a hard requirement.
3. Agenda 1. The Problems We Faced 2. Security Autotest 3. Use Cases 4. Creation Autotests In a Few Clicks 5. Important to Remember 6. Q&A
4. The Problems We Faced - A lot of reported vulnerabilities that we should validate as fixed; - Detect duplicate previously found vulnerabilities; - Spending too much time on validation.
5. Solution
6. Security Autotests - Saving time; - Automated validation of vulnerabilities; - Integration into the CI/CD pipeline; - Tracking previous vulnerabilities; - Creation in a few clicks.
7. Use Cases - Validating HTTP security headers; - Input validation; - Misconfigurations (open files, secrets in code, etc.); - Rate limits.
8. Validating HTTP headers
9. Session Token Revocation
10. Wait wait wait…
11. Real Size of Security Autotests
12. Use templates!!!
13. Template
14. Creation Autotests In a Few Clicks Burp Suite + ‘Copy as Python-Requests’ extension + + your templates
15. Copy As Python-Requests Installation https://github.com/portswigger/copy-as-python-requests
16. Copy As Python-Requests Usage
17. Copy As Python-Requests Usage 2
18. Creation of Security Autotest
19. Creation of security autotest 2
20. Output
21. Pay attention to - Do not trust verifications for high/critical vulnerabilities; - Do not spend too much time on creation (if there are no reasons to automate all); - Use templates for most common issues; - Create a flow for logging in and retrieving session cookies/tokens; - Software is developing, and some automated tests are becoming outdated.
22. QA Q&A