How to Start Security Testing Without Fear
summary
Covers concrete, actionable checks: follow OWASP Top 10 focus areas (injection A3 2021, broken access control, security misconfiguration), test that form, URL and API inputs are sanitized and encoded (watch file uploads), and attempt access with wrong or no credentials and by altering object IDs. Run automated scans against dependency databases (example: an npm http-server pulled 13 packages) to check for outdated dependencies and CVEs, remove secrets from code, use infrastructure-as-code and Docker hardening, and subscribe to vulnerability alerts.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:40What security testing is
- 3:04Understanding attackers
- 6:41OWASP Top 10 overview
- 7:23Injection vulnerabilities
- 13:47Vulnerable components
- 16:19Broken access control
- 19:07Security misconfiguration
- 21:59Practical security testing
- 23:26Securing test automation
- 25:38Summary
related talks
44mShift-Left-Security with the Security Test Pyramid
37mDeploying Security Testing Practice in Your Team and Company
57mThe Developer's Field Guide to Software Security
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
44mStart writing security tests now!
15mJumpstart Security & Penetration Testing APIs
43mSecurity Testing Tools: Can I Touch You There?
28mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time