Manual versus automated penetration testing on AWS
summary
Argues that neither pure automation nor pure manual testing wins and shows concrete practices: uses Burp and other scanners, finds thousands of scan outputs with many false positives and several missed issues until an authentication bug is fixed, discovers basic XSS and SQLi and demonstrates exploiting one SQLi to exfiltrate a database, automates report generation so numbering and remediation text update automatically, and prototypes a containerized pipeline for repeatable testing and reporting.
AI-written summary · about
chapters (5)
- 0:00Introduction to the debate
- 0:27The role of security testing
- 10:42Automating report generation
- 14:05Balancing testing strategies
- 14:24Conclusion and resources
related talks
39mAutomating myself out of a job...
49mMan vs Machine: manual and automated security testing
44mApplication Security: Everything we know is wrong
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
19mPenetration Testing
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
43mThe Sad Tale of Etaoin ShrdLu and the Danger of Automated Pen Tests