Plants vs thieves: Automated Tests in the World of Web Security
summary
Demonstrates using Cypress end-to-end tests against a Dockerized OWASP Juice Shop to catch OWASP Top 3 issues: a crafted SQL injection via login yields unauthorized access, requests reveal a missing Content-Security-Policy header, and an admin URL returns 200 exposing broken access control. Shows negative tests, API requests (cy.request and cy.origin), faker/random sampling, npm audit, and integration ideas (pre-commit hooks, CI gates, optional ZAP proxy) so automated vanilla tests reliably detect and reproduce concrete web-security failures.
AI-written summary · about
chapters (12)
- 0:00Plants vs Zombies intro
- 7:47Securing apps with vanilla tests
- 15:58Writing security test cases
- 19:57Live demo: SQL injection with Cypress
- 27:59Testing CSP headers and APIs
- 31:58Broken access control tests
- 37:42CSRF testing and tools
- 42:21Security tests in dev lifecycle
- 45:11Testing frameworks beyond E2E
- 47:40Vanilla tests with security tools
- 50:34Value of vanilla security tests
- 53:43Key takeaways
related talks
28mPlants vs thieves: Automated Tests in the World of Security
01h 05mOWASP Juice Shop: Take your security vitamins!
36mLet's take baby steps to security testing
45mAutomated Security Testing in a DevOps world
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
58mSqueezing The Last Drop Out Of OWASP Juice Shop
01h 01mOWASP Juice Shop - An Open Source Software and security Fairytale
22msecure.AllTheThings() - Make Security Accessible to Everyone!