Static Analysis for Dynamic Assessments
summary
Shows how to export Burp Suite traffic to XML, parse and write client-side files with a custom tool Ripa, then run static scanners like Fortify SCA over harvested HTML, JS, XAP and PDFs. Demonstrates automating the workflow from Burp, grouping files by type, and finding real issues: DOM-based XSS, Silverlight XAPs for disassembly, PDFs with sensitive strings, and many math.random insecure randomness flags plus an autocomplete password field. Practical, demoed tool and concrete results.
AI-written summary · about
chapters (14)
- 0:00Start
- 1:20agenda
- 1:46introduction
- 3:27great divides
- 7:26common dynamic challenges
- 10:56a possible solution
- 14:22RIPSA
- 16:05save Burp responses as xml
- 16:22evaluate xml, save files locally
- 16:38analyze local files
- 31:23#winning
- 34:04takeaways
- 35:15call to the community
- 37:31reach out
related talks
45mFinding Vulnerabilities through Static Analysis and Scripting
58mModern web application bugs
01h 13mAutomated Static And Dynamic Security Analysis of Mobile Apps
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
34mOWASP Code Pulse and Attack Surface Detector
42mModern web application bugs