How Scripting In ZAP Can Bridge The Gap Between Dev Teams And Security
summary
Turns the claim that testers can bridge Dev and security into concrete steps: run a browser through ZAP as a proxy and watch the alerts tab populate with passive scanner findings, point Selenium/Postman/JMeter tests through ZAP for automated security assertions, and write Zest scripting or Python scripts to replay API flows, grab tokens, and add custom passive rules. Works headless in Docker/Jenkins; the presenter reports running about 900 instances and thousands of automated test cases to prove it.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 0:20Who am I
- 1:34Who is in the room
- 2:04Opportunities
- 2:34Security
- 3:20Obstacles
- 4:05Learning
- 4:23Dev Type Line
- 5:36Multiple Choice
- 6:19Biggest Obstacle
- 7:09Security Hardness
- 9:08ISO Compliance
- 10:12Tester Mindset
- 10:36Test Theory
- 13:58Solution
- 14:19Testers
- 15:35Step 1 Learning
- 17:05Step 2 Testing
- 18:06PIPI Scanner
- 19:46Zest
- 21:02Demo
- 24:29Questions
- 24:54Traditional tools
- 27:03Recap
- 28:03Summary
- 28:47References
- 30:44Playgrounds
- 31:45QA
- 38:50Can you mix Zest in Python
related talks
35mAutomated Security Testing
36mLet's take baby steps to security testing
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
46mMaking Security Agile
45mSecurity Testing with OWASP ZAP in CI/CD
33mAutomated Security Scanning in Payment Card Industry
22msecure.AllTheThings() - Make Security Accessible to Everyone!
46mSecurity DevOps - Staying Secure In Agile Projects