Let's take baby steps to security testing
summary
Shows how to run OWASP ZAP alongside existing Selenium suites and gate results in Jenkins so obvious vulnerabilities surface during CI rather than at release time. Uses OWASP ZAP 2.8.0 as a proxy with Chrome WebDriver, runs spider and active scans against an OWASP vulnerable app via Juice Shop Docker image, and demonstrates the Jenkins ZAP plugin to persist sessions, fail builds on high alerts and produce HTML reports. Demo finds SQL injection and XSS alerts (three high in one run, five in another).
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:43Agenda
- 4:42Why security testing
- 6:56Cisco Labs
- 8:21Baby Step 1
- 13:17Test Cases
- 15:04Step 3 Tools
- 16:45Step 4 Automation
- 17:47Demonstration
- 25:11Jenkins plugin
- 28:36Demo
related talks
45mSecurity Testing with OWASP ZAP in CI/CD
35mAutomated Security Testing
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
36mSecurity Test Driven Development (STDD) Using Selenium/Appium
45mAutomated Security Testing in a DevOps world
41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And Security
21mAutomated Security Scanning in Payment Card Industry
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way