Project Monterey: Automating Security Testing in Cloud Deployments
Explore automated security testing for cloud deployments with Project Monterey. Learn how Netflix scales traditional tools and integrates custom solutions for continuous security in a dynamic environment.
Active Scan Augmenting Manual Testing with Attack Proxy Plugins
Explore advanced web security techniques with ActiveScan++, a Burp Suite plugin for detecting complex vulnerabilities like host header poisoning and code injection through heuristic probes and automated analysis.
Practical Tips for Web Application Security in the Age of Agile and DevOps
Practical tips for adapting web application security to agile and DevOps environments, focusing on lightweight controls, visibility, and measuring maturity in modern development practices.
Continuous Integration: Live Static Analysis Using Visual Studio and the Roslyn API
Explore live static analysis in Visual Studio using Roslyn API for secure coding. Learn to create custom rules, integrate secure code scanning, and enhance .NET application security.
Continuous Cloud Security Automation
Distributed framework for scalable security automation in cloud environments. Easily integrates tools, minimizes false positives, and supports continuous software delivery across teams.
QARK: Android App Exploit and Static Code Analysis Tool
Explore QARK, a comprehensive tool for Android app security analysis and exploitation. Learn how it combines static code analysis, vulnerability detection, and automatic exploit generation for developers and pentesters.
Static Code Analysis of Complex PHP Application Vulnerabilities
Explore advanced static code analysis techniques for detecting complex PHP vulnerabilities, including first-order, second-order, and object injection issues.
Can SaaS Ever Be Secure? - Security Risks and Compliance in Cloud Services
Explore security challenges and solutions for SaaS, including regulatory compliance, data transfers, and risk assessment. Learn key takeaways for ensuring secure cloud-based services.
Uncovering OWASP's Mobile Risks in iOS Apps - AppSec California 2015
Explore iOS app vulnerabilities through reverse engineering techniques. Learn to extract, analyze, and identify common security risks in mobile applications using real-world examples.
Headless Browser Hide and Seek - Offensive Uses and Countermeasures
Explore offensive and defensive uses of headless browsers in web security. Learn techniques for detecting malicious activity, collecting threat forensics, and securing your own tools against potential vulnerabilities.
Hacking the Oracle Application Framework - Deep-Dive Penetration Testing Techniques
Explore deep-dive penetration testing techniques for complex enterprise applications, using Oracle Application Framework as a case study. Learn about static reverse engineering, mock environments, and dynamic monitoring.
iOS App Integrity: Enhancing Security with Encrypted Code Modules
Explore iOS app security vulnerabilities and learn advanced protection techniques like Encrypted Code Modules (ECM) to safeguard against static analysis, binary patching, and other common attacks.
Improving Penetration Testing Efficiency with OWASP Code Pulse and Attack Surface Detector
Explore OWASP tools for efficient web app penetration testing: Code Pulse for real-time code coverage and Attack Surface Detector for comprehensive endpoint discovery, enhancing security assessment capabilities.
ZAP Heads Up Display - Introduction and Demo
Explore OWASP ZAP's new Heads Up Display feature for automated web application security testing. Learn about its capabilities, demo, hidden fields, attack modes, and integration with browser APIs.
Building a Security Test Automation Framework
Learn best practices for building a security test automation framework using Docker, Kubernetes, and Defect Dojo. Discover how to manage vulnerabilities, prevent key sprawl, and implement security tooling in CI/CD pipelines.
Leveraging the ASVS in the Secure Software Development Lifecycle
Integrating OWASP ASVS into the secure software development lifecycle to create uniform security requirements, prioritize tasks, and track adherence across applications using existing tools and processes.
Endpoint Finder: A Static Analysis Tool for Web Endpoint Discovery - Lightning Talk
Discover a static analysis tool for extracting web endpoints from JavaScript files, offering improved accuracy and reduced false positives compared to regex-based methods.
OWASP Juice Shop - Sustainable Development Practices for Web Applications
Explore sustainable web app development with OWASP Juice Shop. Learn clean code, TDD, CI/CD, quality metrics, and mutation testing. Discover automation benefits and overcome challenges in JavaScript development.
Needle: Finding Issues within iOS Applications
Discover Needle, an open-source framework for streamlined iOS app security assessments. Learn about its modular architecture, capabilities, and how it simplifies vulnerability detection in iOS applications.
Black-Box Approximate Taint Tracking by Utilizing Data Partitioning
Innovative black-box taint tracking system for detecting user input data injection in commands and SQL queries, offering cost-effective and performant runtime protection without code modifications.
A Static Tainting Analysis Method for Aspect-Oriented Programs
Introduces a new method for detecting vulnerabilities in aspect-oriented web applications, focusing on static tainting analysis to improve security in languages like AspectJ.