We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Open Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
Explore the open-source world of pentesting and security analysis tools, and learn how to integrate them into your DevOps practices for seamless automated security testing.
- DevOps and Security: Security should be integrated into DevOps practices.
- ZAP: An open-source Web Application Security Scanner with a UI and headless mode.
- Marathon: An open-source tool that automates web application security scanning and reporting.
- Configuration: ZAP and Marathon can be configured using Jenkins files or shell scripts.
- Automated Security Testing: Automatic testing can be done using ZAP and Marathon.
- Security in DevOps: Security should be integrated into the entire CI/CD pipeline.
- Best Practices: Use default settings, follow best practices, and use the API.
- API: ZAP and Marathon have APIs that can be used for automation.
- Headless Mode: ZAP can run in headless mode for automated testing.
- JSON Reports: Reports can be generated in multiple formats, including JSON.
- DAST Tools: ZAP is a DAST (Dynamic Application Security Testing) tool.
- Crawler Problems: Common problems with crawlers include incorrect handles and not understanding JavaScript.
- Input Vectors: Input vectors are used to test web applications for vulnerabilities.