Henrique Dantas - API fuzzing using Swagger

•

0 j'aime•1,066 vues

DevSecCon

DevSecCon London 2016

Présentations et discours publics

Join the conversation #devseccon
Henrique Dantas
@hndantas
API fuzzing
using Swagger

Why API sec testing?
Public
Close to DB model
Ubiquitous
Business driver
Agility
https://flic.kr/p/5oTsVq

Solution
Automation
Reporting
Integration
https://flic.kr/p/bxwAxk

Python lib
Extensive and extendible
OSS
Popular
Contains all meta-data
Machine Readable
Swagger & Sulley

Join the conversation #devseccon
Now, your turn :)
/hdantas/fuzz

Join the conversation #devseccon
● APIs are good targets
● Leverage existing specs for sec testing
● Automate, Automate, Automate
@hndantas
henrique@restsecured.xyz

Recommandé

Stephen Sadowski - Securely automating infrastructure in the cloudDevSecCon

Matt carroll - "Security patching system packages is fun" said no-one everDevSecCon

Dev seccon london 2016 intelliment securityDevSecCon

Security as Code: A DevSecOps ApproachVMware Tanzu

Elizabeth Lawler - Devops, security, and compliance working in unisonDevSecCon

Nick Drage & Fraser Scott - Epic battle devops vs securityDevSecCon

[DevSecOps Live] DevSecOps: Challenges and OpportunitiesMohammed A. Imran

Renato Rodrigues - Security in the wildDevSecCon

Recommandé

Stephen Sadowski - Securely automating infrastructure in the cloudDevSecCon

Matt carroll - "Security patching system packages is fun" said no-one everDevSecCon

Dev seccon london 2016 intelliment securityDevSecCon

Security as Code: A DevSecOps ApproachVMware Tanzu

Elizabeth Lawler - Devops, security, and compliance working in unisonDevSecCon

Nick Drage & Fraser Scott - Epic battle devops vs securityDevSecCon

[DevSecOps Live] DevSecOps: Challenges and OpportunitiesMohammed A. Imran

Renato Rodrigues - Security in the wildDevSecCon

Bridging the Security Testing Gap in Your CI/CD PipelineDevOps.com

DevSecCon London 2017: when good containers go bad by Tim MackeyDevSecCon

Integrating DevOps and SecurityStijn Muylle

Ast in CI/CD by Ofer MaorDevSecCon

DevSecCon Asia 2017 Ofer Maor: AppSec DevOps automation – real world casesDevSecCon

Enforce compliance policy with model-driven automationPuppet

Secure Your Code Implement DevSecOps in Azurekloia

DevSecOps: essential tooling to enable continuous security 2019-09-16Rich Mills

Code Quality - Securitysedukull

Bringing Security Testing to Development: How to Enable Developers to Act as ...Achim D. Brucker

Security in CI/CD Pipelines: Tips for DevOps EngineersDevOps.com

DevSecOps-OWASP Indonesia Day 2017Suman Sourav

AWS live hack: Atlassian + Snyk OSS on AWSEric Smalling

Aleksei Dremin - Application Security Pipeline - phdays9Alexey Dremin

Take Control: Design a Complete DevSecOps ProgramDeborah Schalm

Application Security at DevOps Speed - DevOpsDays Singapore 2016Stefan Streichsbier

DevSecOps - The big pictureStefan Streichsbier

DevSecOps and the CI/CD PipelineJames Wickett

AllDayDevOps 2019 AppSensorjtmelton

DevSecOps | DevOps SecRubal Jain

Colin Domoney - DevSecCon

Detection, Response and the Azazel RootkitThreat Stack

Contenu connexe

Tendances

Bridging the Security Testing Gap in Your CI/CD PipelineDevOps.com

DevSecCon London 2017: when good containers go bad by Tim MackeyDevSecCon

Integrating DevOps and SecurityStijn Muylle

Ast in CI/CD by Ofer MaorDevSecCon

DevSecCon Asia 2017 Ofer Maor: AppSec DevOps automation – real world casesDevSecCon

Enforce compliance policy with model-driven automationPuppet

Secure Your Code Implement DevSecOps in Azurekloia

DevSecOps: essential tooling to enable continuous security 2019-09-16Rich Mills

Code Quality - Securitysedukull

Bringing Security Testing to Development: How to Enable Developers to Act as ...Achim D. Brucker

Security in CI/CD Pipelines: Tips for DevOps EngineersDevOps.com

DevSecOps-OWASP Indonesia Day 2017Suman Sourav

AWS live hack: Atlassian + Snyk OSS on AWSEric Smalling

Aleksei Dremin - Application Security Pipeline - phdays9Alexey Dremin

Take Control: Design a Complete DevSecOps ProgramDeborah Schalm

Application Security at DevOps Speed - DevOpsDays Singapore 2016Stefan Streichsbier

DevSecOps - The big pictureStefan Streichsbier

DevSecOps and the CI/CD PipelineJames Wickett

AllDayDevOps 2019 AppSensorjtmelton

DevSecOps | DevOps SecRubal Jain

Tendances (20)

Bridging the Security Testing Gap in Your CI/CD Pipeline

DevSecCon London 2017: when good containers go bad by Tim Mackey

Integrating DevOps and Security

Ast in CI/CD by Ofer Maor

DevSecCon Asia 2017 Ofer Maor: AppSec DevOps automation – real world cases

Enforce compliance policy with model-driven automation

Secure Your Code Implement DevSecOps in Azure

DevSecOps: essential tooling to enable continuous security 2019-09-16

Code Quality - Security

Bringing Security Testing to Development: How to Enable Developers to Act as ...

Security in CI/CD Pipelines: Tips for DevOps Engineers

DevSecOps-OWASP Indonesia Day 2017

AWS live hack: Atlassian + Snyk OSS on AWS

Aleksei Dremin - Application Security Pipeline - phdays9

Take Control: Design a Complete DevSecOps Program

Application Security at DevOps Speed - DevOpsDays Singapore 2016

DevSecOps - The big picture

DevSecOps and the CI/CD Pipeline

AllDayDevOps 2019 AppSensor

DevSecOps | DevOps Sec

En vedette

Colin Domoney - DevSecCon

Detection, Response and the Azazel RootkitThreat Stack

D1T3-Anto-Joseph-Droid-FFAnthony Jose

The Python bites your appleQidan He

BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...Alexandre Moneger

What the fuzzChristopher Frenz

50 Shades of Fuzzing by Peter Hlavaty & Marco GrassiShakacon

[CB16] About the cyber grand challenge: the world’s first all-machine hacking...CODE BLUE

Alfredo Reino - Monitoring aws and azureDevSecCon

SmartphoneHacking_Android_ExploitationMalachi Jones

Simon Bennetts - Automating ZAP DevSecCon

Bug Hunting with Media FormatsRussell Sanford

American Fuzzy LopMichael Overmeyer

Discovering Vulnerabilities For Fun and ProfitAbhisek Datta

The Nightmare Fuzzing Suite and Blind Code Coverage FuzzerJoxean Koret

You didnt see it’s coming? "Dawn of hardened Windows Kernel" Peter Hlavaty

Hacking Web Apps by Brent WhiteEC-Council

High Definition Fuzzing; Exploring HDMI vulnerabilitiesE Hacking

Beyond Automated Testing - RVAsec 2016Andrew McNicol

Pentesting RESTful WebServices v1.0n|u - The Open Security Community

En vedette (20)

Colin Domoney -

Detection, Response and the Azazel Rootkit

D1T3-Anto-Joseph-Droid-FF

The Python bites your apple

BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...

What the fuzz

50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi

[CB16] About the cyber grand challenge: the world’s first all-machine hacking...

Alfredo Reino - Monitoring aws and azure

SmartphoneHacking_Android_Exploitation

Simon Bennetts - Automating ZAP

Bug Hunting with Media Formats

American Fuzzy Lop

Discovering Vulnerabilities For Fun and Profit

The Nightmare Fuzzing Suite and Blind Code Coverage Fuzzer

You didnt see it’s coming? "Dawn of hardened Windows Kernel"

Hacking Web Apps by Brent White

High Definition Fuzzing; Exploring HDMI vulnerabilities

Beyond Automated Testing - RVAsec 2016

Pentesting RESTful WebServices v1.0

Plus de DevSecCon

DevSecCon London 2019: Workshop: Cloud Agnostic Security Testing with Scout S...DevSecCon

DevSecCon London 2019: Are Open Source Developers Security’s New Front Line?DevSecCon

DevSecCon London 2019: How to Secure OpenShift Environments and What Happens ...DevSecCon

DevSecCon London 2019: A Kernel of Truth: Intrusion Detection and Attestation...DevSecCon

DevSecCon Seattle 2019: Containerizing IT Security KnowledgeDevSecCon

DevSecCon Seattle 2019: Decentralized Authorization - Implementing Fine Grain...DevSecCon

DevSecCon Seattle 2019: Liquid Software as the real solution for the Sec in D...DevSecCon

DevSecCon Seattle 2019: Fully Automated production deployments with HIPAA/HIT...DevSecCon

DevSecCon Singapore 2019: Four years of reflection: How (not) to secure Web A...DevSecCon

DevSecCon Singapore 2019: crypto jacking: An evolving threat for cloud contai...DevSecCon

DevSecCon Singapore 2019: Can "dev", "sec" and "ops" really coexist in the wi...DevSecCon

DevSecCon Singapore 2019: Workshop - Burp extension writing workshopDevSecCon

DevSecCon Singapore 2019: Embracing Security - A changing DevOps landscapeDevSecCon

DevSecCon Singapore 2019: Web Services aren’t as secure as we thinkDevSecCon

DevSecCon Singapore 2019: An attacker's view of Serverless and GraphQL apps S...DevSecCon

DevSecCon Singapore 2019: The journey of digital transformation through DevSe...DevSecCon

DevSecCon Singapore 2019: Preventative Security for KubernetesDevSecCon

DevSecCon London 2018: Is your supply chain your achille's heelDevSecCon

DevSecCon London 2018: Get rid of these TLS certificatesDevSecCon

DevSecCon London 2018: Open DevSecOpsDevSecCon

Plus de DevSecCon (20)

DevSecCon London 2019: Workshop: Cloud Agnostic Security Testing with Scout S...

DevSecCon London 2019: Are Open Source Developers Security’s New Front Line?

DevSecCon London 2019: How to Secure OpenShift Environments and What Happens ...

DevSecCon London 2019: A Kernel of Truth: Intrusion Detection and Attestation...

DevSecCon Seattle 2019: Containerizing IT Security Knowledge

DevSecCon Seattle 2019: Decentralized Authorization - Implementing Fine Grain...

DevSecCon Seattle 2019: Liquid Software as the real solution for the Sec in D...

DevSecCon Seattle 2019: Fully Automated production deployments with HIPAA/HIT...

DevSecCon Singapore 2019: Four years of reflection: How (not) to secure Web A...

DevSecCon Singapore 2019: crypto jacking: An evolving threat for cloud contai...

DevSecCon Singapore 2019: Can "dev", "sec" and "ops" really coexist in the wi...

DevSecCon Singapore 2019: Workshop - Burp extension writing workshop

DevSecCon Singapore 2019: Embracing Security - A changing DevOps landscape

DevSecCon Singapore 2019: Web Services aren’t as secure as we think

DevSecCon Singapore 2019: An attacker's view of Serverless and GraphQL apps S...

DevSecCon Singapore 2019: The journey of digital transformation through DevSe...

DevSecCon Singapore 2019: Preventative Security for Kubernetes

DevSecCon London 2018: Is your supply chain your achille's heel

DevSecCon London 2018: Get rid of these TLS certificates

DevSecCon London 2018: Open DevSecOps

Dernier

Microsoft Fabric Analytics Engineer (DP-600) Exam Dumps 2024.pdfSkillCertProExams

Deciding The Topic of our Magazine.pptx.bazilnaeem7

The Concession of Asaba International Airport: Balancing Politics and Policy ...Kayode Fayemi

ACM CHT Best Inspection Practices Kinben Innovation MIC Slideshare.pdfKinben Innovation Private Limited

Understanding Poverty: A Community Questionnairebazilnaeem7

The Influence and Evolution of Mogul Press in Contemporary Public Relations.docxMogul Press

Databricks Machine Learning Associate Exam Dumps 2024.pdfSkillCertProExams

TSM unit 5 Toxicokinetics seminar by Ansari Aashif Raza.pptxAnsari Aashif Raza Mohd Imtiyaz

SaaStr Workshop Wednesday with CEO of Gurusaastr

DAY 0 8 A Revelation 05-19-2024 PPT.pptxFamilyWorshipCenterD

2024 mega trends for the digital workplace - FINAL.pdfNancy Goebel

STM valmiusseminaari 26-04-2024 PUUMALAINEN Ajankohtaista kansainvälisestä yh...Sosiaali- ja terveysministeriö / yleiset

ServiceNow CIS-Discovery Exam Dumps 2024SkillCertProExams

2024-05-15-Surat Meetup-Hyperautomation.pptxnitishjain2015

Dernier (14)

Microsoft Fabric Analytics Engineer (DP-600) Exam Dumps 2024.pdf

Deciding The Topic of our Magazine.pptx.

The Concession of Asaba International Airport: Balancing Politics and Policy ...

ACM CHT Best Inspection Practices Kinben Innovation MIC Slideshare.pdf

Understanding Poverty: A Community Questionnaire

The Influence and Evolution of Mogul Press in Contemporary Public Relations.docx

Databricks Machine Learning Associate Exam Dumps 2024.pdf

TSM unit 5 Toxicokinetics seminar by Ansari Aashif Raza.pptx

SaaStr Workshop Wednesday with CEO of Guru

DAY 0 8 A Revelation 05-19-2024 PPT.pptx

2024 mega trends for the digital workplace - FINAL.pdf

STM valmiusseminaari 26-04-2024 PUUMALAINEN Ajankohtaista kansainvälisestä yh...

ServiceNow CIS-Discovery Exam Dumps 2024

2024-05-15-Surat Meetup-Hyperautomation.pptx

Henrique Dantas - API fuzzing using Swagger

1. Join the conversation #devseccon Henrique Dantas @hndantas API fuzzing using Swagger

2. Why API sec testing? Public Close to DB model Ubiquitous Business driver Agility https://flic.kr/p/5oTsVq

3. Solution Automation Reporting Integration https://flic.kr/p/bxwAxk

4. Python lib Extensive and extendible OSS Popular Contains all meta-data Machine Readable Swagger & Sulley

5. Join the conversation #devseccon Now, your turn :) /hdantas/fuzz

6. Join the conversation #devseccon ● APIs are good targets ● Leverage existing specs for sec testing ● Automate, Automate, Automate @hndantas henrique@restsecured.xyz