Web Application Security - A Hands On Testing Challenge, with Dan Billing
Details
IMPORTANT: This is a hands-on workshop. You will benefit most by bringing your own laptop. If you don't have one, you'll be able to pair with someone.
ALSO: If you can't make this event, fear not! The Edinburgh MoT Meetup is hosting Dan the day before, Wednesday October 17th, so hopefully you can make that one.
We know that application security is important. We have to protect our customers' data and our employers' data while keeping our systems up and running. But do we have the skills and knowledge to meet that challenge?
During this workshop, we will begin to explore some of the concepts, skills, and techniques ofsecurity testing by working with a vulnerable web application. Through practical activities and hands-on learning, we will discover the key security issues that affect web applications today.
Testers will learn skills to identify software vulnerabilities and understand common threats and risks that occur in web-applications. We will also examine some of the tools and utilities that can enhance and extend security testing efforts. Let's look at the essential steps to build and execute your own security testing strategies. Let's examine how learning and mentoring can aid in the development of strategies. You can and should build up your own skills with integrated security testing. This will ensure ongoing relevance of your role in a security context, and the success ofyour organisations.
Building upon personal experience of integrating security testing into an existing organisation, incorporating DevOps, continuous delivery and integration, this workshop will highlight and discuss the reflections of learning from hackers, recent breaches and the socio-economic, political and technical impact upon software development organisations.
Attendees will take away a set of advice and techniques to incorporate and enable security testing into their day to day work, answering some of the questions that may arise around scope,skills, tools, models and learning.
SETUP INSTRUCTIONS
Dan Billing: Web Application Security - A Hands on Testing Challenge
Hello! Thanks for deciding to attend this workshop. We have a full day of great learning ahead of us, but so that we all have a smooth experience on the day, it would be really great if you could do some pre installation and configuration. The web applications will be available via a URL, however it would be helpful if you could install the the following applications and tools prior to the workshop.
Heroku
We will be using a live Heroku instance during this workshop, but should the wifi go down, we have some alternatives. Please create your own Heroku login, available at https://www.heroku.com/
Docker
Install the appropriate version of Docker for your laptop, available from https://www.docker.com/
TicketMagpie
Start Docker on your machine. From a command line run:
docker pull danielbilling/ticketmagpie
The dependencies should install, then run;
docker run -e "SPRING_PROFILES_ACTIVE=hsqldb" -p8080:8080 "danielbilling/ticketmagpie"
Access the application from localhost:8080 in the browser.
OWASP Juice Shop
Full instructions for installing OWASP Juice Box can be found here: https://www.owasp.org/index.php/OWASP_Juice_Shop_Project
Alternatively, from the command line run:
docker pull bkimminich/juice-shop
The dependencies should install, then run;
docker run -d -p 3000:3000 bkimminich/juice-shop
Access the application from localhost:3000 in the browser.
Zed Attack Proxy
Install the appropriate stable version of ZAP from this URL: https://github.com/zaproxy/zaproxy/wiki/Downloads
Cookie Editor
Install a cookie editor plugin to your favourite browser. I recommend: http://www.editthiscookie.com/
Foxy Proxy
Install Foxy Proxy or a similar proxy switching tool into your favourite browser. https://getfoxyproxy.org/
I would recommend having both Google Chrome and Mozilla Firefox browsers installed on your machines.