Building Application Security Automation with Python

Instructor - Abhay Bhargav

Pre-Requisites - Knowledge of Python basics preferred but not required ( Basic Python skills are good enough. Knowledge of variables, loops, modules, imports and data structures would suffice). Examples with complete source code would be given to participants to study further. Hands-on exercises will be "templatized" to ensure that people are up and running quickly, even if they are not familiar with Python.

Abstract - In an age of rapid-release applications, DevOps and small application security teams, the only way application security can scale, is with automation. In this workshop, I will introduce some key automation practices and techniques using Python that students can use in their own application security programs for quick wins. These techniques will predominantly focus on developing automation scripts harnessing API from Open Source Web Vulnerability Scanners (like OWASP ZAP), Building fuzzers harnessing features of tools like mitmproxy with as little as a few lines of code and using NoSQL databases for easy search and to generate powerful application security analytics. The session will be entirely hands-on, with a lot of coding and very little theory.

Required materials - Laptop with 64bit CPU (Mac/Win/*nix) is good with 8GB+ RAM (Host Machine) preferred, and atleast 50GB of free HDD to import a Virtualbox VM

For Windows Laptops please ensure that Virtualization is enabled at the BIOS to run the VM. There have been issues where Virtualization being disabled at the BIOS has resulted in the VM not working. Please ensure that you have the necessary permissions to change BIOS settings if required (especially for work/corporate laptops)

64 bit CPU is required. we would be using Docker images and docker doesn't support 32bit systems

Please have the latest version of Virtualbox installed on the laptop.