WEBVTT

1
00:00:02.345 --> 00:00:05.365
<00:00:02.345>It <00:00:02.485>is <00:00:02.625>almost <00:00:02.765>a <00:00:02.905>little, <00:00:03.045>I <00:00:03.185>don't <00:00:03.325>wanna <00:00:03.465>call <00:00:03.605>it <00:00:03.745>scary,

2
00:00:05.545 --> 00:00:08.565
<00:00:05.545>but <00:00:05.825>for <00:00:06.104>me <00:00:06.385>it's <00:00:06.665>mostly <00:00:06.945>positive

3
00:00:08.565 --> 00:00:11.245
<00:00:08.565>because <00:00:08.705>I <00:00:08.844>know <00:00:08.985>that <00:00:09.125>there <00:00:09.264>are <00:00:09.405>some <00:00:09.545>nerdy <00:00:09.684>people <00:00:09.825>like <00:00:09.965>me

4
00:00:11.305 --> 00:00:14.405
<00:00:11.305>coming <00:00:11.504>here <00:00:11.705>because <00:00:11.905>maybe <00:00:12.105>they <00:00:12.305>noticed <00:00:12.504>a <00:00:12.705>little

5
00:00:14.685 --> 00:00:15.765
<00:00:14.685>reference <00:00:14.928>in <00:00:15.171>my <00:00:15.414>top <00:00:15.657>title.

6
00:00:15.945 --> 00:00:19.965
<00:00:15.945>So <00:00:16.085>who <00:00:16.225>thought <00:00:16.365>about <00:00:16.505>a <00:00:16.645>certain <00:00:16.785>game <00:00:16.925>when <00:00:17.065>reading <00:00:17.205>this <00:00:17.345>title?

7
00:00:21.825 --> 00:00:23.365
<00:00:21.825>Oh <00:00:22.023>my <00:00:22.221>god, <00:00:22.419>I'm <00:00:22.616>so <00:00:22.814>happy <00:00:23.012>about <00:00:23.211>that.

8
00:00:24.185 --> 00:00:28.205
<00:00:24.185>So <00:00:24.312>that <00:00:24.439>was <00:00:24.566>a <00:00:24.694>little <00:00:24.821>game, <00:00:24.948>which <00:00:25.075>is <00:00:25.203>a <00:00:25.330>wonderful <00:00:25.457>allegory <00:00:25.584>on

9
00:00:28.725 --> 00:00:30.365
<00:00:28.725>security <00:00:29.075>and <00:00:29.425>testing <00:00:29.775>a <00:00:30.125>live.

10
00:00:30.665 --> 00:00:35.205
<00:00:30.665>So <00:00:30.865>it's <00:00:31.064>perfect <00:00:31.265>for <00:00:31.465>some <00:00:31.665>maybe <00:00:31.865>interesting <00:00:32.064>way

11
00:00:35.205 --> 00:00:39.565
<00:00:35.205>of <00:00:35.332>seeing <00:00:35.459>it <00:00:35.586>because <00:00:35.714>I <00:00:35.841>know <00:00:35.968>you <00:00:36.095>will <00:00:36.223>ask <00:00:36.350>me, <00:00:36.477>Hey <00:00:36.605>Mo,

12
00:00:39.785 --> 00:00:43.285
<00:00:39.785>why <00:00:39.959>do <00:00:40.135>you <00:00:40.309>bring <00:00:40.485>automated <00:00:40.660>tests <00:00:40.834>in <00:00:41.010>the <00:00:41.184>world

13
00:00:43.285 --> 00:00:47.165
<00:00:43.285>of <00:00:43.425>security <00:00:43.565>testing <00:00:43.705>when <00:00:43.845>I <00:00:43.985>can <00:00:44.125>only <00:00:44.264>like <00:00:44.404>install <00:00:44.544>the <00:00:44.684>tool

14
00:00:47.265 --> 00:00:48.285
<00:00:47.265>or <00:00:47.571>import <00:00:47.876>a <00:00:48.183>library?

15
00:00:50.015 --> 00:00:51.245
<00:00:50.015>Let's <00:00:50.199>take <00:00:50.384>a <00:00:50.568>look <00:00:50.753>at <00:00:50.937>it <00:00:51.122>together.

16
00:00:51.385 --> 00:00:53.965
<00:00:51.385>So <00:00:51.540>maybe <00:00:51.696>this <00:00:51.851>is <00:00:52.007>wonderful <00:00:52.162>alternative <00:00:52.318>way <00:00:52.473>of <00:00:52.629>seeing <00:00:52.785>it.

17
00:00:55.385 --> 00:00:58.965
<00:00:55.385>So <00:00:55.559>before <00:00:55.735>that, <00:00:55.910>quick, <00:00:56.085>some <00:00:56.260>small <00:00:56.434>facts <00:00:56.610>about <00:00:56.785>me,

18
00:00:59.105 --> 00:01:01.325
<00:00:59.105>my <00:00:59.279>name's <00:00:59.455>Ramona <00:00:59.629>or <00:00:59.805>some <00:00:59.980>people <00:01:00.154>call <00:01:00.330>me <00:01:00.504>Mo.

19
00:01:01.345 --> 00:01:04.605
<00:01:01.345>You <00:01:01.485>can <00:01:01.625>choose <00:01:01.765>it. <00:01:01.905>I'm <00:01:02.045>working <00:01:02.185>as <00:01:02.324>a <00:01:02.464>developer <00:01:02.605>advocate <00:01:02.745>at

20
00:01:05.465 --> 00:01:07.245
<00:01:05.465>for <00:01:05.815>like <00:01:06.165>some <00:01:06.515>month <00:01:06.865>months.

21
00:01:07.265 --> 00:01:08.725
<00:01:07.265>So <00:01:07.527>I'm <00:01:07.790>a <00:01:08.053>little <00:01:08.316>baby <00:01:08.579>advocate.

22
00:01:09.265 --> 00:01:11.805
<00:01:09.265>Um, <00:01:09.440>before <00:01:09.615>I <00:01:09.790>was <00:01:09.965>working <00:01:10.140>in <00:01:10.315>open <00:01:10.490>source, <00:01:10.665>um,

23
00:01:12.095 --> 00:01:14.885
<00:01:12.095>being <00:01:12.295>a <00:01:12.495>Google <00:01:12.695>developer <00:01:12.895>expert <00:01:13.095>in <00:01:13.295>web <00:01:13.495>technologies

24
00:01:14.945 --> 00:01:15.965
<00:01:14.945>and <00:01:15.250>the <00:01:15.557>Cyprus <00:01:15.863>ambassador.

25
00:01:16.305 --> 00:01:17.525
<00:01:16.305>So <00:01:16.524>it <00:01:16.744>should <00:01:16.963>be <00:01:17.183>a <00:01:17.403>surprise.

26
00:01:17.765 --> 00:01:20.125
<00:01:17.765>I <00:01:17.965>am <00:01:18.165>using <00:01:18.365>end-to-end <00:01:18.565>testing <00:01:18.765>in <00:01:18.965>this <00:01:19.165>talk

27
00:01:20.145 --> 00:01:22.405
<00:01:20.145>to <00:01:20.378>showcase <00:01:20.611>a <00:01:20.845>little <00:01:21.078>bit <00:01:21.311>some <00:01:21.545>Cyprus.

28
00:01:22.425 --> 00:01:25.565
<00:01:22.425>But <00:01:22.774>little <00:01:23.125>disclaimer <00:01:23.475>beforehand, <00:01:23.825>most

29
00:01:25.565 --> 00:01:28.525
<00:01:25.565>of <00:01:25.692>my <00:01:25.819>advice <00:01:25.946>here <00:01:26.074>in <00:01:26.201>this <00:01:26.328>tool <00:01:26.455>can <00:01:26.583>be <00:01:26.710>used <00:01:26.837>in <00:01:26.965>playwright

30
00:01:28.525 --> 00:01:30.845
<00:01:28.525>test <00:01:28.758>cafe <00:01:28.991>or <00:01:29.225>selenium <00:01:29.458>if <00:01:29.691>you <00:01:29.925>are

31
00:01:31.515 --> 00:01:33.085
<00:01:31.515>confident <00:01:31.865>enough <00:01:32.215>to <00:01:32.565>use <00:01:32.915>selenium.

32
00:01:33.305 --> 00:01:36.005
<00:01:33.305>But <00:01:33.480>I <00:01:33.655>try <00:01:33.830>to <00:01:34.005>be <00:01:34.180>as <00:01:34.355>agnostic <00:01:34.530>as <00:01:34.705>possible

33
00:01:36.945 --> 00:01:38.525
<00:01:36.945>and <00:01:37.145>I <00:01:37.345>hope <00:01:37.544>you <00:01:37.744>feel <00:01:37.945>this <00:01:38.145>little <00:01:38.345>pain.

34
00:01:38.585 --> 00:01:39.685
<00:01:38.585>No <00:01:38.915>offense <00:01:39.245>to <00:01:39.575>Selenium

35
00:01:39.745 --> 00:01:42.685
<00:01:39.745>but <00:01:39.920>well <00:01:40.095>there's <00:01:40.270>a <00:01:40.445>little <00:01:40.620>gr <00:01:40.795>little <00:01:40.970>curse <00:01:41.145>in

36
00:01:42.685 --> 00:01:43.805
<00:01:42.685>my <00:01:42.853>hat <00:01:43.021>when <00:01:43.189>it <00:01:43.357>comes <00:01:43.525>to <00:01:43.693>that.

37
00:01:45.045 --> 00:01:48.975
<00:01:45.045>Okay, <00:01:45.200>so <00:01:45.356>some <00:01:45.511>people <00:01:45.667>raise <00:01:45.822>their <00:01:45.978>hand <00:01:46.133>when <00:01:46.289>it <00:01:46.445>comes

38
00:01:48.975 --> 00:01:52.295
<00:01:48.975>to <00:01:49.208>my <00:01:49.441>small <00:01:49.675>reference <00:01:49.908>in <00:01:50.141>my <00:01:50.375>throat.

39
00:01:52.315 --> 00:01:53.975
<00:01:52.315>So <00:01:52.548>it's <00:01:52.781>called <00:01:53.015>plans <00:01:53.248>for <00:01:53.481>the <00:01:53.715>Thieves

40
00:01:54.435 --> 00:01:57.095
<00:01:54.435>and <00:01:54.590>it's <00:01:54.746>a <00:01:54.901>kind <00:01:55.057>not <00:01:55.212>to <00:01:55.368>plans <00:01:55.523>for <00:01:55.679>the <00:01:55.835>zombies.

41
00:01:57.845 --> 00:02:01.255
<00:01:57.845>This <00:01:58.020>was <00:01:58.195>a <00:01:58.370>game <00:01:58.545>I <00:01:58.720>guess <00:01:58.895>late <00:01:59.070>20,000 <00:01:59.245>years

42
00:02:01.315 --> 00:02:05.015
<00:02:01.315>or <00:02:01.490>29 <00:02:01.664>I <00:02:01.840>think <00:02:02.015>Game <00:02:02.190>by <00:02:02.365>PopCap <00:02:02.539>which <00:02:02.715>was

43
00:02:05.575 --> 00:02:06.615
<00:02:05.575>released <00:02:06.043>cross <00:02:06.511>platform.

44
00:02:06.615 --> 00:02:10.775
<00:02:06.615>It <00:02:06.742>was <00:02:06.869>actually <00:02:06.996>the <00:02:07.124>only <00:02:07.251>mobile <00:02:07.378>game <00:02:07.505>I <00:02:07.633>play <00:02:07.760>in <00:02:07.887>my <00:02:08.014>life.

45
00:02:10.775 --> 00:02:12.615
<00:02:10.775>Otherwise <00:02:11.008>I <00:02:11.241>go <00:02:11.475>for <00:02:11.708>PC <00:02:11.941>and <00:02:12.175>console

46
00:02:13.195 --> 00:02:14.775
<00:02:13.195>but <00:02:13.428>I <00:02:13.661>still <00:02:13.894>enjoy <00:02:14.128>that <00:02:14.361>a <00:02:14.595>lot.

47
00:02:15.195 --> 00:02:17.575
<00:02:15.195>It <00:02:15.370>is <00:02:15.545>a <00:02:15.720>power <00:02:15.894>defense <00:02:16.070>game <00:02:16.245>so <00:02:16.420>you <00:02:16.595>need

48
00:02:17.575 --> 00:02:20.135
<00:02:17.575>to <00:02:17.924>protect <00:02:18.274>something <00:02:18.625>against <00:02:18.975>intruders

49
00:02:20.995 --> 00:02:23.735
<00:02:20.995>and <00:02:21.195>yeah, <00:02:21.395>the <00:02:21.595>zombies <00:02:21.795>are <00:02:21.995>obviously <00:02:22.195>the <00:02:22.395>intruders

50
00:02:23.735 --> 00:02:26.295
<00:02:23.735>because <00:02:23.910>we <00:02:24.085>all <00:02:24.260>like <00:02:24.435>our <00:02:24.610>little <00:02:24.785>zombie <00:02:24.960>cocal <00:02:25.135>clips.

51
00:02:26.295 --> 00:02:28.615
<00:02:26.295>Of <00:02:26.528>course <00:02:26.761>in <00:02:26.995>this <00:02:27.228>case <00:02:27.461>we <00:02:27.695>want

52
00:02:28.615 --> 00:02:30.735
<00:02:28.615>to <00:02:28.848>protect <00:02:29.081>our <00:02:29.315>house <00:02:29.548>against <00:02:29.781>zombies <00:02:30.015>using

53
00:02:30.755 --> 00:02:33.135
<00:02:30.755>plants <00:02:31.221>like <00:02:31.688>tower <00:02:32.155>defense.

54
00:02:33.205 --> 00:02:35.655
<00:02:33.204>They <00:02:33.404>have <00:02:33.605>some <00:02:33.804>wonderful <00:02:34.005>powers <00:02:34.204>to <00:02:34.404>do <00:02:34.605>that.

55
00:02:36.635 --> 00:02:41.185
<00:02:36.635>And <00:02:36.868>yes, <00:02:37.101>well <00:02:37.334>I <00:02:37.568>could <00:02:37.801>understand <00:02:38.035>you

56
00:02:41.605 --> 00:02:44.945
<00:02:41.605>if <00:02:41.760>you're <00:02:41.916>wondering <00:02:42.071>like <00:02:42.227>why <00:02:42.382>do <00:02:42.538>I <00:02:42.693>nerd <00:02:42.849>around <00:02:43.005>plants

57
00:02:44.945 --> 00:02:48.465
<00:02:44.945>with <00:02:45.084>zombies, <00:02:45.225>but <00:02:45.364>this <00:02:45.505>this <00:02:45.644>have <00:02:45.785>to <00:02:45.924>do <00:02:46.065>with <00:02:46.204>web <00:02:46.345>development,

58
00:02:48.925 --> 00:02:50.185
<00:02:48.925>at <00:02:49.114>least <00:02:49.303>it's <00:02:49.492>web <00:02:49.681>in <00:02:49.870>my <00:02:50.059>case.

59
00:02:50.695 --> 00:02:54.825
<00:02:50.695>Well <00:02:50.850>what <00:02:51.006>if <00:02:51.161>I <00:02:51.317>told <00:02:51.472>you <00:02:51.628>again <00:02:51.783>of <00:02:51.939>course <00:02:52.095>if

60
00:02:54.855 --> 00:02:58.425
<00:02:54.855>that <00:02:55.010>it's <00:02:55.166>a <00:02:55.321>wonderful <00:02:55.477>leg <00:02:55.632>on <00:02:55.788>security <00:02:55.943>if <00:02:56.099>you <00:02:56.255>want

61
00:02:58.425 --> 00:03:00.965
<00:02:58.425>to <00:02:58.600>protect <00:02:58.775>something <00:02:58.950>precious, <00:02:59.125>may <00:02:59.300>it <00:02:59.475>be <00:02:59.650>a <00:02:59.825>house,

62
00:03:01.495 --> 00:03:04.925
<00:03:01.495>maybe <00:03:01.650>your <00:03:01.806>application, <00:03:01.961>the <00:03:02.117>data <00:03:02.272>of <00:03:02.428>your <00:03:02.583>customers <00:03:02.739>and <00:03:02.895>users

63
00:03:05.585 --> 00:03:07.805
<00:03:05.585>or <00:03:05.785>just <00:03:05.985>some <00:03:06.185>features <00:03:06.385>where <00:03:06.585>you <00:03:06.785>don't <00:03:06.985>like

64
00:03:07.825 --> 00:03:09.365
<00:03:07.825>to <00:03:08.055>have <00:03:08.287>people <00:03:08.518>use <00:03:08.749>them <00:03:08.980>for <00:03:09.211>free.

65
00:03:10.545 --> 00:03:13.585
<00:03:10.545>So <00:03:10.825>we <00:03:11.105>have <00:03:11.385>in <00:03:11.665>the <00:03:11.945>techer,

66
00:03:13.585 --> 00:03:15.665
<00:03:13.585>which <00:03:13.785>is <00:03:13.985>a <00:03:14.185>zombie, <00:03:14.385>could <00:03:14.585>be <00:03:14.785>a <00:03:14.985>threat.

67
00:03:17.075 --> 00:03:19.215
<00:03:17.075>And <00:03:17.355>we <00:03:17.635>have, <00:03:17.915>yeah, <00:03:18.195>the <00:03:18.475>attack

68
00:03:19.215 --> 00:03:20.655
<00:03:19.215>of <00:03:19.474>the <00:03:19.733>security <00:03:19.992>risk, <00:03:20.251>the <00:03:20.511>exploit.

69
00:03:20.675 --> 00:03:25.575
<00:03:20.675>And <00:03:20.830>we <00:03:20.986>have <00:03:21.141>a <00:03:21.297>plant <00:03:21.452>which <00:03:21.608>is <00:03:21.763>hopefully <00:03:21.919>protecting <00:03:22.075>us,

70
00:03:25.955 --> 00:03:28.215
<00:03:25.954>our <00:03:26.188>house, <00:03:26.421>our <00:03:26.654>application <00:03:26.888>against <00:03:27.121>the <00:03:27.355>threat.

71
00:03:28.555 --> 00:03:32.255
<00:03:28.555>And <00:03:28.695>I <00:03:28.835>dunno <00:03:28.975>why <00:03:29.115>it <00:03:29.255>stopped <00:03:29.395>one <00:03:29.535>moment. <00:03:29.675>There <00:03:29.815>we <00:03:29.955>go.

72
00:03:32.925 --> 00:03:33.975
<00:03:32.925>Wonderful <00:03:33.870>animation.

73
00:03:34.155 --> 00:03:35.215
<00:03:34.155>So <00:03:34.393>you <00:03:34.632>still <00:03:34.870>see <00:03:35.109>it,

74
00:03:35.235 --> 00:03:38.175
<00:03:35.235>the <00:03:35.410>plant <00:03:35.585>can <00:03:35.760>be <00:03:35.935>all <00:03:36.110>the <00:03:36.285>measures <00:03:36.460>we <00:03:36.635>have

75
00:03:39.245 --> 00:03:40.785
<00:03:39.245>to <00:03:39.938>secure <00:03:40.631>applications.

76
00:03:41.965 --> 00:03:46.345
<00:03:41.965>May <00:03:42.120>it <00:03:42.276>be <00:03:42.431>best <00:03:42.587>practices, <00:03:42.742>may <00:03:42.898>it <00:03:43.053>be <00:03:43.209>you <00:03:43.365>use,

77
00:03:46.525 --> 00:03:49.545
<00:03:46.525>may <00:03:46.665>it <00:03:46.805>be <00:03:46.945>clinical, <00:03:47.085>may <00:03:47.225>it <00:03:47.365>be <00:03:47.505>everything <00:03:47.645>you <00:03:47.785>know <00:03:47.925>on

78
00:03:49.575 --> 00:03:53.465
<00:03:49.575>what <00:03:49.714>not <00:03:49.855>to <00:03:49.994>do <00:03:50.135>when <00:03:50.274>it <00:03:50.415>comes <00:03:50.554>to <00:03:50.695>like <00:03:50.834>avoiding <00:03:50.975>injection,

79
00:03:53.745 --> 00:03:55.665
<00:03:53.745>avoiding <00:03:54.095>skin <00:03:54.445>injection, <00:03:54.795>cross <00:03:55.145>scripting,

80
00:03:55.665 --> 00:03:57.225
<00:03:55.665>all <00:03:55.898>those <00:03:56.131>threats <00:03:56.364>you <00:03:56.598>could <00:03:56.831>think <00:03:57.065>about.

81
00:03:57.845 --> 00:04:01.865
<00:03:57.845>So <00:03:58.000>actually <00:03:58.156>those <00:03:58.311>plants <00:03:58.467>are <00:03:58.622>our <00:03:58.778>counters <00:03:58.933>on <00:03:59.089>our <00:03:59.245>mitigation

82
00:04:01.865 --> 00:04:06.745
<00:04:01.865>strategies, <00:04:03.265>Right?

83
00:04:07.285 --> 00:04:11.425
<00:04:07.285>The <00:04:07.484>garden <00:04:07.685>we <00:04:07.885>have <00:04:08.085>is <00:04:08.285>like <00:04:08.484>our <00:04:08.685>defenses

84
00:04:11.425 --> 00:04:13.385
<00:04:11.425>as <00:04:11.600>set <00:04:11.775>the <00:04:11.950>plants <00:04:12.125>will <00:04:12.300>be <00:04:12.475>planted <00:04:12.650>into <00:04:12.825>it

85
00:04:15.295 --> 00:04:17.155
<00:04:15.295>and <00:04:15.494>the <00:04:15.695>house <00:04:15.894>will <00:04:16.094>be <00:04:16.294>the <00:04:16.495>protective <00:04:16.695>part.

86
00:04:18.955 --> 00:04:21.615
<00:04:18.954>So <00:04:19.234>let's <00:04:19.515>build <00:04:19.794>our <00:04:20.075>garden <00:04:20.354>together

87
00:04:22.435 --> 00:04:23.615
<00:04:22.435>in <00:04:22.647>the <00:04:22.859>real <00:04:23.072>realm <00:04:23.284>of <00:04:23.497>testing.

88
00:04:24.765 --> 00:04:27.575
<00:04:24.765>It's <00:04:24.940>not <00:04:25.115>the <00:04:25.289>best <00:04:25.465>practices <00:04:25.640>on <00:04:25.815>general <00:04:25.990>web <00:04:26.164>security.

89
00:04:27.845 --> 00:04:29.455
<00:04:27.845>I'll <00:04:28.045>have <00:04:28.245>a <00:04:28.445>virtual <00:04:28.645>talk <00:04:28.845>on <00:04:29.045>that <00:04:29.245>one.

90
00:04:29.515 --> 00:04:31.095
<00:04:29.515>So <00:04:29.715>if <00:04:29.914>you <00:04:30.115>are <00:04:30.315>interested <00:04:30.515>on <00:04:30.715>the <00:04:30.914>recording,

91
00:04:31.165 --> 00:04:32.735
<00:04:31.165>just <00:04:31.398>take <00:04:31.631>a <00:04:31.865>look <00:04:32.098>at <00:04:32.331>this <00:04:32.565>here.

92
00:04:32.785 --> 00:04:33.815
<00:04:32.784>We'll <00:04:33.094>go <00:04:33.402>to <00:04:33.712>testing.

93
00:04:34.115 --> 00:04:37.775
<00:04:34.115>So <00:04:34.315>our <00:04:34.515>plans, <00:04:34.715>our <00:04:34.915>testing <00:04:35.115>plans, <00:04:35.315>the <00:04:35.515>line

94
00:04:37.775 --> 00:04:39.535
<00:04:37.775>of <00:04:37.950>defense <00:04:38.125>we <00:04:38.299>want <00:04:38.474>to <00:04:38.650>take <00:04:38.825>a <00:04:39.000>look <00:04:39.174>at.

95
00:04:40.235 --> 00:04:45.195
<00:04:40.235>Can <00:04:40.515>contesting <00:04:40.795>help <00:04:41.075>us <00:04:41.355>so <00:04:41.635>well

96
00:04:45.985 --> 00:04:47.525
<00:04:45.985>the <00:04:46.331>honorable <00:04:46.678>mentioned <00:04:47.024>to <00:04:47.371>you,

97
00:04:47.765 --> 00:04:49.525
<00:04:47.765>security <00:04:47.965>best <00:04:48.164>practices <00:04:48.365>is <00:04:48.565>still <00:04:48.765>in <00:04:48.965>place <00:04:49.164>there.

98
00:04:49.525 --> 00:04:51.285
<00:04:49.525>So <00:04:49.758>learn <00:04:49.991>your <00:04:50.224>application, <00:04:50.458>learn <00:04:50.691>your <00:04:50.924>vulnerabilities

99
00:04:51.425 --> 00:04:54.365
<00:04:51.425>so <00:04:51.625>you <00:04:51.825>know <00:04:52.025>on <00:04:52.225>what <00:04:52.425>to <00:04:52.625>test <00:04:52.825>against.

100
00:04:55.355 --> 00:04:57.605
<00:04:55.355>What <00:04:55.510>do <00:04:55.666>I <00:04:55.821>need <00:04:55.977>to <00:04:56.132>write, <00:04:56.288>what <00:04:56.443>do <00:04:56.599>I <00:04:56.755>need

101
00:04:57.605 --> 00:04:59.965
<00:04:57.605>to <00:04:57.760>take <00:04:57.916>into <00:04:58.071>account <00:04:58.227>When <00:04:58.382>it <00:04:58.538>comes <00:04:58.693>to <00:04:58.849>test <00:04:59.005>animation,

102
00:05:01.485 --> 00:05:04.105
<00:05:01.485>you <00:05:01.640>need <00:05:01.796>to <00:05:01.951>have <00:05:02.107>the <00:05:02.262>cause <00:05:02.418>to <00:05:02.573>thread <00:05:02.729>at <00:05:02.885>hand

103
00:05:04.815 --> 00:05:07.385
<00:05:04.815>because <00:05:05.048>the <00:05:05.281>tests <00:05:05.515>are <00:05:05.748>always <00:05:05.981>the <00:05:06.215>messenger,

104
00:05:09.375 --> 00:05:10.915
<00:05:09.375>not <00:05:09.837>anymore <00:05:10.299>of <00:05:10.761>that.

105
00:05:11.015 --> 00:05:15.285
<00:05:11.015>So <00:05:11.248>let's <00:05:11.481>learn <00:05:11.715>about <00:05:11.948>it. <00:05:12.181>For <00:05:12.414>causes

106
00:05:15.625 --> 00:05:18.775
<00:05:15.625>of <00:05:15.975>the <00:05:16.325>most <00:05:16.675>like <00:05:17.025>common

107
00:05:18.875 --> 00:05:22.535
<00:05:18.875>or <00:05:19.015>the <00:05:19.155>most <00:05:19.295>dangerous <00:05:19.435>threats <00:05:19.575>in <00:05:19.715>security, <00:05:19.855>I <00:05:19.995>would <00:05:20.135>like <00:05:20.275>to

108
00:05:23.415 --> 00:05:25.535
<00:05:23.415>showcase <00:05:23.695>for <00:05:23.975>you <00:05:24.255>this <00:05:24.535>is <00:05:24.815>short

109
00:05:25.535 --> 00:05:27.815
<00:05:25.535>for <00:05:25.815>open <00:05:26.095>worldwide <00:05:26.375>application <00:05:26.655>security <00:05:26.935>project.

110
00:05:28.195 --> 00:05:31.935
<00:05:28.195>So <00:05:28.322>this <00:05:28.449>is <00:05:28.576>a <00:05:28.704>project <00:05:28.831>with <00:05:28.958>the <00:05:29.085>aim <00:05:29.213>of <00:05:29.340>raising <00:05:29.467>security <00:05:29.594>inside

111
00:05:31.935 --> 00:05:36.615
<00:05:31.935>of <00:05:32.051>the <00:05:32.168>web <00:05:32.285>and <00:05:32.401>I <00:05:32.518>guess <00:05:32.635>all <00:05:32.751>few <00:05:32.868>years <00:05:32.985>they <00:05:33.101>will <00:05:33.218>release <00:05:33.335>a

112
00:05:36.615 --> 00:05:38.815
<00:05:36.615>certain <00:05:36.895>ranking <00:05:37.175>on <00:05:37.455>the <00:05:37.735>most <00:05:38.015>common

113
00:05:38.955 --> 00:05:42.335
<00:05:38.955>or <00:05:39.110>the <00:05:39.266>most <00:05:39.421>dangerous <00:05:39.577>security <00:05:39.732>threats <00:05:39.888>you <00:05:40.043>might <00:05:40.199>take <00:05:40.354>into

114
00:05:42.335 --> 00:05:45.655
<00:05:42.335>account <00:05:42.490>when <00:05:42.646>it <00:05:42.801>comes <00:05:42.957>to <00:05:43.112>writing <00:05:43.268>tests, <00:05:43.423>helping <00:05:43.579>you <00:05:43.734>inside

115
00:05:45.655 --> 00:05:46.895
<00:05:45.655>of <00:05:46.027>your <00:05:46.399>security <00:05:46.770>defenses.

116
00:05:47.605 --> 00:05:49.375
<00:05:47.605>Same <00:05:47.885>with <00:05:48.165>like <00:05:48.445>the <00:05:48.725>normal <00:05:49.005>perspectives.

117
00:05:49.435 --> 00:05:52.135
<00:05:49.435>So <00:05:49.610>we'll <00:05:49.785>take <00:05:49.960>a <00:05:50.135>look <00:05:50.310>at <00:05:50.485>the <00:05:50.660>top <00:05:50.835>three.

118
00:05:55.635 --> 00:05:57.750
<00:05:55.635>The <00:05:55.868>first <00:05:56.101>one <00:05:56.335>is <00:05:56.568>broken <00:05:56.801>access <00:05:57.034>control.

119
00:05:58.675 --> 00:06:01.925
<00:05:58.675>This <00:05:59.025>is <00:05:59.375>primarily <00:05:59.725>targeting <00:06:00.075>authorization.

120
00:06:02.065 --> 00:06:04.525
<00:06:02.065>So <00:06:02.220>can <00:06:02.376>the <00:06:02.531>user <00:06:02.687>do <00:06:02.842>the <00:06:02.998>things <00:06:03.153>they <00:06:03.309>should <00:06:03.465>do

121
00:06:04.905 --> 00:06:06.045
<00:06:04.905>and <00:06:05.246>are <00:06:05.589>not <00:06:05.931>allowed

122
00:06:06.045 --> 00:06:08.285
<00:06:06.045>to <00:06:06.200>do <00:06:06.356>the <00:06:06.511>things <00:06:06.667>they <00:06:06.822>are <00:06:06.978>not <00:06:07.133>allowed <00:06:07.289>to <00:06:07.445>do?

123
00:06:08.675 --> 00:06:11.365
<00:06:08.675>Like <00:06:08.850>do <00:06:09.025>they <00:06:09.200>have <00:06:09.375>access <00:06:09.550>to <00:06:09.725>the <00:06:09.900>wrong <00:06:10.075>things?

124
00:06:11.625 --> 00:06:15.525
<00:06:11.625>Do <00:06:11.780>they <00:06:11.936>have <00:06:12.091>like <00:06:12.247>more <00:06:12.402>permissions <00:06:12.558>than <00:06:12.713>they <00:06:12.869>used <00:06:13.025>to

125
00:06:17.495 --> 00:06:18.905
<00:06:17.495>cryptographic <00:06:18.763>failures.

126
00:06:19.205 --> 00:06:21.225
<00:06:19.205>So <00:06:19.555>is <00:06:19.905>your <00:06:20.255>page <00:06:20.604>encrypted?

127
00:06:21.365 --> 00:06:24.825
<00:06:21.365>Is <00:06:21.565>it <00:06:21.765>always <00:06:21.965>like <00:06:22.165>taking <00:06:22.365>this <00:06:22.565>into <00:06:22.765>account?

128
00:06:25.365 --> 00:06:27.785
<00:06:25.365>And <00:06:25.505>last <00:06:25.645>but <00:06:25.785>not <00:06:25.925>least, <00:06:26.065>I <00:06:26.205>guess <00:06:26.345>the <00:06:26.485>most <00:06:26.625>interesting <00:06:26.765>part

129
00:06:27.785 --> 00:06:29.785
<00:06:27.785>for <00:06:28.065>frontend <00:06:28.345>developers, <00:06:28.625>the <00:06:28.905>injection <00:06:29.185>part.

130
00:06:29.885 --> 00:06:33.865
<00:06:29.885>So <00:06:30.025>is <00:06:30.164>it <00:06:30.305>possible <00:06:30.445>that <00:06:30.585>an <00:06:30.724>attacker <00:06:30.865>can <00:06:31.005>inject <00:06:31.145>some <00:06:31.284>code

131
00:06:34.125 --> 00:06:36.545
<00:06:34.125>so <00:06:34.358>it <00:06:34.591>will <00:06:34.825>be <00:06:35.058>compiled <00:06:35.291>and <00:06:35.525>interpreted

132
00:06:36.545 --> 00:06:38.585
<00:06:36.545>and <00:06:36.825>executed <00:06:37.105>like <00:06:37.385>my <00:06:37.665>own <00:06:37.945>code?

133
00:06:40.085 --> 00:06:43.735
<00:06:40.085>Okay, <00:06:40.260>so <00:06:40.435>what <00:06:40.609>is <00:06:40.784>the <00:06:40.960>first <00:06:41.135>line <00:06:41.310>of <00:06:41.484>defense

134
00:06:44.525 --> 00:06:46.415
<00:06:44.525>from <00:06:44.804>the <00:06:45.085>view <00:06:45.364>of <00:06:45.645>a <00:06:45.924>tester?

135
00:06:46.915 --> 00:06:49.775
<00:06:46.915>The <00:06:47.115>view <00:06:47.315>of <00:06:47.515>someone <00:06:47.715>who's <00:06:47.915>writing <00:06:48.115>automatic <00:06:48.315>tests,

136
00:06:49.775 --> 00:06:50.815
<00:06:49.775>especially <00:06:50.087>end <00:06:50.399>end <00:06:50.711>test.

137
00:06:51.795 --> 00:06:54.095
<00:06:51.795>And <00:06:52.028>this <00:06:52.261>can <00:06:52.495>be <00:06:52.728>your <00:06:52.961>test <00:06:53.195>cases.

138
00:06:55.205 --> 00:07:00.155
<00:06:55.205>You <00:06:55.344>can <00:06:55.484>utilize <00:06:55.625>your <00:06:55.765>test <00:06:55.905>cases <00:06:56.044>to <00:06:56.185>look <00:06:56.325>for <00:06:56.465>security <00:06:56.604>issues

139
00:07:00.575 --> 00:07:02.795
<00:07:00.575>or <00:07:00.854>for <00:07:01.135>points <00:07:01.414>in <00:07:01.695>your <00:07:01.974>application

140
00:07:02.795 --> 00:07:05.195
<00:07:02.795>where <00:07:03.145>something <00:07:03.495>could <00:07:03.845>come <00:07:04.195>on.

141
00:07:06.515 --> 00:07:09.055
<00:07:06.515>And <00:07:06.690>this <00:07:06.865>is <00:07:07.039>actually <00:07:07.215>interesting <00:07:07.390>for <00:07:07.565>all <00:07:07.740>the <00:07:07.914>things

142
00:07:09.565 --> 00:07:13.735
<00:07:09.565>depending <00:07:09.705>on <00:07:09.844>injection, <00:07:09.985>may <00:07:10.125>it <00:07:10.265>be <00:07:10.405>S <00:07:10.545>scripting <00:07:10.685>May <00:07:10.825>B, <00:07:10.965>CSRF

143
00:07:13.835 --> 00:07:15.735
<00:07:13.835>or <00:07:14.534>SKA <00:07:15.234>injection

144
00:07:16.825 --> 00:07:21.165
<00:07:16.825>and <00:07:17.000>those <00:07:17.175>attacks <00:07:17.349>are <00:07:17.525>not <00:07:17.700>too <00:07:17.875>difficult <00:07:18.050>to <00:07:18.224>reproduce

145
00:07:21.165 --> 00:07:23.005
<00:07:21.165>as <00:07:21.340>at <00:07:21.515>least <00:07:21.690>when <00:07:21.865>it <00:07:22.040>comes <00:07:22.215>to <00:07:22.390>component <00:07:22.565>tests

146
00:07:23.545 --> 00:07:24.565
<00:07:23.545>or <00:07:23.774>N <00:07:24.004>two <00:07:24.233>M <00:07:24.463>tests.

147
00:07:24.985 --> 00:07:27.405
<00:07:24.985>So <00:07:25.140>let's <00:07:25.296>take <00:07:25.451>at <00:07:25.607>some <00:07:25.762>test <00:07:25.918>cases <00:07:26.073>I <00:07:26.229>wrote <00:07:26.385>before.

148
00:07:28.815 --> 00:07:33.235
<00:07:28.815>So <00:07:29.015>this <00:07:29.215>is <00:07:29.415>a <00:07:29.615>simple <00:07:29.815>small <00:07:30.015>code <00:07:30.215>snippet

149
00:07:33.235 --> 00:07:36.275
<00:07:33.235>for <00:07:33.375>an <00:07:33.515>example <00:07:33.655>on <00:07:33.795>how <00:07:33.935>to <00:07:34.075>test <00:07:34.215>for <00:07:34.355>cross <00:07:34.495>side <00:07:34.635>scripting

150
00:07:36.295 --> 00:07:37.675
<00:07:36.295>or <00:07:36.709>an <00:07:37.123>excess <00:07:37.537>vulnerability.

151
00:07:38.665 --> 00:07:41.245
<00:07:38.665>And <00:07:38.805>in <00:07:38.945>it <00:07:39.085>you <00:07:39.225>do <00:07:39.365>the <00:07:39.505>same <00:07:39.645>as <00:07:39.785>you <00:07:39.925>would <00:07:40.065>like

152
00:07:41.265 --> 00:07:42.965
<00:07:41.265>to <00:07:41.544>take <00:07:41.825>a <00:07:42.104>look <00:07:42.385>at <00:07:42.664>it.

153
00:07:43.065 --> 00:07:47.185
<00:07:43.065>So <00:07:43.298>try <00:07:43.531>to <00:07:43.765>inject <00:07:43.998>D <00:07:44.231>script <00:07:44.465>which

154
00:07:47.885 --> 00:07:51.345
<00:07:47.885>my <00:07:48.012>fire <00:07:48.139>and <00:07:48.266>alert <00:07:48.394>this <00:07:48.521>case <00:07:48.648>it <00:07:48.775>doesn't <00:07:48.903>do <00:07:49.030>too <00:07:49.157>much <00:07:49.284>damage

155
00:07:51.445 --> 00:07:53.585
<00:07:51.445>but <00:07:51.620>of <00:07:51.795>course <00:07:51.969>an <00:07:52.145>attacker <00:07:52.320>might <00:07:52.495>do <00:07:52.670>other <00:07:52.844>things

156
00:07:54.405 --> 00:07:56.825
<00:07:54.405>and <00:07:54.604>take <00:07:54.804>a <00:07:55.005>look <00:07:55.205>how <00:07:55.405>your <00:07:55.604>application <00:07:55.804>will

157
00:07:56.835 --> 00:07:57.985
<00:07:56.835>react <00:07:57.093>inside <00:07:57.352>of <00:07:57.611>your <00:07:57.870>test.

158
00:07:58.205 --> 00:08:00.745
<00:07:58.205>So <00:07:58.438>this <00:07:58.671>is <00:07:58.905>really <00:07:59.138>simplifies <00:07:59.371>of <00:07:59.604>course.

159
00:08:00.765 --> 00:08:02.945
<00:08:00.765>So <00:08:01.044>it's <00:08:01.325>a <00:08:01.604>wonderful <00:08:01.885>like <00:08:02.164>slide

160
00:08:03.405 --> 00:08:06.265
<00:08:03.405>but <00:08:03.580>that <00:08:03.755>is <00:08:03.929>not <00:08:04.104>popping <00:08:04.280>up <00:08:04.455>at <00:08:04.630>some <00:08:04.804>point

161
00:08:06.265 --> 00:08:09.225
<00:08:06.265>that <00:08:06.420>you <00:08:06.576>don't <00:08:06.731>have <00:08:06.887>any <00:08:07.042>alert <00:08:07.198>coming <00:08:07.353>up <00:08:07.509>on <00:08:07.664>your

162
00:08:09.345 --> 00:08:10.585
<00:08:09.345>page, <00:08:09.717>stuff <00:08:10.089>like <00:08:10.461>that.

163
00:08:11.125 --> 00:08:15.475
<00:08:11.125>So <00:08:11.300>in <00:08:11.475>this <00:08:11.650>case <00:08:11.825>you <00:08:12.000>can <00:08:12.175>be <00:08:12.350>pretty <00:08:12.525>sure

164
00:08:15.585 --> 00:08:18.035
<00:08:15.585>that <00:08:15.818>your <00:08:16.051>application <00:08:16.284>is <00:08:16.518>escaping <00:08:16.751>the <00:08:16.984>script

165
00:08:18.455 --> 00:08:21.355
<00:08:18.455>or <00:08:18.688>like <00:08:18.921>rendering <00:08:19.155>unusable <00:08:19.388>in <00:08:19.621>another <00:08:19.854>way.

166
00:08:21.815 --> 00:08:24.635
<00:08:21.815>So <00:08:22.094>utilize <00:08:22.375>your <00:08:22.655>tasks, <00:08:22.935>maybe <00:08:23.215>go

167
00:08:24.635 --> 00:08:28.755
<00:08:24.635>for <00:08:24.762>a <00:08:24.889>little <00:08:25.016>sample <00:08:25.144>like <00:08:25.271>a <00:08:25.398>login <00:08:25.525>form <00:08:25.653>form <00:08:25.780>where <00:08:25.907>you <00:08:26.034>know

168
00:08:28.755 --> 00:08:30.075
<00:08:28.755>that <00:08:29.052>people <00:08:29.349>will <00:08:29.646>use <00:08:29.943>it

169
00:08:30.615 --> 00:08:33.395
<00:08:30.615>and <00:08:30.848>use <00:08:31.081>some <00:08:31.315>small <00:08:31.548>test <00:08:31.781>case <00:08:32.015>for

170
00:08:34.195 --> 00:08:35.835
<00:08:34.195>a <00:08:34.475>typical <00:08:34.755>drop <00:08:35.035>site <00:08:35.315>scripting <00:08:35.595>point.

171
00:08:39.345 --> 00:08:41.145
<00:08:39.345>I <00:08:39.545>said <00:08:39.745>we <00:08:39.945>will <00:08:40.145>imitate <00:08:40.345>the <00:08:40.545>attack <00:08:40.745>here.

172
00:08:44.435 --> 00:08:47.855
<00:08:44.435>So <00:08:44.574>another <00:08:44.714>point <00:08:44.854>we <00:08:44.994>could <00:08:45.135>take <00:08:45.275>a <00:08:45.415>look <00:08:45.555>at <00:08:45.694>is <00:08:45.834>CSRF

173
00:08:47.855 --> 00:08:51.015
<00:08:47.855>vulnerabilities <00:08:48.205>and <00:08:48.555>I <00:08:48.905>do <00:08:49.255>like

174
00:08:51.035 --> 00:08:55.365
<00:08:51.035>to <00:08:51.175>utilize <00:08:51.314>cypress <00:08:51.454>API <00:08:51.594>features <00:08:51.735>for <00:08:51.875>that <00:08:52.015>which <00:08:52.155>you <00:08:52.295>can <00:08:52.435>do

175
00:08:55.365 --> 00:08:58.565
<00:08:55.365>for <00:08:55.540>most <00:08:55.715>of <00:08:55.890>injection <00:08:56.065>thing <00:08:56.240>for <00:08:56.415>your <00:08:56.590>SQ <00:08:56.765>injection

176
00:08:58.625 --> 00:08:59.925
<00:08:58.625>for <00:08:58.819>example, <00:08:59.015>you <00:08:59.210>can <00:08:59.405>do <00:08:59.599>the <00:08:59.795>same.

177
00:09:00.385 --> 00:09:05.245
<00:09:00.385>So <00:09:00.560>fire <00:09:00.735>request <00:09:00.910>this <00:09:01.085>case, <00:09:01.260>try <00:09:01.435>to <00:09:01.610>do <00:09:01.785>something

178
00:09:06.215 --> 00:09:07.645
<00:09:06.215>which <00:09:06.472>is <00:09:06.729>forbidden <00:09:06.987>for <00:09:07.244>the <00:09:07.502>user

179
00:09:07.985 --> 00:09:09.845
<00:09:07.985>and <00:09:08.185>take <00:09:08.385>a <00:09:08.585>look <00:09:08.785>if <00:09:08.985>your <00:09:09.185>API <00:09:09.385>is

180
00:09:10.805 --> 00:09:13.785
<00:09:10.805>reacting <00:09:11.084>the <00:09:11.364>way <00:09:11.645>it <00:09:11.925>should <00:09:12.204>be.

181
00:09:14.685 --> 00:09:17.305
<00:09:14.685>So <00:09:14.885>like <00:09:15.084>going <00:09:15.285>for <00:09:15.484>permission <00:09:15.685>denied <00:09:15.885>status <00:09:16.084>code

182
00:09:17.325 --> 00:09:21.345
<00:09:17.325>or <00:09:17.480>whatever <00:09:17.636>your <00:09:17.791>project <00:09:17.947>is <00:09:18.102>meant <00:09:18.258>to <00:09:18.413>do <00:09:18.569>in <00:09:18.725>case

183
00:09:21.405 --> 00:09:23.345
<00:09:21.405>of <00:09:21.605>a <00:09:21.805>user <00:09:22.005>doing <00:09:22.204>things <00:09:22.405>which <00:09:22.605>they <00:09:22.805>are

184
00:09:23.345 --> 00:09:24.465
<00:09:23.345>basically <00:09:23.597>for <00:09:23.849>them <00:09:24.101>to <00:09:24.353>do.

185
00:09:26.405 --> 00:09:29.315
<00:09:26.405>Again <00:09:26.605>a <00:09:26.805>small <00:09:27.005>test <00:09:27.204>case <00:09:27.405>in <00:09:27.605>API <00:09:27.805>testing

186
00:09:29.505 --> 00:09:30.715
<00:09:29.505>with <00:09:29.777>an <00:09:30.049>end-to-end <00:09:30.321>testing <00:09:30.594>tool.

187
00:09:30.715 --> 00:09:33.835
<00:09:30.715>Of <00:09:30.842>course <00:09:30.969>you <00:09:31.096>can <00:09:31.224>do <00:09:31.351>it <00:09:31.478>for <00:09:31.605>integration <00:09:31.733>or <00:09:31.860>unit <00:09:31.987>testing <00:09:32.115>too.

188
00:09:34.145 --> 00:09:35.195
<00:09:34.145>Depends <00:09:34.460>on <00:09:34.775>your <00:09:35.090>tool.

189
00:09:38.705 --> 00:09:42.845
<00:09:38.705>You <00:09:38.860>can <00:09:39.016>use <00:09:39.171>similar <00:09:39.327>PI <00:09:39.482>testing <00:09:39.638>for <00:09:39.793>SK <00:09:39.949>injection <00:09:40.105>two,

190
00:09:43.005 --> 00:09:45.485
<00:09:43.005>I <00:09:43.285>use <00:09:43.564>a <00:09:43.845>click <00:09:44.125>example <00:09:44.405>here

191
00:09:45.485 --> 00:09:47.725
<00:09:45.485>but <00:09:45.625>you <00:09:45.765>can <00:09:45.905>do <00:09:46.045>basically <00:09:46.185>the <00:09:46.325>same <00:09:46.465>for <00:09:46.605>cypress <00:09:46.745>request <00:09:46.885>too.

192
00:09:47.725 --> 00:09:52.445
<00:09:47.725>So <00:09:47.865>like <00:09:48.005>adding <00:09:48.145>a <00:09:48.285>smoke <00:09:48.425>query <00:09:48.565>we <00:09:48.705>inside <00:09:48.845>of <00:09:48.985>the <00:09:49.125>parameters

193
00:09:52.445 --> 00:09:54.325
<00:09:52.445>for <00:09:52.725>example <00:09:53.005>and <00:09:53.285>take <00:09:53.565>a <00:09:53.845>look

194
00:09:55.255 --> 00:09:57.545
<00:09:55.255>what <00:09:55.455>the <00:09:55.655>application <00:09:55.855>is <00:09:56.055>doing <00:09:56.255>again <00:09:56.455>right <00:09:56.655>now.

195
00:09:57.805 --> 00:10:01.425
<00:09:57.805>So <00:09:57.912>if <00:09:58.020>the <00:09:58.128>test <00:09:58.235>here <00:09:58.343>is <00:09:58.451>visiting <00:09:58.558>A <00:09:58.666>URL <00:09:58.774>with <00:09:58.881>a <00:09:58.989>query <00:09:59.097>inside <00:09:59.204>it

196
00:10:02.005 --> 00:10:04.945
<00:10:02.005>and <00:10:02.180>we'll <00:10:02.355>assert <00:10:02.530>that <00:10:02.705>there's <00:10:02.880>no <00:10:03.055>error <00:10:03.230>coming <00:10:03.405>up.

197
00:10:05.045 --> 00:10:08.265
<00:10:05.045>So <00:10:05.185>this <00:10:05.324>grade <00:10:05.464>will <00:10:05.604>not <00:10:05.745>be <00:10:05.885>applied <00:10:06.025>to <00:10:06.165>anything <00:10:06.305>or <00:10:06.444>compiled

198
00:10:08.265 --> 00:10:11.505
<00:10:08.265>or <00:10:08.405>used <00:10:08.545>in <00:10:08.685>any <00:10:08.824>case <00:10:08.965>escape <00:10:09.105>the <00:10:09.245>way <00:10:09.385>we <00:10:09.525>need <00:10:09.665>to.

199
00:10:12.305 --> 00:10:17.145
<00:10:12.305>So <00:10:12.538>nothing <00:10:12.771>should <00:10:13.005>happen. <00:10:13.238>And <00:10:13.471>another <00:10:13.704>example

200
00:10:17.145 --> 00:10:21.915
<00:10:17.145>which <00:10:17.285>I <00:10:17.425>like <00:10:17.564>to <00:10:17.704>show <00:10:17.845>to <00:10:17.985>you <00:10:18.125>is <00:10:18.265>the <00:10:18.405>um <00:10:18.545>content,

201
00:10:22.215 --> 00:10:24.755
<00:10:22.215>uh, <00:10:22.681>like <00:10:23.148>CSP <00:10:23.615>example.

202
00:10:25.145 --> 00:10:27.515
<00:10:25.145>This <00:10:25.285>is <00:10:25.425>a <00:10:25.564>wonderful <00:10:25.704>uh, <00:10:25.845>take <00:10:25.985>from <00:10:26.125>a <00:10:26.265>blog <00:10:26.405>post <00:10:26.545>by

203
00:10:27.515 --> 00:10:29.235
<00:10:27.515>by <00:10:27.748>ov <00:10:27.981>which <00:10:28.215>is <00:10:28.448>actually <00:10:28.681>pretty <00:10:28.915>nice.

204
00:10:29.255 --> 00:10:31.955
<00:10:29.255>So <00:10:29.362>if <00:10:29.470>you <00:10:29.578>want <00:10:29.685>to <00:10:29.793>take <00:10:29.901>a <00:10:30.008>look <00:10:30.116>at <00:10:30.224>it <00:10:30.331>in <00:10:30.439>detail, <00:10:30.547>which <00:10:30.655>I

205
00:10:32.495 --> 00:10:34.955
<00:10:32.495>am <00:10:32.650>not <00:10:32.806>able <00:10:32.961>to <00:10:33.117>do <00:10:33.272>inside <00:10:33.428>of <00:10:33.583>this <00:10:33.739>little <00:10:33.895>timeframe,

206
00:10:35.645 --> 00:10:37.615
<00:10:35.645>take <00:10:35.878>a <00:10:36.111>look <00:10:36.345>at <00:10:36.578>this <00:10:36.811>in <00:10:37.045>like

207
00:10:38.675 --> 00:10:42.695
<00:10:38.675>as <00:10:38.802>a <00:10:38.929>little <00:10:39.056>overview <00:10:39.184>in <00:10:39.311>it <00:10:39.438>we <00:10:39.565>will <00:10:39.693>um, <00:10:39.820>check <00:10:39.947>for <00:10:40.074>Facebooking

208
00:10:42.695 --> 00:10:45.095
<00:10:42.695>and <00:10:42.895>the <00:10:43.095>content <00:10:43.295>security <00:10:43.495>policy <00:10:43.695>head <00:10:43.895>of <00:10:44.095>violations

209
00:10:46.485 --> 00:10:49.885
<00:10:46.485>by <00:10:46.660>like <00:10:46.835>define <00:10:47.010>yeah <00:10:47.185>you <00:10:47.360>can <00:10:47.535>see <00:10:47.710>it <00:10:47.885>here

210
00:10:51.265 --> 00:10:53.805
<00:10:51.265>if <00:10:51.420>we <00:10:51.576>want <00:10:51.731>to <00:10:51.887>utilize <00:10:52.042>cypress <00:10:52.198>for <00:10:52.353>it, <00:10:52.509>we <00:10:52.665>need

211
00:10:53.805 --> 00:10:58.085
<00:10:53.805>to <00:10:53.979>yeah <00:10:54.155>change <00:10:54.329>the <00:10:54.505>um <00:10:54.680>configuration <00:10:54.854>a <00:10:55.030>little <00:10:55.204>bit

212
00:10:58.265 --> 00:11:00.725
<00:10:58.265>to <00:10:58.545>allow <00:10:58.824>experimental <00:10:59.105>CSP <00:10:59.385>allow <00:10:59.665>list.

213
00:11:01.185 --> 00:11:05.685
<00:11:01.185>So <00:11:01.301>we <00:11:01.418>are <00:11:01.535>able <00:11:01.651>to <00:11:01.768>check <00:11:01.885>for <00:11:02.001>this <00:11:02.118>pattern <00:11:02.234>our <00:11:02.351>cypress <00:11:02.468>test <00:11:02.584>so

214
00:11:05.685 --> 00:11:09.425
<00:11:05.685>that <00:11:05.859>like <00:11:06.035>the <00:11:06.209>CSP <00:11:06.385>Hader <00:11:06.560>for <00:11:06.734>defining <00:11:06.910>FT <00:11:07.084>sources

215
00:11:09.565 --> 00:11:12.225
<00:11:09.565>for <00:11:09.765>content <00:11:09.965>allowed <00:11:10.165>to <00:11:10.365>load <00:11:10.565>is <00:11:10.765>set <00:11:10.965>correctly.

216
00:11:12.645 --> 00:11:14.825
<00:11:12.645>So <00:11:13.111>some <00:11:13.578>small <00:11:14.045>configuration

217
00:11:15.795 --> 00:11:19.175
<00:11:15.795>and <00:11:15.969>afterwards <00:11:16.145>our <00:11:16.319>little <00:11:16.495>test <00:11:16.670>case <00:11:16.844>where <00:11:17.020>you <00:11:17.194>see

218
00:11:19.525 --> 00:11:23.415
<00:11:19.525>that <00:11:19.641>we <00:11:19.758>will <00:11:19.875>take <00:11:19.991>a <00:11:20.108>look <00:11:20.225>at <00:11:20.341>the <00:11:20.458>header <00:11:20.574>when <00:11:20.691>doing <00:11:20.808>a <00:11:20.925>request,

219
00:11:24.235 --> 00:11:26.495
<00:11:24.235>it <00:11:24.435>should <00:11:24.635>have <00:11:24.835>the <00:11:25.035>property <00:11:25.235>content <00:11:25.435>security <00:11:25.635>policy

220
00:11:27.675 --> 00:11:30.415
<00:11:27.675>and <00:11:28.025>include <00:11:28.375>the <00:11:28.724>right <00:11:29.074>point.

221
00:11:30.675 --> 00:11:31.895
<00:11:30.675>So <00:11:30.949>see <00:11:31.223>if <00:11:31.498>it's <00:11:31.773>set

222
00:11:33.845 --> 00:11:35.425
<00:11:33.845>and <00:11:34.078>this <00:11:34.311>way <00:11:34.545>you're <00:11:34.778>able <00:11:35.011>to <00:11:35.245>check

223
00:11:35.445 --> 00:11:37.425
<00:11:35.445>for <00:11:35.725>those <00:11:36.005>content <00:11:36.285>security <00:11:36.565>policy <00:11:36.845>headers.

224
00:11:40.495 --> 00:11:44.965
<00:11:40.495>Yeah <00:11:40.695>you <00:11:40.895>can <00:11:41.095>intercept <00:11:41.295>it <00:11:41.495>in <00:11:41.695>a <00:11:41.895>typical

225
00:11:45.425 --> 00:11:46.965
<00:11:45.425>use <00:11:45.622>case <00:11:45.821>for <00:11:46.019>a <00:11:46.217>test <00:11:46.415>where <00:11:46.613>you <00:11:46.811>click

226
00:11:46.965 --> 00:11:49.205
<00:11:46.965>through <00:11:47.120>the <00:11:47.276>application <00:11:47.431>if <00:11:47.587>you <00:11:47.742>don't <00:11:47.898>do <00:11:48.053>API <00:11:48.209>testing <00:11:48.365>queue,

227
00:11:49.225 --> 00:11:52.925
<00:11:49.225>so <00:11:49.380>like <00:11:49.536>intercepting <00:11:49.691>request <00:11:49.847>which <00:11:50.002>has <00:11:50.158>the <00:11:50.313>header <00:11:50.469>in <00:11:50.625>it

228
00:11:53.665 --> 00:11:57.315
<00:11:53.665>and <00:11:53.898>then <00:11:54.131>yeah <00:11:54.365>see <00:11:54.598>if <00:11:54.831>it's <00:11:55.064>blocked.

229
00:11:59.655 --> 00:12:04.045
<00:11:59.655>Okay, <00:11:59.888>so <00:12:00.121>far <00:12:00.355>for <00:12:00.588>um, <00:12:00.821>injection <00:12:01.055>content,

230
00:12:04.345 --> 00:12:06.845
<00:12:04.345>how <00:12:04.545>can <00:12:04.745>I <00:12:04.945>test <00:12:05.145>for <00:12:05.345>broken <00:12:05.545>access <00:12:05.745>control?

231
00:12:08.135 --> 00:12:09.955
<00:12:08.135>And <00:12:08.368>this <00:12:08.601>sounds <00:12:08.835>a <00:12:09.068>little <00:12:09.301>too <00:12:09.535>simple

232
00:12:10.015 --> 00:12:12.155
<00:12:10.015>but <00:12:10.215>it's <00:12:10.415>still <00:12:10.615>useful <00:12:10.814>when <00:12:11.015>it <00:12:11.215>comes <00:12:11.415>to

233
00:12:12.745 --> 00:12:14.515
<00:12:12.745>testing <00:12:13.025>especially <00:12:13.305>in <00:12:13.585>the <00:12:13.865>real <00:12:14.145>real

234
00:12:14.515 --> 00:12:16.515
<00:12:14.515>of <00:12:14.748>enter <00:12:14.981>end <00:12:15.215>test <00:12:15.448>cover <00:12:15.681>your <00:12:15.915>login

235
00:12:16.735 --> 00:12:20.315
<00:12:16.735>or <00:12:16.968>the <00:12:17.201>authentication <00:12:17.435>APIs <00:12:17.668>by <00:12:17.901>API <00:12:18.135>testing

236
00:12:20.895 --> 00:12:22.395
<00:12:20.895>by <00:12:21.345>a <00:12:21.795>certain <00:12:22.245>test.

237
00:12:22.465 --> 00:12:23.755
<00:12:22.465>Yeah <00:12:22.852>the <00:12:23.239>typical <00:12:23.626>login

238
00:12:24.095 --> 00:12:26.755
<00:12:24.095>and <00:12:24.222>you <00:12:24.349>could <00:12:24.476>ask <00:12:24.604>myself <00:12:24.731>so <00:12:24.858>like <00:12:24.985>okay <00:12:25.113>why <00:12:25.240>should <00:12:25.367>I <00:12:25.495>test

239
00:12:26.755 --> 00:12:29.315
<00:12:26.755>for <00:12:26.910>login <00:12:27.066>because <00:12:27.221>I'm <00:12:27.377>doing <00:12:27.532>it <00:12:27.688>like <00:12:27.843>all <00:12:27.999>the <00:12:28.155>time.

240
00:12:30.815 --> 00:12:33.075
<00:12:30.815>Well <00:12:31.281>you <00:12:31.748>still <00:12:32.215>need

241
00:12:33.075 --> 00:12:36.435
<00:12:33.075>to <00:12:33.215>have <00:12:33.355>it <00:12:33.495>itemized <00:12:33.635>especially <00:12:33.775>if <00:12:33.915>you <00:12:34.055>have <00:12:34.195>a <00:12:34.335>like <00:12:34.475>small

242
00:12:36.455 --> 00:12:38.915
<00:12:36.455>change, <00:12:36.655>you <00:12:36.855>push <00:12:37.055>it <00:12:37.255>to <00:12:37.455>your <00:12:37.655>full <00:12:37.855>request

243
00:12:39.175 --> 00:12:40.955
<00:12:39.175>and <00:12:39.454>you're <00:12:39.734>not <00:12:40.015>expecting <00:12:40.295>side <00:12:40.574>effects.

244
00:12:42.175 --> 00:12:44.545
<00:12:42.175>Yeah, <00:12:42.314>in <00:12:42.454>this <00:12:42.594>case <00:12:42.734>you'll <00:12:42.875>not <00:12:43.015>take <00:12:43.155>a <00:12:43.295>look <00:12:43.435>at <00:12:43.574>login

245
00:12:44.725 --> 00:12:48.185
<00:12:44.725>so <00:12:44.852>please <00:12:44.979>cover <00:12:45.106>it <00:12:45.234>please <00:12:45.361>see <00:12:45.488>if <00:12:45.615>people <00:12:45.743>can <00:12:45.870>like <00:12:45.997>reach <00:12:46.125>your

246
00:12:48.185 --> 00:12:49.665
<00:12:48.185>page <00:12:48.517>without <00:12:48.851>being <00:12:49.184>locked <00:12:49.516>in.

247
00:12:49.895 --> 00:12:53.185
<00:12:49.895>Include <00:12:50.128>negative <00:12:50.361>tasks <00:12:50.595>if <00:12:50.828>they <00:12:51.061>are <00:12:51.295>like

248
00:12:53.565 --> 00:12:57.705
<00:12:53.565>as <00:12:53.692>I'm <00:12:53.819>doing <00:12:53.946>here <00:12:54.074>being <00:12:54.201>like <00:12:54.328>bounced <00:12:54.455>off <00:12:54.583>if <00:12:54.710>they <00:12:54.837>are <00:12:54.965>using

249
00:12:57.895 --> 00:13:00.745
<00:12:57.895>invalid <00:12:58.095>credentials <00:12:58.295>so <00:12:58.495>you <00:12:58.694>don't <00:12:58.895>break <00:12:59.095>it <00:12:59.295>by

250
00:13:01.345 --> 00:13:04.895
<00:13:01.345>accident <00:13:01.625>actually <00:13:01.905>you <00:13:02.185>could <00:13:02.465>rush <00:13:02.745>out

251
00:13:04.915 --> 00:13:07.895
<00:13:04.915>for <00:13:05.115>permission <00:13:05.314>nights <00:13:05.515>status <00:13:05.714>quo <00:13:05.915>for <00:13:06.115>example <00:13:06.314>too.

252
00:13:07.985 --> 00:13:10.775
<00:13:07.985>There <00:13:08.112>are <00:13:08.239>a <00:13:08.366>couple <00:13:08.494>of <00:13:08.621>ways <00:13:08.748>on <00:13:08.875>how <00:13:09.003>to <00:13:09.130>utilize <00:13:09.257>those <00:13:09.385>tests.

253
00:13:13.225 --> 00:13:16.475
<00:13:13.225>Last <00:13:13.425>but <00:13:13.625>not <00:13:13.825>least, <00:13:14.025>there <00:13:14.225>is <00:13:14.425>cryptographic <00:13:14.625>failures.

254
00:13:17.095 --> 00:13:20.955
<00:13:17.095>So <00:13:17.250>how <00:13:17.406>can <00:13:17.561>I <00:13:17.717>see <00:13:17.872>if <00:13:18.028>my <00:13:18.183>page <00:13:18.339>is <00:13:18.495>completely

255
00:13:21.345 --> 00:13:22.835
<00:13:21.345>encrypted <00:13:21.613>the <00:13:21.881>way <00:13:22.149>it <00:13:22.417>should <00:13:22.686>be?

256
00:13:22.835 --> 00:13:25.475
<00:13:22.835>Like <00:13:23.068>I <00:13:23.301>have <00:13:23.535>a <00:13:23.768>proper <00:13:24.001>SSLS <00:13:24.235>certificate

257
00:13:25.475 --> 00:13:26.795
<00:13:25.475>and <00:13:25.644>it's <00:13:25.814>working <00:13:25.984>the <00:13:26.153>way <00:13:26.323>we <00:13:26.493>need <00:13:26.663>to.

258
00:13:27.375 --> 00:13:30.635
<00:13:27.375>And <00:13:27.515>when <00:13:27.655>it <00:13:27.795>comes <00:13:27.935>to <00:13:28.075>Cyprus <00:13:28.215>you <00:13:28.355>don't <00:13:28.495>need <00:13:28.635>to <00:13:28.775>do

259
00:13:30.705 --> 00:13:31.795
<00:13:30.705>that <00:13:31.195>much <00:13:31.685>actually

260
00:13:31.795 --> 00:13:36.135
<00:13:31.795>because <00:13:31.995>there's <00:13:32.194>an <00:13:32.395>in <00:13:32.594>embed <00:13:32.795>functionality <00:13:32.995>in <00:13:33.194>Cyprus.

261
00:13:36.235 --> 00:13:39.255
<00:13:36.235>If <00:13:36.435>you <00:13:36.635>use <00:13:36.835>Cyprus <00:13:37.035>for <00:13:37.235>NN <00:13:37.435>testing, <00:13:37.635>it'll

262
00:13:39.915 --> 00:13:42.735
<00:13:39.915>for <00:13:40.089>an <00:13:40.265>error <00:13:40.439>anytime <00:13:40.615>you <00:13:40.790>attempt <00:13:40.964>to <00:13:41.140>navigate <00:13:41.314>that

263
00:13:42.795 --> 00:13:44.655
<00:13:42.795>to <00:13:43.145>a <00:13:43.495>simple <00:13:43.844>HCPP <00:13:44.194>site.

264
00:13:44.715 --> 00:13:48.375
<00:13:44.715>So <00:13:44.855>if <00:13:44.995>the <00:13:45.135>encryption <00:13:45.275>is <00:13:45.415>not <00:13:45.555>properly <00:13:45.695>done <00:13:45.835>you <00:13:45.975>will <00:13:46.115>know.

265
00:13:51.605 --> 00:13:55.885
<00:13:51.605>And <00:13:51.805>this <00:13:52.005>way <00:13:52.205>we <00:13:52.405>have <00:13:52.605>wonderful <00:13:52.805>test <00:13:53.005>cases

266
00:13:56.585 --> 00:13:59.405
<00:13:56.585>but <00:13:56.760>now <00:13:56.935>of <00:13:57.110>course <00:13:57.285>you <00:13:57.460>could <00:13:57.635>complain <00:13:57.810>like <00:13:57.985>Ramona

267
00:14:00.405 --> 00:14:02.745
<00:14:00.405>in <00:14:00.579>this <00:14:00.755>case <00:14:00.930>I <00:14:01.105>will <00:14:01.280>need <00:14:01.454>to <00:14:01.630>be <00:14:01.805>aware

268
00:14:02.745 --> 00:14:05.185
<00:14:02.745>that <00:14:02.978>there <00:14:03.211>might <00:14:03.445>be <00:14:03.678>security <00:14:03.911>risk, <00:14:04.145>right?

269
00:14:05.425 --> 00:14:10.305
<00:14:05.425>I <00:14:05.552>can <00:14:05.679>only <00:14:05.806>tackle <00:14:05.934>samples, <00:14:06.061>I <00:14:06.188>cannot <00:14:06.315>go <00:14:06.443>for <00:14:06.570>all <00:14:06.697>input <00:14:06.824>fields

270
00:14:10.365 --> 00:14:12.745
<00:14:10.365>for <00:14:10.565>example <00:14:10.765>to <00:14:10.965>take <00:14:11.165>a <00:14:11.365>look <00:14:11.565>if <00:14:11.765>there's

271
00:14:13.265 --> 00:14:14.705
<00:14:13.265>possible <00:14:13.697>cross <00:14:14.129>scripting <00:14:14.561>issue.

272
00:14:15.375 --> 00:14:18.865
<00:14:15.375>Well <00:14:15.550>yeah <00:14:15.725>there <00:14:15.900>are <00:14:16.075>tools <00:14:16.250>you <00:14:16.425>can <00:14:16.600>help <00:14:16.775>you

273
00:14:18.925 --> 00:14:21.305
<00:14:18.925>and <00:14:19.099>yes <00:14:19.275>I <00:14:19.449>will <00:14:19.625>mention <00:14:19.800>them <00:14:19.974>in <00:14:20.150>this <00:14:20.324>case

274
00:14:21.305 --> 00:14:23.905
<00:14:21.305>because <00:14:21.479>of <00:14:21.655>course <00:14:21.829>things <00:14:22.005>you <00:14:22.180>don't <00:14:22.354>know <00:14:22.530>you <00:14:22.704>cannot

275
00:14:24.115 --> 00:14:25.225
<00:14:24.115>cover <00:14:24.614>it <00:14:25.114>also.

276
00:14:26.095 --> 00:14:31.005
<00:14:26.095>Yeah <00:14:26.445>I <00:14:26.795>will <00:14:27.145>mention <00:14:27.495>them

277
00:14:31.065 --> 00:14:32.325
<00:14:31.065>for <00:14:31.348>the <00:14:31.632>big <00:14:31.915>picture <00:14:32.199>here.

278
00:14:33.345 --> 00:14:37.065
<00:14:33.345>So <00:14:33.811>There's <00:14:34.278>some <00:14:34.745>recommendation

279
00:14:37.125 --> 00:14:38.945
<00:14:37.125>by <00:14:37.325>OVAs <00:14:37.525>you <00:14:37.725>could <00:14:37.925>take <00:14:38.125>a <00:14:38.325>look <00:14:38.525>at

280
00:14:39.335 --> 00:14:40.625
<00:14:39.335>when <00:14:39.567>it <00:14:39.799>comes <00:14:40.031>to <00:14:40.263>those <00:14:40.496>things.

281
00:14:41.045 --> 00:14:43.825
<00:14:41.045>For <00:14:41.245>example, <00:14:41.444>the <00:14:41.645>static <00:14:41.844>application <00:14:42.045>security <00:14:42.245>testing <00:14:42.444>stuff

282
00:14:44.035 --> 00:14:47.185
<00:14:44.035>which <00:14:44.190>is <00:14:44.346>often <00:14:44.501>already <00:14:44.657>built <00:14:44.812>in <00:14:44.968>inside <00:14:45.123>of <00:14:45.279>your <00:14:45.435>ID.

283
00:14:47.525 --> 00:14:49.785
<00:14:47.525>So <00:14:47.680>there's <00:14:47.836>some <00:14:47.991>highlighting <00:14:48.147>when <00:14:48.302>it <00:14:48.458>comes <00:14:48.613>to <00:14:48.769>those <00:14:48.925>things

284
00:14:50.445 --> 00:14:54.155
<00:14:50.445>or <00:14:50.585>you <00:14:50.725>could <00:14:50.865>take <00:14:51.005>a <00:14:51.145>look <00:14:51.285>at <00:14:51.425>GitHub <00:14:51.565>code <00:14:51.705>scanning <00:14:51.845>to

285
00:14:54.815 --> 00:14:56.435
<00:14:54.815>see <00:14:55.165>those <00:14:55.515>like <00:14:55.865>test <00:14:56.215>for

286
00:14:57.675 --> 00:15:00.075
<00:14:57.675>properly <00:14:57.849>new <00:14:58.025>security <00:14:58.199>issues <00:14:58.375>you're <00:14:58.550>not <00:14:58.724>aware <00:14:58.900>of, <00:14:59.074>right?

287
00:15:00.585 --> 00:15:04.715
<00:15:00.585>Programming. <00:15:00.935>Another <00:15:01.285>point <00:15:01.635>is <00:15:01.985>dynamics

288
00:15:04.715 --> 00:15:05.995
<00:15:04.715>application <00:15:05.291>security <00:15:05.867>testing.

289
00:15:06.175 --> 00:15:08.915
<00:15:06.175>So <00:15:06.349>those <00:15:06.525>are <00:15:06.699>all <00:15:06.875>the <00:15:07.050>scans <00:15:07.224>from <00:15:07.400>the <00:15:07.574>outside

290
00:15:09.525 --> 00:15:10.635
<00:15:09.525>might <00:15:10.024>be <00:15:10.524>automated

291
00:15:11.135 --> 00:15:13.715
<00:15:11.135>but <00:15:11.275>these <00:15:11.415>are <00:15:11.555>often <00:15:11.694>tools <00:15:11.835>you <00:15:11.975>might <00:15:12.115>need <00:15:12.255>to <00:15:12.395>pay <00:15:12.535>for

292
00:15:13.855 --> 00:15:15.155
<00:15:13.855>or <00:15:14.440>another <00:15:15.025>dependency.

293
00:15:18.705 --> 00:15:22.135
<00:15:18.705>Third <00:15:18.905>one <00:15:19.105>might <00:15:19.305>be <00:15:19.505>the <00:15:19.705>interactive <00:15:19.905>application <00:15:20.105>security

294
00:15:22.135 --> 00:15:24.455
<00:15:22.135>testing <00:15:22.415>tools <00:15:22.694>which <00:15:22.975>are <00:15:23.255>often <00:15:23.535>used

295
00:15:24.455 --> 00:15:26.575
<00:15:24.455>for <00:15:24.805>web <00:15:25.155>applications <00:15:25.505>or <00:15:25.855>APIs.

296
00:15:27.465 --> 00:15:31.155
<00:15:27.465>There's <00:15:27.640>for <00:15:27.815>example <00:15:27.990>a <00:15:28.165>contract <00:15:28.340>community <00:15:28.515>edition <00:15:28.690>which <00:15:28.865>OAS

297
00:15:31.215 --> 00:15:32.995
<00:15:31.215>is <00:15:31.448>recommended <00:15:31.681>to <00:15:31.915>take <00:15:32.148>a <00:15:32.381>look <00:15:32.615>at

298
00:15:33.455 --> 00:15:34.995
<00:15:33.455>but <00:15:33.732>most <00:15:34.009>are <00:15:34.286>paid <00:15:34.563>of <00:15:34.841>course.

299
00:15:35.455 --> 00:15:37.395
<00:15:35.455>And <00:15:35.688>last <00:15:35.921>but <00:15:36.155>not <00:15:36.388>least, <00:15:36.621>close <00:15:36.855>analysis.

300
00:15:38.335 --> 00:15:40.755
<00:15:38.335>You <00:15:38.510>could <00:15:38.685>take <00:15:38.860>a <00:15:39.035>look <00:15:39.210>at <00:15:39.385>tools <00:15:39.560>like <00:15:39.735>sonacube.

301
00:15:41.115 --> 00:15:42.595
<00:15:41.115>I <00:15:41.305>guess <00:15:41.495>they <00:15:41.685>have <00:15:41.876>a <00:15:42.066>booth <00:15:42.256>here <00:15:42.447>too,

302
00:15:43.095 --> 00:15:46.955
<00:15:43.095>but <00:15:43.270>other <00:15:43.445>like <00:15:43.620>status <00:15:43.795>analysis <00:15:43.970>to <00:15:44.145>take <00:15:44.320>a <00:15:44.495>look.

303
00:15:48.715 --> 00:15:51.605
<00:15:48.715>Yeah, <00:15:48.870>you <00:15:49.026>can <00:15:49.181>find <00:15:49.337>some <00:15:49.492>details <00:15:49.648>here <00:15:49.803>in <00:15:49.959>the <00:15:50.115>listing

304
00:15:51.785 --> 00:15:53.045
<00:15:51.785>by <00:15:52.163>the <00:15:52.540>OVAs <00:15:52.919>project

305
00:15:53.505 --> 00:15:56.005
<00:15:53.505>to <00:15:53.660>give <00:15:53.816>you <00:15:53.971>a <00:15:54.127>little <00:15:54.282>overview <00:15:54.438>for <00:15:54.593>the <00:15:54.749>full <00:15:54.905>picture.

306
00:15:57.825 --> 00:16:01.845
<00:15:57.825>And <00:15:57.965>last <00:15:58.105>but <00:15:58.245>not <00:15:58.385>least, <00:15:58.525>I <00:15:58.665>know <00:15:58.805>it's <00:15:58.945>not <00:15:59.085>completely <00:15:59.225>connected

307
00:16:01.845 --> 00:16:03.605
<00:16:01.845>to <00:16:02.045>testing <00:16:02.245>but <00:16:02.445>I <00:16:02.645>cannot <00:16:02.845>stress <00:16:03.045>it <00:16:03.245>enough.

308
00:16:03.605 --> 00:16:05.005
<00:16:03.605>Keep <00:16:03.857>your <00:16:04.109>dependencies <00:16:04.361>up <00:16:04.613>to <00:16:04.865>date.

309
00:16:05.225 --> 00:16:07.405
<00:16:05.225>So <00:16:05.505>if <00:16:05.785>depend <00:16:06.065>bot <00:16:06.345>is <00:16:06.625>complaining,

310
00:16:08.025 --> 00:16:09.605
<00:16:08.025>you <00:16:08.258>might <00:16:08.491>need <00:16:08.725>to <00:16:08.958>listen <00:16:09.191>to <00:16:09.425>it.

311
00:16:10.135 --> 00:16:13.605
<00:16:10.135>Don't <00:16:10.275>be <00:16:10.415>the <00:16:10.555>A <00:16:10.694>person <00:16:10.835>who <00:16:10.975>is <00:16:11.115>having <00:16:11.255>like <00:16:11.395>lots <00:16:11.535>of

312
00:16:14.395 --> 00:16:16.645
<00:16:14.395>full <00:16:14.595>requests <00:16:14.795>by <00:16:14.995>depend <00:16:15.194>bot <00:16:15.395>which <00:16:15.595>are <00:16:15.795>unanswered

313
00:16:16.825 --> 00:16:20.205
<00:16:16.825>or <00:16:17.105>like <00:16:17.385>big <00:16:17.665>warning <00:16:17.945>and <00:16:18.225>NPM.

314
00:16:20.225 --> 00:16:22.125
<00:16:20.225>So <00:16:20.425>like <00:16:20.625>lots <00:16:20.825>of <00:16:21.025>packages <00:16:21.225>are <00:16:21.425>not <00:16:21.625>up

315
00:16:22.125 --> 00:16:24.845
<00:16:22.125>to <00:16:22.325>date <00:16:22.525>use <00:16:22.725>NPM <00:16:22.925>order <00:16:23.125>use <00:16:23.325>depend <00:16:23.525>bot.

316
00:16:24.845 --> 00:16:27.645
<00:16:24.845>There <00:16:25.020>are <00:16:25.195>lots <00:16:25.370>of <00:16:25.545>ways <00:16:25.720>on <00:16:25.895>helping <00:16:26.070>you <00:16:26.245>having

317
00:16:28.375 --> 00:16:29.695
<00:16:28.375>dependencies <00:16:28.771>up <00:16:29.167>to <00:16:29.563>date.

318
00:16:31.225 --> 00:16:33.995
<00:16:31.225>Okay? <00:16:31.505>When <00:16:31.785>it <00:16:32.065>comes <00:16:32.345>to <00:16:32.625>Cyprus

319
00:16:34.055 --> 00:16:37.755
<00:16:34.055>and <00:16:34.194>you <00:16:34.334>use <00:16:34.474>used <00:16:34.614>to <00:16:34.755>look <00:16:34.895>for <00:16:35.035>some <00:16:35.175>examples <00:16:35.314>on <00:16:35.454>how

320
00:16:38.175 --> 00:16:41.235
<00:16:38.175>to <00:16:38.375>include <00:16:38.574>the <00:16:38.775>tools <00:16:38.974>by <00:16:39.175>OVAs <00:16:39.375>even <00:16:39.574>more.

321
00:16:41.495 --> 00:16:43.515
<00:16:41.495>You <00:16:41.622>could <00:16:41.749>take <00:16:41.876>a <00:16:42.004>look <00:16:42.131>at <00:16:42.258>this <00:16:42.385>one, <00:16:42.513>it's <00:16:42.640>open <00:16:42.767>source <00:16:42.895>us,

322
00:16:43.515 --> 00:16:46.515
<00:16:43.515>however <00:16:43.715>it's <00:16:43.915>fairly <00:16:44.115>old <00:16:44.314>so <00:16:44.515>you <00:16:44.715>would <00:16:44.915>need

323
00:16:46.515 --> 00:16:48.795
<00:16:46.515>to <00:16:46.655>take <00:16:46.795>a <00:16:46.935>look <00:16:47.074>if <00:16:47.215>it's <00:16:47.355>working <00:16:47.495>inside <00:16:47.635>of <00:16:47.775>your <00:16:47.915>environment,

324
00:16:49.335 --> 00:16:53.475
<00:16:49.335>but <00:16:49.462>at <00:16:49.589>least <00:16:49.716>for <00:16:49.844>some <00:16:49.971>examples <00:16:50.098>on <00:16:50.225>how <00:16:50.353>to <00:16:50.480>include <00:16:50.607>overset <00:16:50.735>aps

325
00:16:54.135 --> 00:16:56.355
<00:16:54.135>to <00:16:54.485>screen <00:16:54.835>for <00:16:55.185>security <00:16:55.535>issues.

326
00:16:56.735 --> 00:16:59.595
<00:16:56.735>And <00:16:56.851>you'd <00:16:56.968>like <00:16:57.085>to <00:16:57.201>say <00:16:57.318>open <00:16:57.435>source, <00:16:57.551>it <00:16:57.668>might <00:16:57.785>be <00:16:57.901>a <00:16:58.018>good <00:16:58.135>idea

327
00:16:59.595 --> 00:17:00.955
<00:16:59.595>to <00:16:59.717>take <00:16:59.839>a <00:16:59.962>look <00:17:00.084>at <00:17:00.207>it <00:17:00.329>and <00:17:00.451>see <00:17:00.574>if <00:17:00.696>you <00:17:00.819>can

328
00:17:00.955 --> 00:17:01.995
<00:17:00.955>implement <00:17:01.189>it <00:17:01.423>on <00:17:01.657>your <00:17:01.891>own.

329
00:17:02.005 --> 00:17:04.555
<00:17:02.005>There <00:17:02.205>are <00:17:02.405>some <00:17:02.605>test <00:17:02.805>cases <00:17:03.005>I <00:17:03.205>mentioned <00:17:03.405>here

330
00:17:04.555 --> 00:17:08.355
<00:17:04.555>before <00:17:04.730>covered <00:17:04.905>in <00:17:05.080>this <00:17:05.255>case <00:17:05.430>in <00:17:05.605>this <00:17:05.780>library <00:17:05.955>too.

331
00:17:08.455 --> 00:17:13.025
<00:17:08.454>So <00:17:08.595>for <00:17:08.734>a <00:17:08.875>source <00:17:09.014>of <00:17:09.155>um <00:17:09.294>examples, <00:17:09.435>this <00:17:09.574>is <00:17:09.714>very <00:17:09.855>good.

332
00:17:14.915 --> 00:17:17.565
<00:17:14.915>Okay, <00:17:15.381>now <00:17:15.848>forgive <00:17:16.315>me

333
00:17:17.565 --> 00:17:20.765
<00:17:17.565>to <00:17:17.705>go <00:17:17.845>into <00:17:17.985>a <00:17:18.125>quality <00:17:18.265>issuance <00:17:18.405>lens <00:17:18.545>for <00:17:18.685>a <00:17:18.825>little <00:17:18.965>something.

334
00:17:20.945 --> 00:17:23.645
<00:17:20.944>So <00:17:21.178>a <00:17:21.411>little <00:17:21.645>away <00:17:21.878>from <00:17:22.111>automatic <00:17:22.345>test

335
00:17:24.265 --> 00:17:28.045
<00:17:24.265>but <00:17:24.420>general <00:17:24.576>advice <00:17:24.731>to <00:17:24.887>take <00:17:25.042>into <00:17:25.198>account <00:17:25.353>when <00:17:25.509>it's <00:17:25.665>comes

336
00:17:28.065 --> 00:17:30.165
<00:17:28.065>to <00:17:28.415>testing <00:17:28.765>and <00:17:29.115>security <00:17:29.465>issues.

337
00:17:30.545 --> 00:17:32.285
<00:17:30.545>So <00:17:31.011>general <00:17:31.478>testing <00:17:31.945>practices

338
00:17:32.285 --> 00:17:33.765
<00:17:32.285>where <00:17:32.507>you <00:17:32.729>don't <00:17:32.951>need <00:17:33.173>libraries <00:17:33.395>for <00:17:33.617>whatsoever.

339
00:17:35.015 --> 00:17:38.035
<00:17:35.015>So <00:17:35.170>how <00:17:35.326>to <00:17:35.481>incorporate <00:17:35.637>security <00:17:35.792>testing <00:17:35.948>in <00:17:36.103>your <00:17:36.259>test <00:17:36.415>plans,

340
00:17:38.395 --> 00:17:39.475
<00:17:38.395>pipelines <00:17:38.880>and <00:17:39.367>workflows.

341
00:17:41.635 --> 00:17:45.565
<00:17:41.635>Well <00:17:41.790>I <00:17:41.946>did <00:17:42.101>use <00:17:42.257>end-to-end <00:17:42.412>testing <00:17:42.568>here <00:17:42.723>as <00:17:42.879>an <00:17:43.035>example

342
00:17:45.625 --> 00:17:46.845
<00:17:45.625>for <00:17:45.991>the <00:17:46.357>limited <00:17:46.723>timeframe.

343
00:17:46.905 --> 00:17:48.845
<00:17:46.905>But <00:17:47.138>of <00:17:47.371>course <00:17:47.605>you <00:17:47.838>could <00:17:48.071>well <00:17:48.305>um,

344
00:17:48.845 --> 00:17:51.805
<00:17:48.845>think <00:17:49.045>about <00:17:49.245>using <00:17:49.445>unit <00:17:49.645>tests <00:17:49.845>if <00:17:50.045>you <00:17:50.245>want

345
00:17:51.805 --> 00:17:52.965
<00:17:51.805>to <00:17:52.013>have <00:17:52.222>them <00:17:52.431>even <00:17:52.640>more <00:17:52.849>faster.

346
00:17:52.975 --> 00:17:55.805
<00:17:52.975>Especially <00:17:53.254>on <00:17:53.534>IPI <00:17:53.814>level <00:17:54.094>integration <00:17:54.375>tests,

347
00:17:55.805 --> 00:17:58.005
<00:17:55.805>component <00:17:56.271>tests <00:17:56.738>too, <00:17:57.205>especially

348
00:17:58.105 --> 00:18:00.405
<00:17:58.105>for <00:17:58.305>the <00:17:58.505>API <00:17:58.705>use <00:17:58.905>cases <00:17:59.105>I <00:17:59.305>showed <00:17:59.505>you

349
00:18:00.405 --> 00:18:03.245
<00:18:00.405>before <00:18:00.545>using <00:18:00.685>cypress <00:18:00.825>you <00:18:00.965>can <00:18:01.105>have <00:18:01.245>them <00:18:01.385>even <00:18:01.524>more <00:18:01.665>faster <00:18:01.805>if

350
00:18:03.245 --> 00:18:05.165
<00:18:03.245>you <00:18:03.419>use <00:18:03.594>like <00:18:03.770>PP <00:18:03.945>unit <00:18:04.120>for <00:18:04.294>it <00:18:04.469>for <00:18:04.645>example.

351
00:18:07.215 --> 00:18:11.395
<00:18:07.215>And <00:18:07.355>when <00:18:07.495>it <00:18:07.635>comes <00:18:07.774>to <00:18:07.915>a <00:18:08.054>a <00:18:08.195>like <00:18:08.334>workflow, <00:18:08.475>I <00:18:08.615>like

352
00:18:11.395 --> 00:18:12.755
<00:18:11.395>to <00:18:11.639>apply <00:18:11.884>when <00:18:12.129>it <00:18:12.374>comes <00:18:12.619>to

353
00:18:13.265 --> 00:18:16.555
<00:18:13.265>incorporating <00:18:13.545>security <00:18:13.825>best <00:18:14.105>practices <00:18:14.385>in <00:18:14.665>tests.

354
00:18:17.435 --> 00:18:18.955
<00:18:17.435>I <00:18:17.708>like <00:18:17.982>to <00:18:18.255>use <00:18:18.529>this <00:18:18.803>one.

355
00:18:19.175 --> 00:18:21.715
<00:18:19.175>So <00:18:19.350>like <00:18:19.524>first <00:18:19.700>I <00:18:19.875>want <00:18:20.050>to <00:18:20.225>learn <00:18:20.399>my <00:18:20.575>app

356
00:18:21.715 --> 00:18:24.155
<00:18:21.715>and <00:18:21.948>the <00:18:22.181>vulnerabilities <00:18:22.415>which <00:18:22.648>might <00:18:22.881>happen <00:18:23.115>inside

357
00:18:24.155 --> 00:18:29.135
<00:18:24.155>of <00:18:24.310>this <00:18:24.466>application <00:18:24.621>to <00:18:24.777>know <00:18:24.932>what <00:18:25.088>I <00:18:25.243>want <00:18:25.399>to <00:18:25.555>test,

358
00:18:29.155 --> 00:18:30.775
<00:18:29.155>to <00:18:29.388>know <00:18:29.621>which <00:18:29.855>test <00:18:30.088>cases <00:18:30.321>I <00:18:30.555>need,

359
00:18:30.915 --> 00:18:32.695
<00:18:30.915>if <00:18:31.115>I <00:18:31.315>really <00:18:31.514>need <00:18:31.715>some <00:18:31.915>tools <00:18:32.115>or <00:18:32.315>not.

360
00:18:35.595 --> 00:18:37.675
<00:18:35.595>I <00:18:35.828>will <00:18:36.061>think <00:18:36.295>about <00:18:36.528>a <00:18:36.761>test <00:18:36.995>plan.

361
00:18:37.975 --> 00:18:39.955
<00:18:37.975>So <00:18:38.175>which <00:18:38.375>layers <00:18:38.574>do <00:18:38.774>I <00:18:38.975>need <00:18:39.175>to <00:18:39.375>do?

362
00:18:39.955 --> 00:18:43.475
<00:18:39.955>I <00:18:40.129>need <00:18:40.304>unit <00:18:40.480>integration, <00:18:40.655>E <00:18:40.830>two <00:18:41.004>E <00:18:41.179>component <00:18:41.355>testing,

363
00:18:43.875 --> 00:18:46.915
<00:18:43.875>whatever <00:18:44.108>testing <00:18:44.341>like <00:18:44.575>a <00:18:44.808>small <00:18:45.041>risk <00:18:45.275>analysis.

364
00:18:46.925 --> 00:18:49.125
<00:18:46.925>Where <00:18:47.391>could <00:18:47.858>something <00:18:48.325>happen?

365
00:18:49.785 --> 00:18:52.205
<00:18:49.785>Is <00:18:49.940>it <00:18:50.096>really <00:18:50.251>likely <00:18:50.407>that <00:18:50.562>they <00:18:50.718>will <00:18:50.873>be <00:18:51.029>cut <00:18:51.185>uh,

366
00:18:52.205 --> 00:18:54.765
<00:18:52.205>cryptographic <00:18:52.405>phase <00:18:52.605>inside <00:18:52.804>of <00:18:53.004>my <00:18:53.205>application <00:18:53.405>or <00:18:53.605>not?

367
00:18:55.345 --> 00:18:58.005
<00:18:55.345>So <00:18:55.485>just <00:18:55.625>having <00:18:55.765>a <00:18:55.905>plan <00:18:56.045>on <00:18:56.185>what <00:18:56.325>I <00:18:56.465>want <00:18:56.605>to <00:18:56.745>have

368
00:18:58.345 --> 00:19:00.565
<00:18:58.345>and <00:18:58.625>what <00:18:58.905>is <00:18:59.185>not <00:18:59.465>that <00:18:59.745>important

369
00:19:00.625 --> 00:19:03.165
<00:19:00.625>for <00:19:00.825>my <00:19:01.025>test <00:19:01.225>strategy <00:19:01.425>in <00:19:01.625>terms <00:19:01.825>of <00:19:02.025>security.

370
00:19:04.075 --> 00:19:06.495
<00:19:04.075>Then <00:19:04.308>I <00:19:04.541>will <00:19:04.775>write <00:19:05.008>the <00:19:05.241>test <00:19:05.475>cases

371
00:19:06.665 --> 00:19:08.175
<00:19:06.665>where <00:19:07.004>you <00:19:07.344>saw <00:19:07.684>some <00:19:08.024>examples.

372
00:19:08.175 --> 00:19:11.155
<00:19:08.175>They <00:19:08.350>don't <00:19:08.524>need <00:19:08.700>to <00:19:08.875>be <00:19:09.050>difficult <00:19:09.225>as <00:19:09.399>you <00:19:09.575>saw.

373
00:19:11.295 --> 00:19:13.755
<00:19:11.295>So <00:19:11.470>like <00:19:11.645>think <00:19:11.820>about, <00:19:11.995>okay, <00:19:12.170>writing <00:19:12.345>the <00:19:12.520>test <00:19:12.695>cases,

374
00:19:13.895 --> 00:19:17.275
<00:19:13.895>having <00:19:14.050>the <00:19:14.206>pen <00:19:14.361>bot <00:19:14.517>in <00:19:14.672>place, <00:19:14.828>like <00:19:14.983>what <00:19:15.139>I <00:19:15.295>need

375
00:19:19.035 --> 00:19:21.055
<00:19:19.035>and <00:19:19.268>execute <00:19:19.501>them <00:19:19.735>and <00:19:19.968>analyze <00:19:20.201>the <00:19:20.435>results.

376
00:19:21.055 --> 00:19:23.535
<00:19:21.055>So <00:19:21.195>take <00:19:21.335>a <00:19:21.475>look <00:19:21.615>at <00:19:21.755>the <00:19:21.895>logs, <00:19:22.035>see <00:19:22.175>if <00:19:22.315>something <00:19:22.455>breaks,

377
00:19:23.795 --> 00:19:25.135
<00:19:23.795>see <00:19:24.036>if <00:19:24.277>you <00:19:24.518>have <00:19:24.759>any <00:19:25.001>warnings.

378
00:19:25.135 --> 00:19:27.655
<00:19:25.135>There <00:19:25.368>are <00:19:25.601>wonderful <00:19:25.835>plugins <00:19:26.068>for <00:19:26.301>cypress <00:19:26.535>which

379
00:19:27.675 --> 00:19:31.925
<00:19:27.675>for <00:19:27.850>example <00:19:28.024>print <00:19:28.200>out <00:19:28.375>the <00:19:28.550>um, <00:19:28.725>like <00:19:28.899>the <00:19:29.075>content

380
00:19:32.185 --> 00:19:35.445
<00:19:32.185>of <00:19:32.360>your <00:19:32.534>browser <00:19:32.710>console, <00:19:32.885>like <00:19:33.060>try <00:19:33.235>to <00:19:33.409>find, <00:19:33.585>get

381
00:19:35.465 --> 00:19:37.925
<00:19:35.465>as <00:19:35.665>many <00:19:35.865>data <00:19:36.064>from <00:19:36.264>your <00:19:36.465>test <00:19:36.665>as <00:19:36.865>possible.

382
00:19:40.485 --> 00:19:42.695
<00:19:40.485>Yeah, <00:19:40.764>include <00:19:41.044>other <00:19:41.324>tools <00:19:41.604>if <00:19:41.885>necessary.

383
00:19:42.715 --> 00:19:45.375
<00:19:42.715>If <00:19:42.855>you <00:19:42.995>cannot <00:19:43.135>like <00:19:43.274>cover <00:19:43.415>all <00:19:43.554>the <00:19:43.695>things <00:19:43.834>through <00:19:43.975>your <00:19:44.115>tests

384
00:19:46.755 --> 00:19:50.655
<00:19:46.755>and <00:19:46.910>then <00:19:47.066>repeat, <00:19:47.221>set <00:19:47.377>your <00:19:47.532>test <00:19:47.688>into <00:19:47.843>a <00:19:47.999>pipeline <00:19:48.155>to

385
00:19:51.235 --> 00:19:52.735
<00:19:51.235>run <00:19:51.504>them <00:19:51.774>on <00:19:52.044>a <00:19:52.314>certain <00:19:52.584>rhythm.

386
00:19:52.955 --> 00:19:56.815
<00:19:52.955>May <00:19:53.082>it <00:19:53.209>be <00:19:53.336>nightly, <00:19:53.464>may <00:19:53.591>it <00:19:53.718>be <00:19:53.845>on <00:19:53.973>any <00:19:54.100>bigger <00:19:54.227>pool <00:19:54.355>request.

387
00:19:56.835 --> 00:20:01.125
<00:19:56.835>Opt <00:19:56.962>in <00:19:57.089>out <00:19:57.216>where <00:19:57.344>you <00:19:57.471>need <00:19:57.598>to <00:19:57.725>and <00:19:57.853>then <00:19:57.980>rinse <00:19:58.107>and <00:19:58.235>repeat.

388
00:20:02.085 --> 00:20:05.035
<00:20:02.085>Write <00:20:02.212>more <00:20:02.339>tests. <00:20:02.466>If <00:20:02.594>you <00:20:02.721>see <00:20:02.848>there's <00:20:02.975>a <00:20:03.103>point <00:20:03.230>where <00:20:03.357>you <00:20:03.485>need

389
00:20:05.035 --> 00:20:06.835
<00:20:05.035>to <00:20:05.501>have <00:20:05.968>more <00:20:06.435>coverage.

390
00:20:07.655 --> 00:20:12.475
<00:20:07.655>So <00:20:07.830>in <00:20:08.004>this <00:20:08.180>way <00:20:08.355>tests <00:20:08.530>are <00:20:08.705>a <00:20:08.879>great <00:20:09.055>compliment

391
00:20:12.475 --> 00:20:14.315
<00:20:12.475>to <00:20:12.754>keep <00:20:13.034>your <00:20:13.314>app <00:20:13.594>more <00:20:13.875>secure.

392
00:20:15.175 --> 00:20:18.715
<00:20:15.175>Of <00:20:15.302>course <00:20:15.429>it <00:20:15.556>shouldn't <00:20:15.684>be <00:20:15.811>the <00:20:15.938>for <00:20:16.065>only <00:20:16.193>one <00:20:16.320>line <00:20:16.447>of <00:20:16.575>defense

393
00:20:18.715 --> 00:20:20.235
<00:20:18.715>because <00:20:18.988>there're <00:20:19.262>still <00:20:19.535>just <00:20:19.809>a <00:20:20.082>messenger.

394
00:20:20.535 --> 00:20:24.295
<00:20:20.535>If <00:20:20.710>there's <00:20:20.885>a <00:20:21.060>problem <00:20:21.235>showing <00:20:21.410>up, <00:20:21.585>you <00:20:21.760>might <00:20:21.935>need

395
00:20:24.295 --> 00:20:28.095
<00:20:24.295>to <00:20:24.495>like <00:20:24.695>amp <00:20:24.895>up <00:20:25.095>your <00:20:25.295>application <00:20:25.495>as <00:20:25.695>it

396
00:20:28.155 --> 00:20:32.615
<00:20:28.155>to <00:20:28.310>like <00:20:28.466>apply <00:20:28.621>certain <00:20:28.777>fixes, <00:20:28.932>certain <00:20:29.088>best <00:20:29.243>practices <00:20:29.399>to <00:20:29.555>not.

397
00:20:32.955 --> 00:20:34.855
<00:20:32.955>But <00:20:33.155>when <00:20:33.355>it <00:20:33.554>comes <00:20:33.754>to <00:20:33.955>being <00:20:34.155>a <00:20:34.355>messenger,

398
00:20:35.245 --> 00:20:36.535
<00:20:35.245>it's <00:20:35.632>a <00:20:36.019>perfect <00:20:36.406>messenger

399
00:20:37.275 --> 00:20:39.695
<00:20:37.275>and <00:20:37.415>you <00:20:37.555>don't <00:20:37.695>need <00:20:37.835>to <00:20:37.975>have <00:20:38.115>that <00:20:38.255>many <00:20:38.395>tools <00:20:38.535>in <00:20:38.675>it.

400
00:20:43.585 --> 00:20:46.405
<00:20:43.585>So <00:20:43.740>I <00:20:43.896>hope <00:20:44.051>that <00:20:44.207>your <00:20:44.362>app <00:20:44.518>could <00:20:44.673>look <00:20:44.829>like <00:20:44.985>this.

401
00:20:46.925 --> 00:20:49.845
<00:20:46.925>A <00:20:47.080>wonderful <00:20:47.236>garden <00:20:47.391>with <00:20:47.547>many <00:20:47.702>measures <00:20:47.858>may <00:20:48.013>be <00:20:48.169>test <00:20:48.325>cases,

402
00:20:50.745 --> 00:20:53.845
<00:20:50.745>may <00:20:50.919>it <00:20:51.094>be <00:20:51.270>best <00:20:51.445>practices, <00:20:51.620>may <00:20:51.794>it <00:20:51.969>be <00:20:52.145>one

403
00:20:53.845 --> 00:20:55.445
<00:20:53.845>or <00:20:54.078>two <00:20:54.311>tools <00:20:54.545>but <00:20:54.778>not <00:20:55.011>too <00:20:55.245>many.

404
00:20:55.765 --> 00:20:57.045
<00:20:55.765>'cause <00:20:55.957>you <00:20:56.149>can <00:20:56.341>cover <00:20:56.533>lots <00:20:56.725>of <00:20:56.917>things

405
00:20:57.105 --> 00:20:59.125
<00:20:57.105>by <00:20:57.455>using <00:20:57.805>normal <00:20:58.155>test <00:20:58.505>automation.

406
00:20:59.665 --> 00:21:04.055
<00:20:59.665>May <00:20:59.840>it <00:21:00.014>be <00:21:00.190>units <00:21:00.365>integration, <00:21:00.540>EGE <00:21:00.715>test, <00:21:00.889>many <00:21:01.065>different,

407
00:21:04.755 --> 00:21:07.775
<00:21:04.755>um, <00:21:04.988>defenses <00:21:05.221>keeping <00:21:05.455>the <00:21:05.688>attackers <00:21:05.921>at <00:21:06.155>bay.

408
00:21:10.075 --> 00:21:13.295
<00:21:10.075>If <00:21:10.230>there <00:21:10.386>are <00:21:10.541>like <00:21:10.697>some <00:21:10.852>small <00:21:11.008>like <00:21:11.163>I <00:21:11.319>guess <00:21:11.475>three

409
00:21:13.315 --> 00:21:15.615
<00:21:13.315>or <00:21:13.548>maybe <00:21:13.781>four <00:21:14.015>points, <00:21:14.248>I <00:21:14.481>want <00:21:14.715>you

410
00:21:15.615 --> 00:21:17.775
<00:21:15.615>to <00:21:15.848>remember <00:21:16.081>from <00:21:16.315>this <00:21:16.548>talks <00:21:16.781>it's <00:21:17.015>those

411
00:21:19.865 --> 00:21:21.455
<00:21:19.865>automation <00:21:20.215>is <00:21:20.565>a <00:21:20.915>great <00:21:21.265>compliment

412
00:21:21.515 --> 00:21:24.015
<00:21:21.515>as <00:21:21.670>we <00:21:21.826>see <00:21:21.981>in <00:21:22.137>a <00:21:22.292>wonderful <00:21:22.448>garden <00:21:22.603>full <00:21:22.759>of <00:21:22.915>defenses.

413
00:21:24.045 --> 00:21:25.495
<00:21:24.045>It's <00:21:24.262>a <00:21:24.480>wonderful <00:21:24.697>thing <00:21:24.915>to <00:21:25.132>have <00:21:25.350>them.

414
00:21:27.595 --> 00:21:30.535
<00:21:27.595>Simple <00:21:27.722>steps <00:21:27.849>are <00:21:27.976>most <00:21:28.104>useful <00:21:28.231>as <00:21:28.358>you <00:21:28.485>saw <00:21:28.613>in <00:21:28.740>those <00:21:28.867>test <00:21:28.995>cases.

415
00:21:30.535 --> 00:21:31.775
<00:21:30.535>They're <00:21:30.907>not <00:21:31.279>that <00:21:31.651>difficult.

416
00:21:32.195 --> 00:21:33.975
<00:21:32.195>You <00:21:32.475>can <00:21:32.754>implement <00:21:33.034>them <00:21:33.314>pretty <00:21:33.595>fast

417
00:21:34.235 --> 00:21:36.575
<00:21:34.235>and <00:21:34.390>it's <00:21:34.546>okay <00:21:34.701>to <00:21:34.857>use <00:21:35.012>them <00:21:35.168>only <00:21:35.323>for <00:21:35.479>samples, <00:21:35.635>right?

418
00:21:39.345 --> 00:21:42.315
<00:21:39.345>Combine <00:21:39.520>those <00:21:39.695>on <00:21:39.870>test <00:21:40.045>cases <00:21:40.220>sometimes <00:21:40.395>with <00:21:40.570>tools, <00:21:40.745>sometimes

419
00:21:42.315 --> 00:21:44.235
<00:21:42.315>with <00:21:42.515>the <00:21:42.715>best <00:21:42.915>practices <00:21:43.115>inside <00:21:43.315>of <00:21:43.515>your <00:21:43.715>application

420
00:21:44.885 --> 00:21:48.715
<00:21:44.885>where <00:21:45.001>you <00:21:45.118>can <00:21:45.235>see <00:21:45.351>a <00:21:45.468>little <00:21:45.585>talk <00:21:45.701>on <00:21:45.818>uh, <00:21:45.935>in <00:21:46.051>the <00:21:46.168>virtual <00:21:46.285>track

421
00:21:50.655 --> 00:21:53.195
<00:21:50.655>and <00:21:50.888>all <00:21:51.121>testing <00:21:51.355>types <00:21:51.588>can <00:21:51.821>be <00:21:52.055>utilized.

422
00:21:53.295 --> 00:21:56.515
<00:21:53.295>So <00:21:53.470>even <00:21:53.645>if <00:21:53.820>I <00:21:53.995>showcase <00:21:54.170>them <00:21:54.345>in <00:21:54.520>end <00:21:54.695>testing,

423
00:21:56.885 --> 00:21:58.075
<00:21:56.885>don't <00:21:57.099>feel <00:21:57.313>limited <00:21:57.527>to <00:21:57.741>do <00:21:57.956>it.

424
00:21:58.245 --> 00:21:59.835
<00:21:58.245>Don't <00:21:58.594>feel <00:21:58.945>limited <00:21:59.294>to <00:21:59.645>Cyprus.

425
00:21:59.935 --> 00:22:01.195
<00:21:59.935>Try <00:22:00.161>it <00:22:00.388>out <00:22:00.615>and <00:22:00.842>playwright <00:22:01.069>too

426
00:22:01.195 --> 00:22:03.515
<00:22:01.195>because <00:22:01.370>most <00:22:01.544>of <00:22:01.720>the <00:22:01.895>things <00:22:02.070>are <00:22:02.245>applicable <00:22:02.419>for <00:22:02.595>both.

427
00:22:04.835 --> 00:22:08.105
<00:22:04.835>Okay, <00:22:05.068>well <00:22:05.301>if <00:22:05.535>you <00:22:05.768>got <00:22:06.001>any <00:22:06.235>feedback

428
00:22:08.645 --> 00:22:10.185
<00:22:08.645>on <00:22:09.107>like <00:22:09.569>automation <00:22:10.031>testing

429
00:22:10.485 --> 00:22:13.785
<00:22:10.485>or <00:22:10.764>normally <00:22:11.044>on <00:22:11.324>authentication, <00:22:11.604>so <00:22:11.885>how

430
00:22:13.785 --> 00:22:15.985
<00:22:13.785>to <00:22:13.960>extend <00:22:14.135>authentication, <00:22:14.310>I'd <00:22:14.485>be <00:22:14.660>happy <00:22:14.835>if <00:22:15.010>you <00:22:15.185>want

431
00:22:15.985 --> 00:22:17.745
<00:22:15.985>to <00:22:16.218>give <00:22:16.451>me <00:22:16.685>a <00:22:16.918>little <00:22:17.151>like <00:22:17.385>message.

432
00:22:18.055 --> 00:22:21.345
<00:22:18.055>There's <00:22:18.230>a <00:22:18.405>little <00:22:18.580>form <00:22:18.755>hidden <00:22:18.930>into <00:22:19.105>this <00:22:19.280>QR <00:22:19.455>code.

433
00:22:22.345 --> 00:22:23.385
<00:22:22.345>I <00:22:22.501>wait <00:22:22.657>for <00:22:22.813>it <00:22:22.969>a <00:22:23.125>little <00:22:23.281>bit,

434
00:22:23.385 --> 00:22:25.745
<00:22:23.385>but <00:22:23.665>you <00:22:23.945>can <00:22:24.225>just <00:22:24.504>enter <00:22:24.785>ramona.dev

435
00:22:25.965 --> 00:22:27.265
<00:22:25.965>inside <00:22:26.257>of <00:22:26.550>your <00:22:26.842>browser <00:22:27.135>too.

436
00:22:27.605 --> 00:22:28.665
<00:22:27.605>So <00:22:28.081>that's <00:22:28.559>all.

437
00:22:29.545 --> 00:22:32.595
<00:22:29.545>There's <00:22:29.745>a <00:22:29.945>virtual <00:22:30.145>event <00:22:30.345>coming <00:22:30.545>up <00:22:30.745>in <00:22:30.945>September,

438
00:22:32.595 --> 00:22:34.595
<00:22:32.595>which <00:22:32.750>I <00:22:32.906>wanted <00:22:33.061>to <00:22:33.217>just <00:22:33.372>have <00:22:33.528>a <00:22:33.683>shot <00:22:33.839>of <00:22:33.995>voice,

439
00:22:34.655 --> 00:22:36.155
<00:22:34.655>so <00:22:34.925>if <00:22:35.195>you're <00:22:35.465>interested <00:22:35.735>in <00:22:36.004>security

440
00:22:36.175 --> 00:22:37.955
<00:22:36.175>or <00:22:36.455>identity <00:22:36.735>topics, <00:22:37.014>you <00:22:37.294>might <00:22:37.575>be

441
00:22:37.955 --> 00:22:39.075
<00:22:37.955>interested <00:22:38.156>to <00:22:38.358>take <00:22:38.559>a <00:22:38.761>look <00:22:38.963>there.

442
00:22:39.845 --> 00:22:44.195
<00:22:39.845>And <00:22:39.961>apart <00:22:40.078>from <00:22:40.195>that, <00:22:40.311>I <00:22:40.428>just <00:22:40.545>can <00:22:40.661>say <00:22:40.778>to <00:22:40.895>thank <00:22:41.011>you <00:22:41.128>to <00:22:41.245>you,

443
00:22:44.195 --> 00:22:46.395
<00:22:44.195>thank <00:22:44.335>you <00:22:44.475>for <00:22:44.615>nerding <00:22:44.754>out, <00:22:44.895>thank <00:22:45.034>you <00:22:45.175>to <00:22:45.314>listen <00:22:45.455>to <00:22:45.595>me.

444
00:22:46.595 --> 00:22:51.265
<00:22:46.595>I <00:22:46.735>hope <00:22:46.875>it's <00:22:47.015>a <00:22:47.155>wonderful <00:22:47.295>like <00:22:47.435>way <00:22:47.575>of <00:22:47.715>thinking <00:22:47.855>that <00:22:47.995>just

445
00:22:51.855 --> 00:22:54.705
<00:22:51.855>like <00:22:52.030>including <00:22:52.205>tools <00:22:52.380>is <00:22:52.555>not <00:22:52.730>the <00:22:52.905>only <00:22:53.080>way <00:22:53.255>how

446
00:22:54.705 --> 00:22:56.665
<00:22:54.705>to <00:22:55.171>use <00:22:55.638>security <00:22:56.105>testing.

447
00:22:57.525 --> 00:23:00.745
<00:22:57.525>If <00:22:57.652>you've <00:22:57.779>got <00:22:57.906>any <00:22:58.034>questions, <00:22:58.161>find <00:22:58.288>me <00:22:58.415>here <00:22:58.543>or <00:22:58.670>at <00:22:58.797>Theta <00:22:58.925>booth.

448
00:23:00.825 --> 00:23:03.185
<00:23:00.825>I <00:23:00.952>guess <00:23:01.079>it's <00:23:01.206>the <00:23:01.334>booth <00:23:01.461>at <00:23:01.588>the <00:23:01.715>other <00:23:01.843>side <00:23:01.970>of <00:23:02.097>this <00:23:02.225>room.

449
00:23:03.645 --> 00:23:06.985
<00:23:03.645>So <00:23:03.845>I <00:23:04.045>guess <00:23:04.245>it's <00:23:04.445>two, <00:23:04.645>um, <00:23:04.845>zero <00:23:05.045>one.

450
00:23:07.365 --> 00:23:08.985
<00:23:07.365>So <00:23:07.540>if <00:23:07.715>you <00:23:07.890>got <00:23:08.065>a <00:23:08.240>question, <00:23:08.415>find <00:23:08.590>me <00:23:08.765>there

451
00:23:09.245 --> 00:23:11.225
<00:23:09.245>and <00:23:09.385>I'm <00:23:09.524>happy <00:23:09.665>I <00:23:09.804>was <00:23:09.945>able <00:23:10.084>to <00:23:10.225>spend <00:23:10.364>time <00:23:10.504>with <00:23:10.645>you.

452
00:23:11.225 --> 00:23:11.905
<00:23:11.225>Thank <00:23:11.428>you <00:23:11.633>so <00:23:11.837>much.

453
00:23:18.495 --> 00:23:20.225
<00:23:18.495>Yeah, <00:23:18.695>thank <00:23:18.895>you <00:23:19.094>so <00:23:19.294>much <00:23:19.495>for <00:23:19.695>your <00:23:19.895>talk.

454
00:23:20.445 --> 00:23:23.225
<00:23:20.445>Um, <00:23:20.620>we <00:23:20.794>have <00:23:20.970>uh, <00:23:21.145>one <00:23:21.320>question <00:23:21.495>in <00:23:21.669>the <00:23:21.845>app.

455
00:23:23.565 --> 00:23:26.265
<00:23:23.565>Yes, <00:23:23.765>you <00:23:23.965>would <00:23:24.165>like <00:23:24.365>to <00:23:24.565>answer, <00:23:24.765>um, <00:23:24.965>how

456
00:23:26.265 --> 00:23:29.265
<00:23:26.265>to <00:23:26.440>increase <00:23:26.615>awareness <00:23:26.790>in <00:23:26.965>a <00:23:27.140>team <00:23:27.315>about <00:23:27.490>the <00:23:27.665>need

457
00:23:29.265 --> 00:23:32.265
<00:23:29.265>of <00:23:29.465>writing <00:23:29.665>security <00:23:29.865>tests <00:23:30.065>along <00:23:30.265>with <00:23:30.465>traditional <00:23:30.665>tests.

458
00:23:33.085 --> 00:23:35.145
<00:23:33.085>Oh <00:23:33.365>yeah, <00:23:33.645>that's <00:23:33.925>a <00:23:34.205>wonderful <00:23:34.485>question.

459
00:23:35.285 --> 00:23:38.425
<00:23:35.285>So <00:23:35.440>I <00:23:35.596>like <00:23:35.751>to <00:23:35.907>go <00:23:36.062>the <00:23:36.218>way <00:23:36.373>of, <00:23:36.529>um, <00:23:36.685>arguing

460
00:23:38.535 --> 00:23:41.065
<00:23:38.535>that <00:23:38.735>you <00:23:38.935>need <00:23:39.135>a <00:23:39.335>messenger <00:23:39.535>for <00:23:39.735>security <00:23:39.935>issues,

461
00:23:41.555 --> 00:23:44.345
<00:23:41.555>especially <00:23:41.835>if <00:23:42.115>you <00:23:42.395>have <00:23:42.675>them <00:23:42.955>happening

462
00:23:44.345 --> 00:23:45.640
<00:23:44.345>inside <00:23:44.636>of <00:23:44.927>the, <00:23:45.219>the <00:23:45.510>application.

463
00:23:46.535 --> 00:23:48.525
<00:23:46.535>It'll <00:23:46.735>cost <00:23:46.935>you <00:23:47.135>trust <00:23:47.335>in <00:23:47.535>your <00:23:47.735>user <00:23:47.935>base.

464
00:23:48.985 --> 00:23:52.325
<00:23:48.985>And <00:23:49.159>especially <00:23:49.334>test <00:23:49.510>automation <00:23:49.685>is <00:23:49.860>something <00:23:50.034>you <00:23:50.209>can <00:23:50.385>like

465
00:23:52.395 --> 00:23:55.725
<00:23:52.395>just <00:23:52.570>run <00:23:52.745>on <00:23:52.920>like <00:23:53.095>any <00:23:53.270>night <00:23:53.445>or <00:23:53.620>any <00:23:53.795>request.

466
00:23:55.785 --> 00:23:58.045
<00:23:55.785>So <00:23:55.960>if <00:23:56.135>you <00:23:56.310>write <00:23:56.485>them <00:23:56.660>once, <00:23:56.835>you <00:23:57.010>will <00:23:57.185>be,

467
00:23:58.795 --> 00:24:00.495
<00:23:58.795>of <00:23:58.970>course <00:23:59.145>you <00:23:59.320>will <00:23:59.495>be <00:23:59.670>protected <00:23:59.845>a <00:24:00.020>little <00:24:00.195>more.

468
00:24:00.715 --> 00:24:01.855
<00:24:00.715>You <00:24:00.971>need <00:24:01.228>to <00:24:01.484>maintain <00:24:01.741>them.

469
00:24:01.875 --> 00:24:05.055
<00:24:01.875>Of <00:24:02.075>course, <00:24:02.275>sometimes <00:24:02.475>if <00:24:02.675>you're <00:24:02.875>a <00:24:03.075>product <00:24:03.275>change,

470
00:24:05.055 --> 00:24:06.255
<00:24:05.055>if <00:24:05.325>you <00:24:05.595>add <00:24:05.865>some <00:24:06.135>features,

471
00:24:06.355 --> 00:24:09.135
<00:24:06.355>but <00:24:06.705>you <00:24:07.055>just <00:24:07.405>like <00:24:07.755>try

472
00:24:09.135 --> 00:24:12.935
<00:24:09.135>to <00:24:09.290>export <00:24:09.446>a <00:24:09.601>task <00:24:09.757>from <00:24:09.912>your <00:24:10.068>brain <00:24:10.223>to <00:24:10.379>an <00:24:10.535>automation

473
00:24:12.935 --> 00:24:14.415
<00:24:12.935>and <00:24:13.101>you <00:24:13.268>don't <00:24:13.434>need <00:24:13.601>to <00:24:13.767>think <00:24:13.934>about <00:24:14.100>it <00:24:14.267>anymore,

474
00:24:14.425 --> 00:24:16.415
<00:24:14.425>which <00:24:14.625>is <00:24:14.825>a <00:24:15.024>huge <00:24:15.225>plus <00:24:15.425>in <00:24:15.625>my <00:24:15.825>opinion.