Talk 11:30 - 12:15 August 09, 2019

YanYan Wang

Speed is vital in startups, and fast moving CI/CD pipelines are the norm in startups. Dynamic application security testing (DAST) can take advantage of the speed, automate along the CI/CD pipelines, and enable developers to fix issues while vulnerabilities are in development phase. In order to be integrate seamlessly with CI/CD pipelines, DAST tools should be ready to be deployed as code, integrate with a modern build system, and be able to provide instant feedback. Existing commercial DAST tools generally do not have such capabilities. In this presentation, we discuss how we dockerized Headless Burp, deployed the Headless Burp as code, so that it can be integrated with Selenium tests on demand.