Exploratory Security Testing in the Browser

Much of the time, security testing is relegated to the end of development and then is assumed to be someone else’s problem. However, late security fixes can have a huge impact on your delivery dates. Although automated scanners offer some help by inspecting your application’s HTTP traffic, most common attacks are best performed in the browser, which should be the focus of your exploratory security testing. Using familiar automation practices, open source tools (Webdriver/Selenium), and a browser (Chrome/Firefox/Edge), Abraham Marin-Perez shows you how to drive a browser and attack a web application, thus providing a way to automate your security testing and receive quick feedback. The best way to find those nasty JavaScript injection bugs is by using an actual browser. With automation practices already familiar to teams, you can integrate a security testing technique—in an agile way—and keep your clients safe.