Tomasz Fajks gives short intro about Security Tests as well as guide how to start. He goes through comparison of two security scanners Burp Suite and OWASP Zed Attack Proxy (ZAP), trying to answer "which one is better".

1. Security test
scanners
Burp vs ZAP
Tomasz Fajks

2. Security testing
process intended to reveal flaws
in the security mechanisms of an
information system that protect
data and maintain functionality as
intended

3. Security tests in objectivity

4. The OWASP Top 10 vulnerabilities:
• A1 Injection
• A2 Broken Authentication and Session Management
• A3 Cross-Site Scripting (XSS)
• A4 Insecure Direct Object References
• A5 Security Misconfiguration
• A6 Sensitive Data Exposure
• A7 Missing Function Level Access Control
• A8 Cross-Site Request Forgery (CSRF)
• A9 Using Components with Known Vulnerabilities
• A10 Unvalidated Redirects and Forwards

5. https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
https://portswigger.net/burp/

6. DEMO

7. www.dvwa.co.uk
https://github.com/WebGoat/WebGoat/wiki

8. DEMO

10. False positive – vulnerability does not exist,
but found
False negative – vulnerability exists, but not
found

11. Burp on DVWA
points priority default deep no Int.
no Int.
MinFalseNeg
no Int.
MinFalsePos
5
Certain
High 16 16 18 17 17
3 Medium 0 0 0 0 0
1 Low 2 2 2 4 4
5
Firm
High 9 10 12 13 9
3 Medium 1 0 0 1 1
1 Low 0 0 0 0 0
-5
Tentative
High 2 16 13 17 4
-3 Medium 5 8 10 11 9
-1 Low 0 0 0 0 0
summary 105 28 57 39 90

12. QUESTIONS?