This presentation slides mostly contain headings and topics of disscused areas, since meet-up was a practical & live demonstration type of Application security.

1. Welcome to
Colombo Security Meet-up
(SL chapter of OWASP)
05th Sep 2012
Role of Webscarab in Application Security

2. • Agenda
– Introduction to Webscarab
– Plugins and Features
– Test your Web Apps with Webscarab
– Security Test Automation

3. • Proxy
– Why we use proxy
– Where we place proxy
– Application Security Proxy
– OWASP proxy

4. • OWASP Communities
– Builders
– Breakers
– Defenders

5. • Webscarab
– Security testing tool / Completely free / Open Source
– Cross Platform / Project leader – Rogan Dawes
– Contributors – All around the world
– Webscarab classic & Webscarab-NG
– Webscarab lite & Webscarab full

6. • Features of Webscarab
– extracts Scripts and HTML comments from HTML pages
– observes traffic between the browser and the web server
– modify HTTP and HTTPS requests and responses on the fly
– Manual request
– execution of arbitrarily complex operations on requests and responses
– Reveal hidden fields

7. • Features of Webscarab
– Bandwidth simulator
– Spider
– SessionID analysis
– Parameter fuzzer
– Search
– Compare
– XSS/CRLF

8. • Webscarab Plugins
– Proxy
– Manual request
– Spider
– SessionID Analysis
– Scripted
– Fragments

9. • Webscarab Plugins
– Compare
– Fuzzer
– Search
– AMF plugin- to analysis flex web application

10. • Test your Web Apps with Webscarab
– Spidering
– SQLi & XSS
– Discovering clues
– Directory enumeration
– Backup files scanning
– Session hijacking
– Parameter modification & Revealing hidding fields

11. • Automate your security testing
– Webscarab + Selenium

12. • Q&A
Thank You
Dilan Warnakulasooriya
99X Technology
https://www.linkedin.com/in/dilanwarnakulasooriya