@TomK. Automated Web App Scanners are useful in their place but have a number of problems, like false positives and also the very very large number of requests they send to get a result. There's a place for them (if well managed) but I've got to say, most web application security testers I know do not use automated scanners as part of their work

@RоryMcCune to be fair I was including things like fuzzers and some of the burp functionality under "scanners"

ahh yeah I was thinking of automated scanners (acunetix, appscan, webinspect etc)

I have heard acunetix referred to as crashunetix

@RоryMcCune yeah, that was the intended direction of my question

and I think acunetix is the tool my company intends to purchase

well my recommendation would be to look at it in a dev/test environment in the first instance

make sure you're happy with the level of load

unfortunately i'm not directly involved in that decision (and it's already been made)

I will be involved if problems arise though ;)

well 2 things to watch, one is general load on the app (10,000's of requests quite quickly) and the other is, if you give it credentials to log in, it will (by default) try to fuzz every single parameter and form, so if you have any destructive functionality, that can end poorly

TBF in a well secured robust site it shouldn't cause too much trouble

well, all our apps are deployed on a productive, test and reference environment

so testing can be done in rather safe environments

load isn't that big of a deal there

and regarding "destructive potential" that probably depends on the app. but it's good to be reminded that the tests can be more "powerful" - if you will - than manual testing

@RоryMcCune I had one example like that - the page had a payment setup and the fuzzer completed the payment. It wasn't the expected test payment of £1. It was a few thousand...

Yeah things like that or the web spider that deleted a customer database 'cause there was a GET request for "delete record" are my favs :)

XKCD 327ed? ;p

to bring up something completely different: @AviD brought up a network of infosec people here. I'm relatively new in the field (6 months in) how do I get into one of these and is it even worth it at this point?

<3 bobby tables

hmm?

if this isn't something that is accessible for people that are too uneperienced, it's no problem. no hard feelings

not sure what you're referring to?

and everything should be accessible for everybody, we were all inexperienced at some point :-)

@TomK. I think its literally "I know some people who know some people..."

except for @RoryAlsop, the universe created him that way :D

@AviD In the beginning, there was Rory. And there was bugger all to do, so everyone went off and got sodding drunk?

lol

ugh.. linked to the wrong comment

I meant this one

Ohh LinkedIn, the network of people that I know... @RoryAlsop also mentioned as much in his post.

OWASP on the other hand - there is an open Slack for that, if you are in appsec

aaah...

(well and even if you're not)

not really, I'm more on the conceptual side

you know, standards and norms and stuff like that

owasp.herokuapp.com

ok

but why not

lol

alrighty, thanks for the invite

@TomK. LinkedIn is very useful - but generally people will only accept a connection once you have met them. OWASP, ISACA, IISP, etc are useful networking opportunities, both in person and via mailing lists

yeah, I was thinking about joining ISACA, just didn't get around to it

thing is: none of my colleagues are members in any of these networks or associations

@TomK. I always encourage people newly into the industry to join at least one - it rapidly speeds up getting awareness and involvement in interesting things

and can be very helpful to your career

yeah, maybe that came out wrong. It's not that I'm not interested, it's just that my (maybe not so up-to-date) colleagues didn't give my any good pointers so far

@TomK. where are you based?

berlin, germany

but my company is very old-fashioned. not one of the hip start ups

(just checking out the german chapter of isaca)

I think ISACA in Germany is more Frankfurt based

I have been over there for a few events, but the ISACA ones were Munich and Frankfurt, mostly

yeah, a lot of the recent and upcoming ones are as well

Security of Things World - June 19

maybe that was last year - hang on

eventbrite.com/d/germany--berlin/security-conference

just missed infosec-conferences.com/events-in-2018/…

it's this year again ;) July 1 – 3, 2018

well, thanks anyway. I'll keep my eyes open. if you have any more suggestions, I would be more than happy to hear them. my professional environment seems not to eager to foster my development

@RoryAlsop I do not know how "featured post" work exactly, but the only "featured on meta" as of now is "Request for comment: Stack Overflow is hiring a Director of Information Security" on my side.

On meta.security.se or meta.se? They certainly show up on my sidebar

Yeah, I noticed it has a strange behaviour too

Ah - seems to depend on which machine I try it on. One gives just that job, the other gives all three...

Sometimes the CTFs posts show up, sometimes it doesn't, I guess there's a cache or something

Maybe it checks for screen real estate and prioritises the official one?

Yeah, that was I thought too, that's why I didn't report it

Maybe it's related to posts I've already read, but I've read all of them already

They're up again for me

Yup, just showed up for me too

Hmmmmm. Let's blame caching / glitch then