Loading…
10
A pen tester at a 2019 BSides in Austin showed me his Burp extension and I still use it every single engagement
He said 'the tool doesn't matter, it's the 40 lines of Python you write to glue everything together' and that line totally changed how I pick which appsec tools to learn first, so what's the one small script or plugin that ended up doing more for you than any paid scanner?
1 comments
Log in to join the discussion
Log In1 Comment
briancarter26d ago
That Burp extension life is real. Wrote like 30 lines of Python to auto-tag IDORs in a proxy history and it's caught more real bugs than the 5k scanner license sitting on my laptop.
Small glue scripts just fit how your brain works on an engagement. Scanners can't read the room.
6