I would be discussing scenarios that I have crossed paths with in my journey to being a pentester. I feel that most of the pentesters relay on intruders instead of logical findings and working dynamically. There should be at least some observational skills and programming skills to at least develop a script that can do the work for you. That can either be an encryption-decryption mechanism or a grep-and-match mechanism from response to the request. Automation with scripting is a necessity as the awareness of hardening application security is increasing. I would like to present a glimpse of how do we observe those mechanisms and build test-cases accordingly then try to perform attacks. https://nsconclave.net-square.com/rebel-against-complex-application-flow.html

2. $ Who am I?
•Security Analyst
@Net Square Solution Pvt. Ltd.
•Wireless Guy
•Forensics Guy
•B.E in Computer Science
SLTIET, Rajkot.
•Twitter: @crashskull
•LinkedIn: crashskull || Nirav Goti

3. Complex Applications?
• Factors of a complex application.
• Architecture
• Parsing
• WAF, Regex, Automations / QA

4. Architecture

5. By Ravi Paghdal

6. Parser(s)

9. @orange.tsai - ssrf

11. Regex, WAF, Automations.

15. Definitely not with a sniper!

16. One doesn't bring sniper to a
street fight.

17. @therealsaumil - The CISO's Dilemma

18. Talk Demo1Demo2

19. Any Questions?

20. See you on the
other side,
nakama!