Talk Title: Automating Web App Security Testing Using Hubot Artificial Intelligence Chat Bot

No ratings

Presented at bsidesdelhi 2017 by

Abhijith Br

Thoufeeque Ns

Abstract: This is the age of Automation, Artificial Intelligence and Machine learning. Even the most sophisticated tasks are being automated. Then why can’t we do the same for security testing as well? Pen-testing as a profession, we will have to repeat a lot of boring tasks on a daily basis. I have tried a lot of ways to automate some tasks using various methods. Finally ended up with Hubot from GitHub, which is an automation/AI Chat framework developed by GitHub using node.js Hubot is popular in the technology world; mostly used for DevOps, ChatOps, DFIR etc This presentation is all about customizing this bot and making it a virtual assistant only for web application testing; we can treat this bot as a person with huge amount of knowledge about information security; it can do so many things it was trained to do. I managed to create and add a bunch of customized security testing interaction scripts to make our job much easier. Other than automating manual testing scenarios, this bot can help us with messy corporate policies and rules. We tends to forget those corporate infosec policies all the time. We could just ask this guy; Hey bot, what is our password policy? Or what’s the list of secure SSL ciphers? Hubot will respond with all possible responses with less error rate. It is possible to interact with our infosec chat from anywhere using mobile interfaces. I’m still working for writing more scripts to automate manual web app security testing; and making this bot much more useful for Web app pen-testers.