In this chapter, we demonstrated infrastructure security testing against the NodeGoat website using RetireJS, OWASP dependency check, SSL communication configuration, and integration with BDD frameworks. These security testing scenarios cover the known vulnerable libraries check, secure SSL configuration check, and basic web security check.
The RetireJS and OWASP dependency check can identify the known CVE of libraries, based on a scan of their project source files. SSLScan is used to inspect any vulnerable HTTPS configurations such as SSL, short encryption keys, and weak HSA or encryption algorithms.
We also illustrated how NMAP NSE can be used to do basic web security inspections such as XSS and SQL injection. An NMAP security scan with the integration of Gauntlt and Robot Framework was also demonstrated. BDD testing techniques can help to make infrastructure security...