BlackHat 2014 is coming up quickly. I’ll be back at the BlackHat Arsenal for the third year running demonstrating ThreadFix. Three-peat! This year we’ll be showing off the main ThreadFix application as well as a lot of new components of the growing ThreadFix ecosystem including:
- Scanner plugins for Portswigger Burp and OWASP ZAP that pre-seed scans with application attack surface
- IDE plugins for Eclipse and IntelliJ IDEA that map the results of both SAST and DAST scan results back to specific lines of code for developers.
- The new ThreadFix Jenkins plugin written by Brandon Spruth. This helps better integrate security testing into developers’ continuous integration (CI) systems.
I will be in the Turbo Talks area from 12:15pm until 12:45pm on Thursday August 7th and manning Station 5 from 12:45pm through 2:45pm – come on by!
There are also a number of other tools that work with ThreadFix presenting at the Arsenal this year. Come on by and see:
- Simon Bennetts demonstrating the OWASP Zed Attack Proxy (ZAP) proxy and web application scanner. He’ll be there from 12:45pm until 2:45pm at Station 1 on Wednesday August 6th.
- Jeremy Long demonstrating the Dependency Check vulnerable component scanner. He’ll be there from 12:45pm until 2:45pm at Station 6 on Wednesday August 6th.
- Ryan Barnett demonstrating the mod_security web application firewall (WAF). He’ll be there from 10:00am until noon at Station 4 on Thursday August 7th.
- Andres Riancho demonstrating the w3af web application scanner at Station 2 – also from 12:45pm until 2:45pm on Thursday August 7th.
I’m really looking forward to this – BlackHat Arsenal has always been a great time to meet with ThreadFix users for feedback as well as to show ThreadFix off to potential new users. If you can’t make it by the Arsenal, I’ll be around BSides/BlackHat/DefCon Tuesday night through Friday morning. Hit me up on email (dan _at_ denimgroup _dot_ com) or Twitter (@danielcornell) and we can find a time to link up.
Contact us to talk about running your software security program on ThreadFix. Also if you want to get a head start, pull down the ThreadFix 2.1M2 build and take a look – I’ll be happy to answer any questions at the Arsenal.