At BSides Delhi on 27 October 2017 I have presented PentestoBots, my research on using ChatOps and natural language to automate web application security testing.
Penetration testing involves a lot of repetitive work, and many people in the community have already written good scripts to automate parts of it. I wanted to make all of that easy to reach. I took Hubot, the chat bot framework from GitHub, and turned it into an assistant for web application testers. You talk to it in plain language instead of typing commands, and it runs the checks for you.
Our bot was called #Sheru, after the lovable tiger from Malayalam comics. Besides running tests, it could answer the questions people keep asking the security team, such as what the password policy is or which SSL ciphers are allowed. That made it useful for developers and project teams as well as pentesters.
In the live demo I set up a chat room with three teammates and #Sheru, and we asked the bot to run security tasks in plain English. The next step, which I described in the talk, was a bot that could run a basic assessment on its own and come back with a report.
I also wrote about this talk on the blog: PentestoBots, automating web application security testing using an AI/NLP Hubot chat bot.
