Content tagged with "devsecops"
Tested with no auth, single role (with 2FA), and multiple roles. Without credentials, the agent autonomously chained SQL Injection → credential extraction → TOTP guessing → admin login. Providing credentials via Secrets Manager enabled stable authenticated testing including 2FA bypass.
AWS officially states Security Agent can test GraphQL APIs, but how well does it actually work? Testing under 4 conditions revealed that HTML link structure is the critical factor — when present, the agent performs GraphQL-specific tests including Introspection, nested query analysis, and Mutation parameter testing.
Tested AWS Security Agent penetration testing with source code provided via documents and sourceCode methods, comparing detection rates and finding quality against URL-only baseline. Source code boosted findings from 5 to 13-28 with 5/5 vulnerability detection.
Verified AWS Security Agent's on-demand penetration testing in Tokyo region. Detected 4/5 planted vulnerabilities (0 false positives) including business logic flaws with HIGH confidence. Cost: ~$136/run.