OWASP Oslo September meetup

Time: 17:00-19:00 on 7.Sept Location: Rebel, Universitetsgata 2. Room: Auditorium 0100 (https://www.rebel.no/konferansesenter/konferanselokaler/auditorium-0100) Agenda: 17:00 - 17:20: Food and drinks 17:20 - 18:10: Testing API Business Logic With AI Agents: What We Got Wrong First (speaker: @Lucas Thietart) 18:10 - 19:00: From Patch to Pwn: Combining AI and static analysis to create a novel PoC for WP2Shell (speaker: @Katie Paxton-Fear) Escape (https://escape.tech/) and Semgrep (https://semgrep.dev/) is sponsoring this event. The sponsors will provide pizza and something to drink during the talks, and after the talk they will provide something to drink in a nearby bar for those that want to stay and mingle after the talks. ----- Testing API Business Logic With AI Agents: What We Got Wrong First (speaker: @Lucas Thietart) Automating API security testing sounds straightforward until you try it on a real enterprise API with complex auth and business flows. Over the past few years I've been building AI agents to test business logic vulnerabilities. This talk is an honest account of what we got wrong in that process. We'll cover three specific failures: testing before we understood resource relationships (and what that did to our IDOR detection), over-relying on agents for things deterministic methods handle better, and ignoring domain context until it became impossible to ignore. Each failure changed how we built the system. Some of the lessons were obvious in retrospect. None of them were obvious at the time. The goal is to give anyone working on similar problems an honest look at where automated business logic testing actually breaks down and why the gap between a clean test environment and a real enterprise API might be harder to close than it looks. The speaker is @Lucas Thietart (https://www.linkedin.com/in/ACoAAD7fxcsBQQlYzxj_0VsM6dSFRnw92ZiEf2I/). Lucas Thietart is a Solution Architect at Escape, where he helps organizations secure modern applications and APIs through AI-powered pentesting. Leading customer engagements across EMEA, he works closely with security teams to identify exploitable vulnerabilities, integrate security into the SDLC, and strengthen application resilience at scale. His background spans cybersecurity and data engineering, with previous experience at CHANEL and N7 Racing Team. --------- From Patch to Pwn: Combining AI and static analysis to create a novel PoC for WP2Shell How can we bridge the gap between static analysis and dynamic exploitation? Easy, why not use both! We're going to demonstrate how combining SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) workflows can uncover vulnerabilities that are easily missed by either approach in isolation. We'll dive into "WP2Shell" – a disclosed pre-authentication RCE in WordPress – and walk through the process of reverse-engineering a patch to build a novel Proof of Concept (PoC). By utilizing "Mandoline" to slice code and map complex call graphs, we'll identify potential entry points, then use dynamic analysis to observe how those call graphs work in practice. In the session, you'll learn how to use static analysis tools to generate actionable leads for dynamic testing, effectively covering the blind spots of each methodology and accelerating the creation of effective PoCs. The speaker is Katie Paxton-Fear who is Staff Security Advocate at Semgrep.