← SecurityCédric MerlinFREN

Security galaxy Case 2 of 5

Testing a website faster, without cutting corners

The problem

A web penetration test means hours of browsing the site, recording the exchanges, replaying them and documenting everything.

What I did

01

Automated crawl

I automate the crawl of the application, screen by screen.

02

Everything is recorded

All exchanges are recorded, within the authorised scope.

03

A first triage

Automatic triage discards the noise and flags what deserves my attention.

04

Replayed, then documented

I replay and verify every finding before documenting it.

Diagram: from the automated browser to the documented findingA browser walks through the application. A proxy, within a defined scope, captures the requests. An AI sorts them: most go into the noise pile, a few into the to-review pile. One of them is replayed through the proxy, verified, then a three-line finding is written.out of scopebrowserproxyAInoiseto reviewfinding

The result

Less time on the mechanics, more time on analysis. A method I can reuse from one engagement to the next.

Stack

  • Automation
  • Traffic analysis
  • AI
  • Manual verification