Manual JavaScript Analysis is a Bug

The talk argues that repetitive manual work in application security is a problem to be engineered away. Drawing on a write-up about two equally skilled engineers, one of whom pulled ahead through iterative automation, the speaker proposes a path: document the steps by hand, convert them into static analysis rules, then build a tool that runs on its own. Freed from routine searching, testers can spend more time on business logic flaws and attack chains.

The middle of the talk covers tooling for modern JavaScript applications. Semgrep rules can locate risky sources and sinks in code, while the DOM Invader feature in Burp tracks canary values from input to dangerous functions in the browser. Blind cross-site scripting is caught with out-of-band callbacks, and endpoints and internal domains are pulled from bundled scripts. Source maps can be restored to original code through developer tools. Regular expressions prone to denial of service are found by pairing Semgrep with the recheck tool, secrets are scanned with Semgrep rules, and dependencies are checked with npm audit, yarn audit and retire.js. A proof-of-concept tool combining these open-source checks was demonstrated on a sample project.

The closing section notes that automation misses things, and that a suspected issue is sometimes better written up as a potential finding than chased for days. The speaker recommends automating any task repeated often and keeping per-library checklists, such as cookie flags for express-session, to guide manual review. The takeaway is to automate both static and dynamic analysis across the browser, proxies and source code.