Do Threat Models Dream of Fuzzing Apps?

Abstract

we’re introducing a new technique that uses existing tools in a novel way: using a threat model as a configuration file for continuous, adaptive pentesting:

• parse model, get attack surface, risks.
• create scanner inputs for ZAP, Nuclei, and fuzzers.
• Scan
• Filters results
• Report