Software Composition Analysis and Secrets Scanning - PenTest+ PT0-003

🎯 Free Hub: https://professorerica.com/pentestplus • 📝 Practice Test: https://professorerica.com/pentestplus-practice - Your application's attack surface includes every dependency it imports and every credential a developer accidentally committed to version control. This video covers Software Composition Analysis with OWASP Dependency-Check, Software Bill of Materials (SBOM), TruffleHog secrets scanning across git history and S3, and how the Equifax 2017 and Log4Shell 2021 breaches could have been caught earlier with SCA tooling. Includes exact command syntax for both tools. Watch the next video for IaC and container vulnerability scanning.

Chapters:
0:00 The Third-Party Problem: Your Code Is Not Your Only Attack Surface
3:05 Software Composition Analysis: Scanning What You Import
5:39 OWASP Dependency-Check in Practice
8:16 Secrets Scanning: Credentials in the Codebase
10:14 TruffleHog: Scanning Git History for Exposed Secrets
12:16 SCA and Secrets in the Pen Test Workflow
15:19 Quiz Time

#softwarecompositionanalysis #SCAsecurity #TruffleHogsecretsscanner #OWASPDependencyCheck #PenTestPT0003

---

Disclosure

The avatars and voices in this video are AI-generated. All content -- research, scripts, lesson design, and the custom video engine -- is created by a CISSP, CISM, and PMP certified professional with a Master's in Project Management, a B.S. in Information Technology, and a Doctorate in Business Administration in progress.

This channel exists to make learning accessible and straightforward.

CompTIA® and PenTest+® are registered trademarks of CompTIA, Inc. This channel is not affiliated with, endorsed by, or sponsored by CompTIA. All content is produced independently for educational purposes only. All penetration testing techniques shown are for authorized, legal use only — obtain written permission before testing any system you do not own. For official exam objectives, pricing, and policies visit comptia.org.

Видео Software Composition Analysis and Secrets Scanning - PenTest+ PT0-003 канала Professor Erica