Differences

This shows you the differences between two versions of the page.

--- public:secureprogramming [2014-05-27 08:45] – [OWASP tools] petrs
+++ public:secureprogramming [2014-09-11 11:40] – [OWASP tools] petrs
@@ Line 81: / Line 81: @@
     * Run cmd with Administrator privileges
       * peach configuration.xml
+===== Notes =====
+  * Example output for new students:
+    * Use format of https://is.muni.cz/auth/th/396518/fi_b/bp.pdf as an example
+    * High-level metrics: platform...
+    * Iterative process, highlight to students
+    * Platform supported
+    * Properties from Andrii
+    * IDE integration vs. standalone / server-based tool
+  * Miro - Coverity experience
+  * 3 bc works
+  * Metrics (owasp top 10)
+    A1 Injection
+    A2 Broken Authentication and Session Management
+    A3 Cross-Site Scripting (XSS)
+    A4 Insecure Direct Object References
+    A5 Security Misconfiguration
+    A6 Sensitive Data Exposure
+    A7 Missing Function Level Access Control
+    A8 Cross-Site Request Forgery (CSRF)
+    A9 Using Components with Known Vulnerabilities
+    A10 Unvalidated Redirects and Forwards
 ==== OWASP tools ====
@@ Line 94: / Line 120: @@
     * Insufficient Access Control
     * TRY
-  * AntiSamy https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET
+  * [2009] AntiSamy https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET
     * API for ensuring user-supplied HTML/CSS is in compliance within an application's rules
   * [2014] OWASP Insecure Web App Project  https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project
@@ Line 133: / Line 159: @@
   * [2014] XSS detection toolkit https://www.owasp.org/index.php/OWASP_Xenotix_XSS_Exploit_Framework
     * TRY
+  * [2014] OWASP ZED Attack Proxy Project https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
+    * TRY
+  * [2014] OSAFT https://www.owasp.org/index.php/O-Saft
+    * ssl testing and auditing tool
+    * tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations
+    * try