Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
public:secureprogramming [2014-05-27 08:47] – [OWASP tools] petrs | public:research:secprog:secureprogramming [2015-02-14 20:29] – [Fuzzing] petrs | ||
---|---|---|---|
Line 81: | Line 81: | ||
* Run cmd with Administrator privileges | * Run cmd with Administrator privileges | ||
* peach configuration.xml | * peach configuration.xml | ||
+ | * Run Peach in agent mode: //peach -a tcp// | ||
+ | * ERROR: Error, could not load platform assembly ' | ||
+ | * Solution: https:// | ||
+ | * ERROR: Could not start monitor " | ||
+ | :\Program Files\Debugging Tools for Windows (x86)\dbgeng.dll' | ||
+ | * set proper path to WinDbg (e.g., c:\Program Files (x86)\Debugging Tools for Windows\) in peach pit file | ||
+ | * <Param name=" | ||
+ | |||
+ | |||
+ | |||
+ | ===== Notes ===== | ||
+ | * Example output for new students: | ||
+ | * Use format of https:// | ||
+ | * High-level metrics: platform... | ||
+ | * Iterative process, highlight to students | ||
+ | * Platform supported | ||
+ | * Properties from Andrii | ||
+ | * IDE integration vs. standalone / server-based tool | ||
+ | * Coverity experience | ||
+ | * 3 bc theses | ||
+ | * Use owasp tools, test against vulnerable apps, evaluate | ||
+ | * Implement personalized testing scenarios inside given framework (he Web Application Hacker' | ||
+ | * multiple scenarios, every week demonstration of progress | ||
+ | * Vulnerability scanners - Nessus, Metasploit... | ||
+ | * Metrics (owasp top 10) | ||
+ | |||
+ | A1 Injection | ||
+ | A2 Broken Authentication and Session Management | ||
+ | A3 Cross-Site Scripting (XSS) | ||
+ | A4 Insecure Direct Object References | ||
+ | A5 Security Misconfiguration | ||
+ | A6 Sensitive Data Exposure | ||
+ | A7 Missing Function Level Access Control | ||
+ | A8 Cross-Site Request Forgery (CSRF) | ||
+ | A9 Using Components with Known Vulnerabilities | ||
+ | A10 Unvalidated Redirects and Forwards | ||
+ | |||
+ | |||
+ | |||
==== OWASP tools ==== | ==== OWASP tools ==== | ||
+ | |||
* List of owasp tools https:// | * List of owasp tools https:// | ||
* https:// | * https:// | ||
+ | |||
+ | ==== Web security testing tool ==== | ||
* w3af framework for manipulating HTTP (fuzzers, crawlers...) http:// | * w3af framework for manipulating HTTP (fuzzers, crawlers...) http:// | ||
* free, opensource | * free, opensource | ||
Line 94: | Line 136: | ||
* Insufficient Access Control | * Insufficient Access Control | ||
* TRY | * TRY | ||
- | * AntiSamy | + | * [2014] OWASP Mantra security testing web browser (build on Firefox) http:// |
- | * API for ensuring user-supplied HTML/CSS is in compliance within an application' | + | * TRY |
+ | * firefox-based browser with large number of security plugins http:// | ||
+ | * [2014] ByWaf https:// | ||
+ | * web application penetration testing framework, command-line interpreter and a set of plugins | ||
+ | * [2011, 2014?] OWASP LAPSE Project https://www.owasp.org/ | ||
+ | * Security Scanner | ||
+ | * eclipse plugin | ||
+ | * TRY | ||
+ | * [2014] OWASP OWTF, the Offensive (Web) Testing Framework https:// | ||
+ | * [2014] XSS detection toolkit https:// | ||
+ | * TRY | ||
+ | * [2014] OWASP ZED Attack Proxy Project https:// | ||
+ | * TRY | ||
+ | * [2014] OSAFT https:// | ||
+ | * ssl testing and auditing tool | ||
+ | * tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations | ||
+ | * try | ||
+ | |||
+ | ==== Vulnerable app / distro / hackme challenges ==== | ||
* [2014] OWASP Insecure Web App Project | * [2014] OWASP Insecure Web App Project | ||
* InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling | * InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling | ||
Line 102: | Line 162: | ||
* TRY | * TRY | ||
* http:// | * http:// | ||
- | * [2014] OWASP Mantra security testing web browser (build on Firefox) http:// | ||
- | * TRY | ||
- | * firefox-based browser with large number of security plugins http:// | ||
* [2013] OWASP Broken Web Applications Project https:// | * [2013] OWASP Broken Web Applications Project https:// | ||
* application with vulnerabilities, | * application with vulnerabilities, | ||
* TRY | * TRY | ||
- | * [2014] ByWaf https:// | ||
- | * web application penetration testing framework, command-line interpreter and a set of plugins | ||
* Damn Vulnerable iOS Application https:// | * Damn Vulnerable iOS Application https:// | ||
* covers all the common vulnerabilities found in iOS applications (following OWASP top 10 mobile risks) and contains several challenges that the user can try | * covers all the common vulnerabilities found in iOS applications (following OWASP top 10 mobile risks) and contains several challenges that the user can try | ||
- | * OWASP Enterprise Security API https:// | ||
- | * Java, .NET, ASP, PHP, Python, JavaScript... | ||
- | * TRY | ||
* [2011] Hackademic Challenges https:// | * [2011] Hackademic Challenges https:// | ||
* vulnerable app, challenges | * vulnerable app, challenges | ||
* TRY | * TRY | ||
- | * [2014] java-html-sanitizer https:// | ||
- | * fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS | ||
- | * XSS prevention sheet https:// | ||
- | * [2014] JSON Sanitizer Project https:// | ||
- | * Given JSON-like content, convert it to valid JSON. Java library | ||
- | * [2011, 2014?] OWASP LAPSE Project https:// | ||
- | * Security Scanner for Java EE Applications | ||
- | * eclipse plugin | ||
- | * TRY | ||
- | * [2014] OWASP OWTF, the Offensive (Web) Testing Framework https:// | ||
* [2013] OWASP Security Shepherd https:// | * [2013] OWASP Security Shepherd https:// | ||
* TRY | * TRY | ||
* security teaching application, | * security teaching application, | ||
- | | + | |
+ | ==== Security-supporting library ==== | ||
+ | |||
+ | | ||
+ | * API for ensuring user-supplied HTML/CSS is in compliance within an application' | ||
+ | * OWASP Enterprise Security API https:// | ||
+ | * Java, .NET, ASP, PHP, Python, JavaScript... | ||
* TRY | * TRY | ||
- | * [2014] | + | * [2014] |
- | * TRY | + | * fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS |
- | * OSAFT https:// | + | * [2014] JSON Sanitizer Project |
- | * ssl testing | + | * Given JSON-like content, convert it to valid JSON. Java library |
- | * try | + | |
+ | |||
+ | ==== Security processes | ||
+ | * XSS prevention sheet https:// | ||
+ | |||
+ | |||
+ | |||