Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| public:secureprogramming [2014-09-11 11:30] – petrs | public:secureprogramming [2014-09-11 11:51] – [OWASP tools] petrs | ||
|---|---|---|---|
| Line 86: | Line 86: | ||
| * Use format of https:// | * Use format of https:// | ||
| * High-level metrics: platform... | * High-level metrics: platform... | ||
| - | * 1st iteration | + | * Iterative process, highlight to students |
| * Platform supported | * Platform supported | ||
| * Properties from Andrii | * Properties from Andrii | ||
| * IDE integration vs. standalone / server-based tool | * IDE integration vs. standalone / server-based tool | ||
| * Miro - Coverity experience | * Miro - Coverity experience | ||
| - | * | + | * 3 bc works |
| + | * Metrics (owasp top 10) | ||
| + | |||
| + | A1 Injection | ||
| + | A2 Broken Authentication and Session Management | ||
| + | A3 Cross-Site Scripting (XSS) | ||
| + | A4 Insecure Direct Object References | ||
| + | A5 Security Misconfiguration | ||
| + | A6 Sensitive Data Exposure | ||
| + | A7 Missing Function Level Access Control | ||
| + | A8 Cross-Site Request Forgery (CSRF) | ||
| + | A9 Using Components with Known Vulnerabilities | ||
| + | A10 Unvalidated Redirects and Forwards | ||
| ==== OWASP tools ==== | ==== OWASP tools ==== | ||
| + | |||
| * List of owasp tools https:// | * List of owasp tools https:// | ||
| * https:// | * https:// | ||
| + | |||
| + | ==== Web security testing tool ==== | ||
| * w3af framework for manipulating HTTP (fuzzers, crawlers...) http:// | * w3af framework for manipulating HTTP (fuzzers, crawlers...) http:// | ||
| * free, opensource | * free, opensource | ||
| Line 107: | Line 123: | ||
| * Insufficient Access Control | * Insufficient Access Control | ||
| * TRY | * TRY | ||
| - | * AntiSamy | + | * [2014] OWASP Mantra security testing web browser (build on Firefox) http:// |
| - | * API for ensuring user-supplied HTML/CSS is in compliance within an application' | + | * TRY |
| + | * firefox-based browser with large number of security plugins http:// | ||
| + | * [2014] ByWaf https:// | ||
| + | * web application penetration testing framework, command-line interpreter and a set of plugins | ||
| + | * [2011, 2014?] OWASP LAPSE Project https://www.owasp.org/ | ||
| + | * Security Scanner | ||
| + | * eclipse plugin | ||
| + | * TRY | ||
| + | * [2014] OWASP OWTF, the Offensive (Web) Testing Framework https:// | ||
| + | |||
| + | ==== Vulnerable app / distro / hackme challenges ==== | ||
| * [2014] OWASP Insecure Web App Project | * [2014] OWASP Insecure Web App Project | ||
| * InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling | * InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling | ||
| Line 115: | Line 141: | ||
| * TRY | * TRY | ||
| * http:// | * http:// | ||
| - | * [2014] OWASP Mantra security testing web browser (build on Firefox) http:// | ||
| - | * TRY | ||
| - | * firefox-based browser with large number of security plugins http:// | ||
| * [2013] OWASP Broken Web Applications Project https:// | * [2013] OWASP Broken Web Applications Project https:// | ||
| * application with vulnerabilities, | * application with vulnerabilities, | ||
| * TRY | * TRY | ||
| - | * [2014] ByWaf https:// | ||
| - | * web application penetration testing framework, command-line interpreter and a set of plugins | ||
| * Damn Vulnerable iOS Application https:// | * Damn Vulnerable iOS Application https:// | ||
| * covers all the common vulnerabilities found in iOS applications (following OWASP top 10 mobile risks) and contains several challenges that the user can try | * covers all the common vulnerabilities found in iOS applications (following OWASP top 10 mobile risks) and contains several challenges that the user can try | ||
| - | * OWASP Enterprise Security API https:// | ||
| - | * Java, .NET, ASP, PHP, Python, JavaScript... | ||
| - | * TRY | ||
| * [2011] Hackademic Challenges https:// | * [2011] Hackademic Challenges https:// | ||
| * vulnerable app, challenges | * vulnerable app, challenges | ||
| + | * TRY | ||
| + | |||
| + | ==== Security-supporting library ==== | ||
| + | |||
| + | * [2009] AntiSamy https:// | ||
| + | * API for ensuring user-supplied HTML/CSS is in compliance within an application' | ||
| + | * OWASP Enterprise Security API https:// | ||
| + | * Java, .NET, ASP, PHP, Python, JavaScript... | ||
| * TRY | * TRY | ||
| * [2014] java-html-sanitizer https:// | * [2014] java-html-sanitizer https:// | ||
| * fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS | * fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS | ||
| - | * XSS prevention sheet https:// | ||
| * [2014] JSON Sanitizer Project https:// | * [2014] JSON Sanitizer Project https:// | ||
| * Given JSON-like content, convert it to valid JSON. Java library | * Given JSON-like content, convert it to valid JSON. Java library | ||
| - | | + | |
| - | * Security Scanner for Java EE Applications | + | |
| - | * eclipse plugin | + | ==== Security processes and awareness ==== |
| - | * TRY | + | |
| - | * [2014] OWASP OWTF, the Offensive (Web) Testing Framework https:// | + | |
| + | |||
| + | |||
| * [2013] OWASP Security Shepherd https:// | * [2013] OWASP Security Shepherd https:// | ||
| * TRY | * TRY | ||