Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
public:secureprogramming [2014-09-11 11:40] – [OWASP tools] petrs | public:secureprogramming [2014-09-11 11:51] – petrs | ||
---|---|---|---|
Line 109: | Line 109: | ||
==== OWASP tools ==== | ==== OWASP tools ==== | ||
+ | |||
* List of owasp tools https:// | * List of owasp tools https:// | ||
* https:// | * https:// | ||
+ | |||
+ | ==== Web security testing tool ==== | ||
* w3af framework for manipulating HTTP (fuzzers, crawlers...) http:// | * w3af framework for manipulating HTTP (fuzzers, crawlers...) http:// | ||
* free, opensource | * free, opensource | ||
Line 120: | Line 123: | ||
* Insufficient Access Control | * Insufficient Access Control | ||
* TRY | * TRY | ||
- | * [2009] AntiSamy https:// | ||
- | * API for ensuring user-supplied HTML/CSS is in compliance within an application' | ||
- | * [2014] OWASP Insecure Web App Project | ||
- | * InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling | ||
- | * [2012] Mutillidae | ||
- | * Mutillidae contains all of the vulnerabilties from the OWASP Top 10 | ||
- | * TRY | ||
- | * http:// | ||
* [2014] OWASP Mantra security testing web browser (build on Firefox) http:// | * [2014] OWASP Mantra security testing web browser (build on Firefox) http:// | ||
* TRY | * TRY | ||
* firefox-based browser with large number of security plugins http:// | * firefox-based browser with large number of security plugins http:// | ||
- | * [2013] OWASP Broken Web Applications Project https:// | ||
- | * application with vulnerabilities, | ||
- | * TRY | ||
* [2014] ByWaf https:// | * [2014] ByWaf https:// | ||
* web application penetration testing framework, command-line interpreter and a set of plugins | * web application penetration testing framework, command-line interpreter and a set of plugins | ||
- | * Damn Vulnerable iOS Application https:// | ||
- | * covers all the common vulnerabilities found in iOS applications (following OWASP top 10 mobile risks) and contains several challenges that the user can try | ||
- | * OWASP Enterprise Security API https:// | ||
- | * Java, .NET, ASP, PHP, Python, JavaScript... | ||
- | * TRY | ||
- | * [2011] Hackademic Challenges https:// | ||
- | * vulnerable app, challenges | ||
- | * TRY | ||
- | * [2014] java-html-sanitizer https:// | ||
- | * fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS | ||
- | * XSS prevention sheet https:// | ||
- | * [2014] JSON Sanitizer Project https:// | ||
- | * Given JSON-like content, convert it to valid JSON. Java library | ||
* [2011, 2014?] OWASP LAPSE Project https:// | * [2011, 2014?] OWASP LAPSE Project https:// | ||
* Security Scanner for Java EE Applications | * Security Scanner for Java EE Applications | ||
Line 154: | Line 133: | ||
* TRY | * TRY | ||
* [2014] OWASP OWTF, the Offensive (Web) Testing Framework https:// | * [2014] OWASP OWTF, the Offensive (Web) Testing Framework https:// | ||
- | * [2013] OWASP Security Shepherd https:// | ||
- | * TRY | ||
- | * security teaching application, | ||
* [2014] XSS detection toolkit https:// | * [2014] XSS detection toolkit https:// | ||
* TRY | * TRY | ||
Line 165: | Line 141: | ||
* tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations | * tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations | ||
* try | * try | ||
+ | |||
+ | ==== Vulnerable app / distro / hackme challenges ==== | ||
+ | * [2014] OWASP Insecure Web App Project | ||
+ | * InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling | ||
+ | * [2012] Mutillidae | ||
+ | * Mutillidae contains all of the vulnerabilties from the OWASP Top 10 | ||
+ | * TRY | ||
+ | * http:// | ||
+ | * [2013] OWASP Broken Web Applications Project https:// | ||
+ | * application with vulnerabilities, | ||
+ | * TRY | ||
+ | * Damn Vulnerable iOS Application https:// | ||
+ | * covers all the common vulnerabilities found in iOS applications (following OWASP top 10 mobile risks) and contains several challenges that the user can try | ||
+ | * [2011] Hackademic Challenges https:// | ||
+ | * vulnerable app, challenges | ||
+ | * TRY | ||
+ | * [2013] OWASP Security Shepherd https:// | ||
+ | * TRY | ||
+ | * security teaching application, | ||
+ | |||
+ | ==== Security-supporting library ==== | ||
+ | |||
+ | * [2009] AntiSamy https:// | ||
+ | * API for ensuring user-supplied HTML/CSS is in compliance within an application' | ||
+ | * OWASP Enterprise Security API https:// | ||
+ | * Java, .NET, ASP, PHP, Python, JavaScript... | ||
+ | * TRY | ||
+ | * [2014] java-html-sanitizer https:// | ||
+ | * fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS | ||
+ | * [2014] JSON Sanitizer Project https:// | ||
+ | * Given JSON-like content, convert it to valid JSON. Java library | ||
+ | |||
+ | |||
+ | ==== Security processes and awareness ==== | ||
+ | * XSS prevention sheet https:// | ||
+ | |||
+ | |||
+ | |||
+ | |||