OWASP - User contributions [en]

Hong Kong

2017-02-21T08:50:18Z

Anthonylai:

http://www.pisa.org.hk/event/owasp-hk_logo.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user and security groups including VXRL in Hong Kong.

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== OWASP HK Chapter Core ==
Facebook: https://www.facebook.com/OwaspHongKongChapter

== News from Hong Kong Chapter ==

''' OWASP TechDay 2017'''

'''Time: 0930 - 1730'''

'''Venue: LTG, HKUST''

'''Details:'''

We will hold a seminar on 11 March in HKUST:

Please kindly find the details including agenda, venue and registration in the URL below:
https://www.eventbrite.hk/e/owasp-techday-2017-hk-tickets-32188270985

Thank you for your joining.

Some speakers are OWASP Core Members have been involved in various Web application research and CTF games, please come and enjoy.

We are thankful to HKUST to sponsor the venue and host the event with us.

Organizer: OWASP Hong Kong Chapter
Co-Host: HKUST Computer Science Department

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]
[[Category:Asia]]

Hong Kong

2017-02-21T06:11:51Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.pisa.org.hk/event/owasp-hk_logo.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== OWASP HK Chapter Core ==
Facebook: https://www.facebook.com/OwaspHongKongChapter

== News from Hong Kong Chapter ==

''' OWASP TechDay 2017'''

'''Time: 0930 - 1730'''

'''Venue: LTG, HKUST''

'''Details:'''

We will hold a seminar on 11 March in HKUST:

Please kindly find the details including agenda, venue and registration in the URL below:
https://www.eventbrite.hk/e/owasp-techday-2017-hk-tickets-32188270985

Thank you for your joining.

All speakers are OWASP Core Members and/or VXRL researchers and have been involved in various Web application research and CTF games, please come and enjoy.

We are thankful to HKUST to sponsor the venue and host the event with us.

Organizer: OWASP Hong Kong Chapter
Co-Host: HKUST Computer Science Department

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]
[[Category:Asia]]

Hong Kong

2013-07-12T16:11:39Z

Anthonylai: /* OWASP HK Chapter Core */

http://www.pisa.org.hk/event/owasp-hk_logo.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== OWASP HK Chapter Core ==
Facebook: https://www.facebook.com/OwaspHongKongChapter

== News from Hong Kong Chapter ==

'''Seminar: OWASP HK Chapter: Half-Day Event on 27 July (Sat)'''

'''Time: 1400 - 1730'''

'''Venue: R502, Polytechnic Univiesity, Hunghom'''

'''Details:'''

We will hold a seminar on 27 July with the following topic and speakers:

OWASP Top 10 2013 Update - Anthony Lai, SANS GWAPT

CTF for Fun and Profit - Anthony Lai, SANS GWAPT

Mobile Phone Browser XSS - Alan Ho, SANS GWAPT (Gold paper)

Crypto and Web Hack - Zetta KE, PhD student, ISMS, HKUST

The time would be from 1400 to 1800 held in Polytechnic University. We will keep you posted on the venue. Please reach me for registration with your full nam e and email address.

Thank you for your joining.

All speakers are VXRL researchers and have been involved in various Web application research and CTF games, please come and enjoy

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]
[[Category:Asia]]

Hong Kong

2013-07-12T05:51:25Z

Anthonylai:

http://www.pisa.org.hk/event/owasp-hk_logo.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== OWASP HK Chapter Core ==
To be listed later.

== News from Hong Kong Chapter ==

'''Seminar: OWASP HK Chapter: Half-Day Event on 27 July (Sat)'''

'''Time: 1400 - 1730'''

'''Venue: R502, Polytechnic Univiesity, Hunghom'''

'''Details:'''

We will hold a seminar on 27 July with the following topic and speakers:

OWASP Top 10 2013 Update - Anthony Lai, SANS GWAPT

CTF for Fun and Profit - Anthony Lai, SANS GWAPT

Mobile Phone Browser XSS - Alan Ho, SANS GWAPT (Gold paper)

Crypto and Web Hack - Zetta KE, PhD student, ISMS, HKUST

The time would be from 1400 to 1800 held in Polytechnic University. We will keep you posted on the venue. Please reach me for registration with your full nam e and email address.

Thank you for your joining.

All speakers are VXRL researchers and have been involved in various Web application research and CTF games, please come and enjoy

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]
[[Category:Asia]]

Hong Kong

2013-07-12T05:41:40Z

Anthonylai: /* News from Hong Kong Chapter */

Hong Kong

2008-12-16T08:15:32Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 16 Dec 2008 : '''The speaker will arrive on 19 Dec and please bring USB storage more than 8GB to copy the VM for practice later on)
Please act fast to reserve it first and the current reservation is 30. The class size is expected to be at most 35.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 17:30
Breaks: 15 minutes each (from 11:30 to 11:45 and 16:00 to 16:15)

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee' (For PISA, HTCIA and OWASP members)''

1000 HKD (On or Before 13 Dec)

1500 HKD (From 14 and before 18 Dec 2008)

'''Fee' (For others)''

2000 HKD (On or Before 13 Dec)

2500 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-08T06:17:55Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 4 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 24. The class size is expected to be at most 35.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee' (For PISA, HTCIA and OWASP members)''

1000 HKD (On or Before 13 Dec)

1500 HKD (From 14 and before 18 Dec 2008)

'''Fee' (For others)''

2000 HKD (On or Before 13 Dec)

2500 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-08T04:11:46Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 4 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 24. The class size is expected to be at most 35.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Supporting Organization'''
PISA (Professional Information Security Association)(www.pisa.org.hk)

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee' (For PISA, HTCIA and OWASP members)''

1000 HKD (On or Before 13 Dec)

1500 HKD (From 14 and before 18 Dec 2008)

'''Fee' (For others)''

2000 HKD (On or Before 13 Dec)

2500 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-07T17:32:16Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 4 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 24. The class size is expected to be at most 35.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Supporting Organization'''
PISA (Professional Information Security Association)(www.pisa.org.hk)

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee' (For PISA, HTCIA and OWASP members)''

1000 HKD (On or Before 8 Dec)

1500 HKD (After 8 and before 13 Dec 2008)

1800 HKD (After 13 and before 18 Dec 2008)

'''Fee' (For others)''

2000 HKD (On or Before 8 Dec)

2500 HKD (After 8 and before 13 Dec 2008)

2800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-04T02:53:03Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 4 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 24. The class size is expected to be at most 35.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Supporting Organization'''
PISA (Professional Information Security Association)(www.pisa.org.hk)

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''

1000 HKD (Before 8 Dec)

1500 HKD (After 8 and before 13 Dec 2008)

1800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-04T02:41:35Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 3 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 23. The class size is expected to be at most 35~40.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Supporting Organization'''
PISA (Professional Information Security Association)(www.pisa.org.hk)

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''

1000 HKD (Before 8 Dec)

1500 HKD (After 8 and before 13 Dec 2008)

1800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-03T03:31:37Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 3 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 23. The class size is expected to be at most 35~40.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''

1000 HKD (Before 8 Dec)

1500 HKD (After 8 and before 13 Dec 2008)

1800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-03T03:31:06Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 3 Dec 2008 : '''The speaker has been notified by the agency and he will get the VISA on 6/7 Dec.
Please act fast to reserve it first and the current reservation is 23. The class size is expected to be at most 35~40.

Payment Method:

1) Send the payment to: Hang Seng Bank, 390-031367-888 and then send back the receipt to anthonation@gmail.com and anthonylai@owasp.org

2) Please reach me if you have enquiry at +852 6778 2668.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''

1000 HKD (Before 8 Dec)

1500 HKD (After 8 and before 13 Dec 2008)

1800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-03T03:27:14Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 6 Nov 2008 : '''The speaker has got my invitation letter and he is now applying the traveling VISA to Hong Kong.
Money collection will start once he confirmed me the air ticket and VISA application. However, you need to reserve it as there are already 17 reservations. The class size is expected to be 30-40.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''

1000 HKD (Before 8 Dec)

1500 HKD (After 8 and before 13 Dec 2008)

1800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-03T03:25:57Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 6 Nov 2008 : '''The speaker has got my invitation letter and he is now applying the traveling VISA to Hong Kong.
Money collection will start once he confirmed me the air ticket and VISA application. However, you need to reserve it as there are already 17 reservations. The class size is expected to be 30-40.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''
1000 HKD (Before 8 Dec)
''
1500 HKD (After 8 and before 13 Dec 2008)
''
1800 HKD (After 13 and before 18 Dec 2008)
''
Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-12-03T03:25:19Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 6 Nov 2008 : '''The speaker has got my invitation letter and he is now applying the traveling VISA to Hong Kong.
Money collection will start once he confirmed me the air ticket and VISA application. However, you need to reserve it as there are already 17 reservations. The class size is expected to be 30-40.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''
1000 HKD (Before 8 Dec)
1500 HKD (After 8 and before 13 Dec 2008)
1800 HKD (After 13 and before 18 Dec 2008)

Seats are limited and expected lab size at most 40. The current reservation is 24 (Last updated: 3 Dec 2008)

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-11-06T16:07:32Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 6 Nov 2008 : '''The speaker has got my invitation letter and he is now applying the traveling VISA to Hong Kong.
Money collection will start once he confirmed me the air ticket and VISA application. However, you need to reserve it as there are already 17 reservations. The class size is expected to be 30-40.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''
1000 HKD

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

a. Overwrite critical variable

b. Overwrite return address

c. Return to .text

d. Return to libc

e. Overwrite .dtors

f. Overwrite .got

g. Overwrite .bss, functors

h. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-11-06T16:06:27Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

'''Status - 6 Nov 2008 : '''The speaker has got my invitation letter and he is now applying the traveling VISA to Hong Kong.
Money collection will start once he confirmed me the air ticket and VISA application. However, you need to reserve it as there are already 17 reservations. The class size is expected to be 30-40.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''
1000 HKD

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

1. Overwrite critical variable

2. Overwrite return address

3. Return to .text

4. Return to libc

5. Overwrite .dtors

6. Overwrite .got

7. Overwrite .bss, functors

8. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-11-06T16:05:32Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.

Status: The speaker has got my invitation letter and he is now applying the traveling VISA to Hong Kong.
Money collection will start once he confirmed me the air ticket and VISA application. However, you need to reserve it as there are already 17 reservations. The class size is expected to be 30-40.

''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter) and PISA

'''Co-organizer and Venue Sponsorship'''
Vocational Training Council (Haking Wong)

'''Fee'''
1000 HKD

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

1. Overwrite critical variable

2. Overwrite return address

3. Return to .text

4. Return to libc

5. Overwrite .dtors

6. Overwrite .got

7. Overwrite .bss, functors

8. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Hong Kong

2008-11-06T08:27:51Z

Anthonylai: /* News from Hong Kong Chapter */

http://www.infosechk.org/download/OWASP/owasp_banner.jpg

{{Chapter Template|chaptername=Hong Kong|extra=The chapter leader is [mailto:anthonylai@owasp.org Anthony LAI,CISSP,CISA]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hongkong|emailarchives=http://lists.owasp.org/pipermail/owasp-hongkong}}
----

<paypal>Hong Kong</paypal>

The Hong Kong chapter was formed in December 2004. The objectives to establish OWASP Hong Kong Chapter are mainly because:
-There are many web applications established in past 10 years. However, how many developers know that their developed application are secure. Meanwhile, there are many transactional-based systems, we should not ignore that the web application is another channel for hackers to compromise one's confidential information and interrupt any critical business operations.

- Raise the security awareness of web application development among the professionals.

- Encourage professionals to reference standard like ISO7799 for their web application security and post-deployment review as well as audit.

- Accelerate to Share, learn, discuss and review best practices of the experienced web application development security professionals even across various user groups (Java User Group and .NET User Group ) and security associations (i.e. PISA) in Hong Kong.

http://www.clarencewong.com/photo/owasp_meeting.jpg

''From left to right: James Tsao, Anthony Lai, David Walker, Richard Stagg, Marco Leung and Gary Kung''

'''Coding Practice'''

- Mainstream web technologies (i.e. .NET, J2EE and PHP on Linux) security assessment

- Web application platform (i.e. Apache, IIS, Linux, Database) security assessment and review.

- Recent Web application security concerns.

- Regularly convey latest projects and presentations from OWASP.

== News from Hong Kong Chapter ==

'''NEW!!!! Software Exploitation - It is about reverse engineering and exploit'''

''
I feel very honorable to invite Nguyen NAM to provide 2-day workshop on software exploit and reverse engineering. In fact, we met in OWASP Appsec Conference 2008 at Taipei and his team has won CTF (Capture The Flag) in Hack In The Box (HITB) 2008. It is really a valuable chance to have him to be in Hong Kong and this workshop is normally charged at 1000 USD per head. Meanwhile, there is NO such kind of workshop held in Hong Kong. Please reach me at [[anthonylai@owasp.org]] for reservation.
''

'''Instructor'''
Nam Nguyen

'''Date and Time'''
2 days, 20 - 21 Dec 2008 (Sat and Sun)
Registration Time: 9:45am
Time: 10:00 - 13:00; 14:30 - 18:00

'''Venue'''
Room 172, IVE Haking Wong, Cheung Sha Wan

'''Organizer'''
OWASP (Hong Kong Chapter)

'''Co-organizer and Venue Sponsorship'''
PISA and Vocational Training Council (Haking Wong)

'''Fee'''
1000 HKD

'''Summary'''
This course is a primer into software exploitation on the Linux environment.
The course assumes only basic understanding of the Linux commands, and C
programming with the standard library. It explains the computer
architecture, assembly language then moves on to three basic classes of
security bug: buffer overflow, format string, and race condition and methods
to take advantage of them. Throughout the course, various examples are
introduced with increasing difficulty so that participants will naturally
realize the art of software exploitation for themselves.

This course does not discuss about shell coding. Except on one example where
provided shell code is used as an illustration, all other challenges require
only good analysis and calculation.

The course is conducted as a workshop with heavy interaction between
participants and instructor. There will not be any presentation slide.
Participants are to take note during the course.

'''Audience'''

Software developers, system administrators, security engineers \with some
experience in Linux and C programming. It is good to prepare a candidate to
join for Capture The Flag (CTF) event.

'''Table of Contents'''

1. Computer architecture

2. Assembly language

3. Buffer overflow

4. Format string

5. Race condition

6. Techniques

1. Overwrite critical variable

2. Overwrite return address

3. Return to .text

4. Return to libc

5. Overwrite .dtors

6. Overwrite .got

7. Overwrite .bss, functors

8. By pass Advanced Space Layout Randomization

7. Tools of the trade: IDA, GDB, and Python

8. Sharing of CTF in HITB

'''Workshop Specifics'''
As we have got a lab. An VM image will be provided.

'''Speaker Biography'''
Nam Nguyen is currently the principal security consultant with Blue
Moon Consulting Co., Ltd. He started poking at binaries when he
couldn't finish Dune 2 and has since spent more than a decade reverse
engineering and understanding how stuffs work.
Nam is a CISSP, a core member of the VNSecurity group, and a chapter
lead of OWASP Vietnam. His interests include code construction and
destruction, decompilation and Python.

----

http://www.infosecurityproject.com/images/infosec2007_content_04.jpg

'''OWASP(HK Chapter) supports 8th Infosecurityproject Conference:'''
URL:http://www.infosecurityproject.com/

http://www.takungpao.com/images/new.gif'''OWASAP Committee Member, Richard Stagg, uncovered Security Reality (Mar 2007)
Richard from Handshake Networking could tell you the truth of that.
URL:http://www.cw.com.hk/computerworldhk/article/articleDetail.jsp?id=409104

'''Hong Kong Standard: HKU changes Internet policy to boost security
Hong Kong University has changed its Internet policy a week after The Standard reported that improperly indexed material listed on its Web sites could be accessed by users of the Google Internet search engine. Doug Crets 4/3/2006'''

URL: http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15675&sid=7341056&con_type=1&d_str=20060403&sear_year=2006

'''Hong Kong Standard: Online enemy within
The biggest threats to computer users are not hackers but their own ignorance, complacency or carelessness, writes Doug Crets 3/27/2006'''
URL:http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=15121&sid=7238709&con_type=1&d_str=20060327&sear_year=2006

'''Web Application Security with PISA:''' http://www.pisa.org.hk/event/web-appl-sec.htm

http://www.pisa.org.hk/event/web-appl-sec.jpg

'''OWASP (Hong Kong Chapter): Successful Web Application Security and Hacking Demo seminar co-organized with Hong Kong Java User Group (30 Jul 2005'''
https://hkjug.dev.java.net/gatherings/2005/0730.html
http://www.infosechk.org/download/OWASP/20050730/2_exposure.JPG

'''OWASP (Hong Kong Chapter): Web Application Security organized with Sun Wah Pearl Linux (29 Oct 2005)'''

http://www.infosechk.org/download/OWASP/20051029/seminar.jpg

== Contact Us ==

'''Chapter Mailbox'''

P.O. Box No. 6684, General Post Office, Hong Kong SAR

== Recent Update ==
--[[User:Anthonylai|Anthony Lai]] 11:25, 6 July 2006 (EDT)

[[Category:China]]

Anthony Lai (Dark Floyd), OWASP HK Chapter

2008-10-22T18:20:14Z

Anthonylai:

Anthony Lai (Dark Floyd)

Dark Floyd (hacker alias used in oCTF@DefCon) is a regional senior risk consultant in an European financial institute to oversee on risk assessment, technology risk management and penetration verification in the APAC region. His major interests are reverse engineering, exploit development, web application security, hacking investigation, response and forensic.

He is the chapter leader of OWASP (Hong Kong), program committee member of PISA (www.pisa.org.hk), program director of HTCIA (Asia Pacific Chapter)(www.htcia.org.hk) and founder/editor of InfoSec Hong Kong web site (www.infosechk.org)

He could be reached at anthonylai@owasp.org (however, I am waiting for head office to reset my password...) and anthony.lai@htcia.org.hk

OWASP AppSec Asia 2008 - Taiwan

2008-10-22T18:15:12Z

Anthonylai: /* (2008/10/27) - Day 1 */

Welcome to OWASP AppSec Asia 2008! We'd like to thank China, Delhi, Hong Kong, Korea, Mumbai, Singapore, Taiwan, Thailand, and Vietnam Chapters for helping out with the conference and for attending the conference. We are working with other chapters across Asia to see if we can invite more chapters. If you represent an Asia chapter and are interested in participating, please [mailto:wayne.owasp@gmail.com email us].

Two professional translators will be at the conference to conduct simultaneous oral translation between English and Mandarin. Wireless earphones will be provided.

[[Image:Map2.png|center]]

== OWASP AppSec Asia 2008, Conference Schedule (Oct 27th - Oct 28th) ==

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" |
=== (2008/10/27) - Day 1 ===
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 08:30 - 09:30 Door opens for registration
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:30- 09:40''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Opening welcome and an introduction to this year’s program]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Wayne Huang, Conference Chair]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:40-09:50''' || style="width:30%; background:#A7BFDE" align="center" | '''Welcome by Institute for Information Industry '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:50-10:00''' || style="width:30%; background:#A7BFDE" align="center" | '''Welcome by Information Security Consortium, Information Service Industry Association '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''10:00-10:50''' || style="width:30%; background:#A7BFDE" align="center" | ''' [[What's Next? Strategies for Web Application Security]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' [[YM Chen, Director, Foundstone, A Division of McAfee]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''11:00-11:50''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Web-based Malware obfuscation: the kung-fu and the detection]]'''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' [[Wayne Huang, OWASP Taiwan Chapter]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 11:50 - 12:40 Lunch
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''12:40 - 13:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Good Business Penetration Testing]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[KK Mookhey (OWASP Mumbai)]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | '''13:40 - 15:40 Asia Chapter Leader Meeting'''
'''Attendee:''' China, Delhi, HK, Korea, Mumbai, Singapore, Taiwan, Thailand, and Vietnam Chapters

'''P.S:''' Meeting with go in parallel to the two of the talk sessions and coffee break.
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''13:40 - 14:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[How bad can Web vulnerabilities be—case study on a 50 million personal records breach]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[PK (Taiwan Criminal Investigation Bureau)]] '''
|-

|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 14:30 - 14:50 Coffee Break
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''14:50 - 15:40''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Tiny coding errors, big losses: real stories of website 0wnage]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Fyodor Yarochkin (Guard-Info)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''15:50 - 16:40''' || style="width:30%; background:#A7BFDE" align="center" | '''Web Application Proactive and Passive Defense Best Practices
 '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Frank Yuan Fan, OWASP China Chapter]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''16:50 - 17:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Why Webmail systems are hard to secure--using real case studies]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Charmi Lin (Taiwan Information & Communication Security Technology Center)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''17:40 - 18:10''' || style="width:30%; background:#A7BFDE" align="center" | '''Penetration Test with BackTrack: Metasploit and Meterpreter '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Anthony Lai (Dark Floyd), OWASP HK Chapter]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" |

=== (2008/10/28) - Day 2 ===
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:00- 10:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[New 0-Day Browser Exploits: Clickjacking - yea, this is bad...]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Robert "RSnake" Hansen (SecTheory)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''10:40- 11:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Web 2.0, Consumerization, and Application Security]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Chenxi Wang, Ph.D. (Forrester Research)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''11:40- 12:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Crossing the Chasm: Anatomy of Client-Side and Browser-Based Attacks]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Dhruv Soi (OWASP Delhi Chapter Leader)]], [[Pukhraj Singh (OWASP Delhi Chapter)]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 12:30 - 13:30 Lunch
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''13:30 - 14:20''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Proxy Caches and Web Application Security--using the recent Google Docs 0-day as an example]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Tim Bass, OWASP Thailand]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''14:30 - 15:20''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Best Practices Guide: Web Application Firewalls]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Alexander Meisel (OWASP Germany)]] '''
|-
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 15:20 - 15:40 Coffee Break
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''15:40 - 16:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[The HTTP Botnet Research: Focusing on HTTP based DDoS Botnets]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Steven Adair (ShadowServer Foundation)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''16:40 - 17:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Panel: Manual auditing or automated tools? Blackbox, whitebox, or WAF?]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[https://www.owasp.org/index.php/Alexander_Meisel_(OWASP_Germany) Alex], [https://www.owasp.org/index.php/Chenxi_Wang%2C_Ph.D._(Forrester_Research) Chenxi], [https://www.owasp.org/index.php/Dhruv_Soi_(OWASP_Delhi_Chapter_Leader) Dhruv], [https://www.owasp.org/index.php/Frank_Fan%2C_OWASP_China Frank Fan], [https://www.owasp.org/index.php/Fyodor_(Guard-Info) Fyodor], [https://www.owasp.org/index.php/KK_Mookhey_(OWASP_Mumbai) KK], [https://www.owasp.org/index.php/Robert_%22RSnake%22_Hansen_(SecTheory) Robert], [https://www.owasp.org/index.php/Tim_Bass%2C_OWASP_Thailand Tim Bass], [https://www.owasp.org/index.php/Wayne_Huang%2C_OWASP_Taiwan_Chapter Wayne], [https://www.owasp.org/index.php/YM_Chen%2C_Director%2C_McAfee_Foundstone YM] '''
|-

|}

==Conference Fees & Registration==

=== Conference Fees ===

The fee for the two days conference is USD 35, which includes:
*Two lunches
*Coffee breaks
*Conference T-Shirt

=== Registration ===

Registration is now open!! Please [mailto:wayne.owasp@gmail.com '''contact us'''] for the registration.

== Conference T-Shirt ==
[[Image:OWAS AppSec Asia Tshirt.png]]

== Conference Venue==

'''NTUH International Convention Center'''

'''Address:''' No. 2, Xuzhou Road, Zhongzheng District 101, Taipei City

'''[http://www.thcc.net.tw/en/index.htm Website]'''

'''[http://www.thcc.net.tw/en/about04.htm Map and transport Information]'''

== Hotel Information ==

'''San Want Hotel'''

'''Address:''' No.172, Sec. 4, ZhongXiao East Road, Taipei, Taiwan

Tel:+886-2-2772-2121 ｜ Fax : +886-2-2721-0302

'''[http://www.sanwant.com/ Website]'''

'''Hope City FuShing Hotel'''

'''Address:''' No.275, Sec.1, Fushing S. Rd., Taipei, Taiwan

Tel : +886-2-2703-9990 ｜ Fax : +886-2-2706-8547

'''[http://www.city-hotel.com.tw/bussiness/b2/b2-en.htm Website]'''

== Taipei City Map - With OWASP Venue and Hotels Marked ==

[[Image:Owasp_appsec_asia_2007_tpe_map-1.psd|center]]

== Welcome to Taiwan==
And WELCOME TO TAIWAN! Please check out [http://tw.youtube.com/watch?v=wRc0q9xQEQ4 this video] about interesting places in Taiwan.
If you need suggestions on how to plan out your trip, please feel free to [mailto:wayne.owasp@gmail.com '''contact us!''']

OWASP AppSec Asia 2008 - Taiwan

2008-10-22T18:05:22Z

Anthonylai: /* (2008/10/27) - Day 1 */

Welcome to OWASP AppSec Asia 2008! We'd like to thank China, Delhi, Hong Kong, Korea, Mumbai, Singapore, Taiwan, Thailand, and Vietnam Chapters for helping out with the conference and for attending the conference. We are working with other chapters across Asia to see if we can invite more chapters. If you represent an Asia chapter and are interested in participating, please [mailto:wayne.owasp@gmail.com email us].

Two professional translators will be at the conference to conduct simultaneous oral translation between English and Mandarin. Wireless earphones will be provided.

[[Image:Map2.png|center]]

== OWASP AppSec Asia 2008, Conference Schedule (Oct 27th - Oct 28th) ==

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" |
=== (2008/10/27) - Day 1 ===
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 08:30 - 09:30 Door opens for registration
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:30- 09:40''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Opening welcome and an introduction to this year’s program]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Wayne Huang, Conference Chair]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:40-09:50''' || style="width:30%; background:#A7BFDE" align="center" | '''Welcome by Institute for Information Industry '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:50-10:00''' || style="width:30%; background:#A7BFDE" align="center" | '''Welcome by Information Security Consortium, Information Service Industry Association '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''10:00-10:50''' || style="width:30%; background:#A7BFDE" align="center" | ''' [[What's Next? Strategies for Web Application Security]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' [[YM Chen, Director, Foundstone, A Division of McAfee]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''11:00-11:50''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Web-based Malware obfuscation: the kung-fu and the detection]]'''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' [[Wayne Huang, OWASP Taiwan Chapter]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 11:50 - 12:40 Lunch
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''12:40 - 13:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Good Business Penetration Testing]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[KK Mookhey (OWASP Mumbai)]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | '''13:40 - 15:40 Asia Chapter Leader Meeting'''
'''Attendee:''' China, Delhi, HK, Korea, Mumbai, Singapore, Taiwan, Thailand, and Vietnam Chapters

'''P.S:''' Meeting with go in parallel to the two of the talk sessions and coffee break.
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''13:40 - 14:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[How bad can Web vulnerabilities be—case study on a 50 million personal records breach]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[PK (Taiwan Criminal Investigation Bureau)]] '''
|-

|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 14:30 - 14:50 Coffee Break
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''14:50 - 15:40''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Tiny coding errors, big losses: real stories of website 0wnage]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Fyodor Yarochkin (Guard-Info)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''15:50 - 16:40''' || style="width:30%; background:#A7BFDE" align="center" | '''Web Application Proactive and Passive Defense Best Practices
 '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Frank Yuan Fan, OWASP China Chapter]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''16:50 - 17:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Why Webmail systems are hard to secure--using real case studies]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Charmi Lin (Taiwan Information & Communication Security Technology Center)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''17:40 - 18:10''' || style="width:30%; background:#A7BFDE" align="center" | '''Penetration Test with BackTrack: Art of Exploitation '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Anthony Lai (Dark Floyd), OWASP HK Chapter]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" |

=== (2008/10/28) - Day 2 ===
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:00- 10:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[New 0-Day Browser Exploits: Clickjacking - yea, this is bad...]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Robert "RSnake" Hansen (SecTheory)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''10:40- 11:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Web 2.0, Consumerization, and Application Security]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Chenxi Wang, Ph.D. (Forrester Research)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''11:40- 12:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Crossing the Chasm: Anatomy of Client-Side and Browser-Based Attacks]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Dhruv Soi (OWASP Delhi Chapter Leader)]], [[Pukhraj Singh (OWASP Delhi Chapter)]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 12:30 - 13:30 Lunch
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''13:30 - 14:20''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Proxy Caches and Web Application Security--using the recent Google Docs 0-day as an example]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Tim Bass, OWASP Thailand]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''14:30 - 15:20''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Best Practices Guide: Web Application Firewalls]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Alexander Meisel (OWASP Germany)]] '''
|-
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 15:20 - 15:40 Coffee Break
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''15:40 - 16:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[The HTTP Botnet Research: Focusing on HTTP based DDoS Botnets]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Steven Adair (ShadowServer Foundation)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''16:40 - 17:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Panel: Manual auditing or automated tools? Blackbox, whitebox, or WAF?]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[https://www.owasp.org/index.php/Alexander_Meisel_(OWASP_Germany) Alex], [https://www.owasp.org/index.php/Chenxi_Wang%2C_Ph.D._(Forrester_Research) Chenxi], [https://www.owasp.org/index.php/Dhruv_Soi_(OWASP_Delhi_Chapter_Leader) Dhruv], [https://www.owasp.org/index.php/Frank_Fan%2C_OWASP_China Frank Fan], [https://www.owasp.org/index.php/Fyodor_(Guard-Info) Fyodor], [https://www.owasp.org/index.php/KK_Mookhey_(OWASP_Mumbai) KK], [https://www.owasp.org/index.php/Robert_%22RSnake%22_Hansen_(SecTheory) Robert], [https://www.owasp.org/index.php/Tim_Bass%2C_OWASP_Thailand Tim Bass], [https://www.owasp.org/index.php/Wayne_Huang%2C_OWASP_Taiwan_Chapter Wayne], [https://www.owasp.org/index.php/YM_Chen%2C_Director%2C_McAfee_Foundstone YM] '''
|-

|}

==Conference Fees & Registration==

=== Conference Fees ===

The fee for the two days conference is USD 35, which includes:
*Two lunches
*Coffee breaks
*Conference T-Shirt

=== Registration ===

Registration is now open!! Please [mailto:wayne.owasp@gmail.com '''contact us'''] for the registration.

== Conference T-Shirt ==
[[Image:OWAS AppSec Asia Tshirt.png]]

== Conference Venue==

'''NTUH International Convention Center'''

'''Address:''' No. 2, Xuzhou Road, Zhongzheng District 101, Taipei City

'''[http://www.thcc.net.tw/en/index.htm Website]'''

'''[http://www.thcc.net.tw/en/about04.htm Map and transport Information]'''

== Hotel Information ==

'''San Want Hotel'''

'''Address:''' No.172, Sec. 4, ZhongXiao East Road, Taipei, Taiwan

Tel:+886-2-2772-2121 ｜ Fax : +886-2-2721-0302

'''[http://www.sanwant.com/ Website]'''

'''Hope City FuShing Hotel'''

'''Address:''' No.275, Sec.1, Fushing S. Rd., Taipei, Taiwan

Tel : +886-2-2703-9990 ｜ Fax : +886-2-2706-8547

'''[http://www.city-hotel.com.tw/bussiness/b2/b2-en.htm Website]'''

== Taipei City Map - With OWASP Venue and Hotels Marked ==

[[Image:Owasp_appsec_asia_2007_tpe_map-1.psd|center]]

== Welcome to Taiwan==
And WELCOME TO TAIWAN! Please check out [http://tw.youtube.com/watch?v=wRc0q9xQEQ4 this video] about interesting places in Taiwan.
If you need suggestions on how to plan out your trip, please feel free to [mailto:wayne.owasp@gmail.com '''contact us!''']

Anthony Lai (Dark Floyd), OWASP HK Chapter

2008-10-22T18:02:04Z

Anthonylai: New page: Anthony Lai (Dark Floyd) Dark Floyd (hacker alias used in oCTF@DefCon) is a regional senior risk consultant in an European financial institute to oversee on risk assessment, technology ri...

Anthony Lai (Dark Floyd)

Dark Floyd (hacker alias used in oCTF@DefCon) is a regional senior risk consultant in an European financial institute to oversee on risk assessment, technology risk management and penetration verification in the APAC region. His major interests are reverse engineering, exploit development, web application security, hacking investigation, response and forensic.

He is the chapter leader of OWASP (Hong Kong), program committee member of PISA (www.pisa.org.hk), program director of HTCIA (Asia Pacific Chapter)(www.htcia.org.hk) and founder/editor of InfoSec Hong Kong web site (www.infosechk.org)

You could be reached at anthonylai@owasp.org (however, I am waiting for head office to reset my password...) and anthony.lai@htcia.org.hk

OWASP AppSec Asia 2008 - Taiwan

2008-10-22T17:52:04Z

Anthonylai: /* (2008/10/27) - Day 1 */

Welcome to OWASP AppSec Asia 2008! We'd like to thank China, Delhi, Hong Kong, Korea, Mumbai, Singapore, Taiwan, Thailand, and Vietnam Chapters for helping out with the conference and for attending the conference. We are working with other chapters across Asia to see if we can invite more chapters. If you represent an Asia chapter and are interested in participating, please [mailto:wayne.owasp@gmail.com email us].

Two professional translators will be at the conference to conduct simultaneous oral translation between English and Mandarin. Wireless earphones will be provided.

[[Image:Map2.png|center]]

== OWASP AppSec Asia 2008, Conference Schedule (Oct 27th - Oct 28th) ==

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" |
=== (2008/10/27) - Day 1 ===
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 08:30 - 09:30 Door opens for registration
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:30- 09:40''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Opening welcome and an introduction to this year’s program]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Wayne Huang, Conference Chair]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:40-09:50''' || style="width:30%; background:#A7BFDE" align="center" | '''Welcome by Institute for Information Industry '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:50-10:00''' || style="width:30%; background:#A7BFDE" align="center" | '''Welcome by Information Security Consortium, Information Service Industry Association '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''10:00-10:50''' || style="width:30%; background:#A7BFDE" align="center" | ''' [[What's Next? Strategies for Web Application Security]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' [[YM Chen, Director, Foundstone, A Division of McAfee]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''11:00-11:50''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Web-based Malware obfuscation: the kung-fu and the detection]]'''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | ''' [[Wayne Huang, OWASP Taiwan Chapter]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 11:50 - 12:40 Lunch
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''12:40 - 13:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Good Business Penetration Testing]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[KK Mookhey (OWASP Mumbai)]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | '''13:40 - 15:40 Asia Chapter Leader Meeting'''
'''Attendee:''' China, Delhi, HK, Korea, Mumbai, Singapore, Taiwan, Thailand, and Vietnam Chapters

'''P.S:''' Meeting with go in parallel to the two of the talk sessions and coffee break.
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''13:40 - 14:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[How bad can Web vulnerabilities be—case study on a 50 million personal records breach]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[PK (Taiwan Criminal Investigation Bureau)]] '''
|-

|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 14:30 - 14:50 Coffee Break
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''14:50 - 15:40''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Tiny coding errors, big losses: real stories of website 0wnage]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Fyodor Yarochkin (Guard-Info)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''15:50 - 16:40''' || style="width:30%; background:#A7BFDE" align="center" | '''Web Application Proactive and Passive Defense Best Practices
 '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Frank Yuan Fan, OWASP China Chapter]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''16:50 - 17:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Why Webmail systems are hard to secure--using real case studies]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Charmi Lin (Taiwan Information & Communication Security Technology Center)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''17:40 - 18:10''' || style="width:30%; background:#A7BFDE" align="center" | '''Penetration Test with BackTrack: Gathering sexy data X Art of Exploitation '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Anthony Lai (Dark Floyd), OWASP HK Chapter]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" |

=== (2008/10/28) - Day 2 ===
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''09:00- 10:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[New 0-Day Browser Exploits: Clickjacking - yea, this is bad...]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Robert "RSnake" Hansen (SecTheory)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''10:40- 11:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Web 2.0, Consumerization, and Application Security]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Chenxi Wang, Ph.D. (Forrester Research)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''11:40- 12:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Crossing the Chasm: Anatomy of Client-Side and Browser-Based Attacks]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Dhruv Soi (OWASP Delhi Chapter Leader)]], [[Pukhraj Singh (OWASP Delhi Chapter)]] '''
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 12:30 - 13:30 Lunch
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''13:30 - 14:20''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Proxy Caches and Web Application Security--using the recent Google Docs 0-day as an example]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Tim Bass, OWASP Thailand]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''14:30 - 15:20''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Best Practices Guide: Web Application Firewalls]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Alexander Meisel (OWASP Germany)]] '''
|-
|-
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | 15:20 - 15:40 Coffee Break
|-
{| style="width:80%" border="0" align="center"
! colspan="4" align="center" style="background:#4F81BD; color:white" |

|-
| align="center" style="width:33%; background:#4F81BD; color:white" | '''TIME''' || style="width:33%; background:#4F81BD; color:white" align="center" | '''SESSION'''
| style="width:33%; background:#4F81BD; color:white" align="center" | '''SPEAKER'''

|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''15:40 - 16:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[The HTTP Botnet Research: Focusing on HTTP based DDoS Botnets]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[[Steven Adair (ShadowServer Foundation)]] '''
|-
| align="center" style="width:20%; background:#4F81BD; color:white" | '''16:40 - 17:30''' || style="width:30%; background:#A7BFDE" align="center" | '''[[Panel: Manual auditing or automated tools? Blackbox, whitebox, or WAF?]] '''
| style="width:40%; background:#EEF0F7; color:#4A4AFF" align="center" | '''[https://www.owasp.org/index.php/Alexander_Meisel_(OWASP_Germany) Alex], [https://www.owasp.org/index.php/Chenxi_Wang%2C_Ph.D._(Forrester_Research) Chenxi], [https://www.owasp.org/index.php/Dhruv_Soi_(OWASP_Delhi_Chapter_Leader) Dhruv], [https://www.owasp.org/index.php/Frank_Fan%2C_OWASP_China Frank Fan], [https://www.owasp.org/index.php/Fyodor_(Guard-Info) Fyodor], [https://www.owasp.org/index.php/KK_Mookhey_(OWASP_Mumbai) KK], [https://www.owasp.org/index.php/Robert_%22RSnake%22_Hansen_(SecTheory) Robert], [https://www.owasp.org/index.php/Tim_Bass%2C_OWASP_Thailand Tim Bass], [https://www.owasp.org/index.php/Wayne_Huang%2C_OWASP_Taiwan_Chapter Wayne], [https://www.owasp.org/index.php/YM_Chen%2C_Director%2C_McAfee_Foundstone YM] '''
|-

|}

==Conference Fees & Registration==

=== Conference Fees ===

The fee for the two days conference is USD 35, which includes:
*Two lunches
*Coffee breaks
*Conference T-Shirt

=== Registration ===

Registration is now open!! Please [mailto:wayne.owasp@gmail.com '''contact us'''] for the registration.

== Conference T-Shirt ==
[[Image:OWAS AppSec Asia Tshirt.png]]

== Conference Venue==

'''NTUH International Convention Center'''

'''Address:''' No. 2, Xuzhou Road, Zhongzheng District 101, Taipei City

'''[http://www.thcc.net.tw/en/index.htm Website]'''

'''[http://www.thcc.net.tw/en/about04.htm Map and transport Information]'''

== Hotel Information ==

'''San Want Hotel'''

'''Address:''' No.172, Sec. 4, ZhongXiao East Road, Taipei, Taiwan

Tel:+886-2-2772-2121 ｜ Fax : +886-2-2721-0302

'''[http://www.sanwant.com/ Website]'''

'''Hope City FuShing Hotel'''

'''Address:''' No.275, Sec.1, Fushing S. Rd., Taipei, Taiwan

Tel : +886-2-2703-9990 ｜ Fax : +886-2-2706-8547

'''[http://www.city-hotel.com.tw/bussiness/b2/b2-en.htm Website]'''

== Taipei City Map - With OWASP Venue and Hotels Marked ==

[[Image:Owasp_appsec_asia_2007_tpe_map-1.psd|center]]

== Welcome to Taiwan==
And WELCOME TO TAIWAN! Please check out [http://tw.youtube.com/watch?v=wRc0q9xQEQ4 this video] about interesting places in Taiwan.
If you need suggestions on how to plan out your trip, please feel free to [mailto:wayne.owasp@gmail.com '''contact us!''']

Category:OWASP Logging Project

2007-12-12T15:39:18Z

Anthonylai:

The OWASP Logging Project [[OWASP Logging Project Roadmap]] .

==Logging Overview==
http://www.pisa.org.hk/event/eventlog-mgt.jpg

This is the project initiated by Hong Kong Chapter. The idea is sparked when I am required to review various system logs and establish the log standard and review practice as well as process.

In fact, how many people could spend time and put it as a serious item in their routine checklist? Logs review seems to be a low-tech without skills. However, there are many state of arts behind the scene.

Anthony Lai, Chapter Leader and Sam Ng, member of Hong Kong Chapter will be responsible to lead this group and please feel free to join us.

We need your efforts and contribution to this project. Please feel free to reach Anthony at anthonylai@owasp.org or anthony.lai@htcia.org.hk for details. In addition, you are welcomed to add relevant content and share materials/tools related to log management in this project group.

==Recent Activities==
Feb 2006 Event log management seminar held with PISA:
http://www.pisa.org.hk/event/eventlog-mgt.htm

== Feedback and Participation: ==

We hope you find the OWASP Logging Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org. To join the OWASP Logging Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-logging subscription page.]

== News related to Logging: ==
NIL

== Other Resources and Practice: ==
* HARDENING WINDOWS TIPS - Audit event log to increase system security
http://searchwindowssecurity.techtarget.com/tip/0,289483,sid45_gci1116378,00.html

* Detecting hack attacks: Application logging is critical
http://searchnetworking.techtarget.com/tip/0,289483,sid7_gci1201090,00.html

[[Category:OWASP Project]]

Category:OWASP Logging Project

2007-12-12T15:33:53Z

Anthonylai:

Log review and management

2007-12-12T15:11:00Z

Anthonylai: /* Logging Tools */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* Who typically does this?

Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:

It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

== Logging Tools ==

'''Resources from Syslog.org'''

* Event Notification
http://www.syslog.org/wiki/Main/EventNotification
* Syslog Clients
http://www.syslog.org/wiki/Main/SyslogClients
* Syslogd Replacements
http://www.syslog.org/wiki/Main/SyslogdReplacements
* Event Viewers
http://www.syslog.org/wiki/Main/EventViewers
* Log Analyzers
http://www.syslog.org/wiki/Main/LogAnalyzers
* Event Correlation
http://www.syslog.org/wiki/Main/EventCorrelation
* Windows
http://www.syslog.org/wiki/Main/Windows
* Misc Log Tools
http://www.syslog.org/wiki/Main/MiscLogTools

'''Best Practice and Tips from Syslog'''
* Syslog Security Tip
http://www.syslog.org/wiki/Main/SyslogSecurityTip
* Central Syslog Tip
http://www.syslog.org/wiki/Main/CentralSyslogTip
* Logging Windows To Syslog Server
http://www.syslog.org/wiki/Main/LoggingWindowsToSyslogServer
*Logging Troubleshoot
http://www.syslog.org/wiki/Main/TroubleshootingSyslogForwarding
* Syslog Best Practices
http://www.syslog.org/wiki/Main/SyslogBestPractices
* Logging, Log File Rotation, and Syslog Tutorial
http://www.hccfl.edu/pollock/AUnix2/Logging.htm

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-12-12T15:02:06Z

Anthonylai: /* Logging Tools */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* Who typically does this?

Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:

It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

== Logging Tools ==

'''Resources from Syslog.org'''

* Event Notification
http://www.syslog.org/wiki/Main/EventNotification
* Syslog Clients
http://www.syslog.org/wiki/Main/SyslogClients
* Syslogd Replacements
http://www.syslog.org/wiki/Main/SyslogdReplacements
* Event Viewers
http://www.syslog.org/wiki/Main/EventViewers
* Log Analyzers
http://www.syslog.org/wiki/Main/LogAnalyzers
* Event Correlation
http://www.syslog.org/wiki/Main/EventCorrelation
* Windows
http://www.syslog.org/wiki/Main/Windows
* Misc Log Tools
http://www.syslog.org/wiki/Main/MiscLogTools

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-12-12T15:00:35Z

Anthonylai: /* Logging Tools */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* Who typically does this?

Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:

It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

== Logging Tools ==

Resources from Syslog.org

* Event Notification
http://www.syslog.org/wiki/Main/EventNotification
* Syslog Clients
http://www.syslog.org/wiki/Main/SyslogClients
* Syslogd Replacements
http://www.syslog.org/wiki/Main/SyslogdReplacements
* Event Viewers
http://www.syslog.org/wiki/Main/EventViewers
* Log Analyzers
http://www.syslog.org/wiki/Main/LogAnalyzers
* Event Correlation
http://www.syslog.org/wiki/Main/EventCorrelation
* Windows
http://www.syslog.org/wiki/Main/Windows
* Misc Log Tools
http://www.syslog.org/wiki/Main/MiscLogTools

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-12-12T14:58:39Z

Anthonylai: /* Logging Tools */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* Who typically does this?

Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:

It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

== Logging Tools ==

* Event Notification
http://www.syslog.org/wiki/Main/EventNotification
* Syslog Clients
http://www.syslog.org/wiki/Main/SyslogClients
* Syslogd Replacements
http://www.syslog.org/wiki/Main/SyslogdReplacements
* Event Viewers
http://www.syslog.org/wiki/Main/EventViewers
* Log Analyzers
http://www.syslog.org/wiki/Main/LogAnalyzers
* Event Correlation
http://www.syslog.org/wiki/Main/EventCorrelation
* Windows
http://www.syslog.org/wiki/Main/Windows
* Misc Log Tools
http://www.syslog.org/wiki/Main/MiscLogTools

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-12-12T14:54:56Z

Anthonylai: /* Subactivity 3 */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* Who typically does this?

Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:

It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

== Logging Tools ==

Event Notification
Syslog Clients
Syslogd Replacements
Event Viewers
Log Analyzers
Event Correlation
Windows
Misc Log Tools

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Error Handling, Auditing and Logging

2007-12-12T14:44:55Z

Anthonylai: /* Further Reading */

[[Guide Table of Contents]]__TOC__

==Objective ==

Many industries are required by legal and regulatory requirements to be:

* Auditable – all activities that affect user state or balances are formally tracked

* Traceable – it’s possible to determine where an activity occurs in all tiers of the application

* High integrity – logs cannot be overwritten or tampered by local or remote users

Well-written applications will dual-purpose logs and activity traces for audit and monitoring, and make it easy to track a transaction without excessive effort or access to the system. They should possess the ability to easily track or identify potential fraud or anomalies end-to-end.

==Environments Affected ==

All.

==Relevant COBIT Topics ==

DS11 – Manage Data – All sections should be reviewed, but in particular:

DS11.4 Source data error handling

DS11.8 Data input error handling

==Description ==

Error handling, debug messages, auditing and logging are different aspects of the same topic: how to track events within an application:

==Best practices ==

* Fail safe – do not fail open

* Dual purpose logs

* Audit logs are legally protected – protect them

* Reports and search logs using a read-only copy or complete replica

==Error Handling ==

Error handling takes two forms: structured exception handling and functional error checking. Structured exception handling is always preferred as it is easier to cover 100% of code. Functional languages such as PHP 4 that does not have exceptions are very hard to cover 100% of all errors. Code that covers 100% of errors is extraordinarily verbose and difficult to read, and can contain subtle bugs and errors in the error handling code itself.

Motivated attackers like to see error messages as they might leak information that leads to further attacks, or may leak privacy related information. Web application error handling is rarely robust enough to survive a penetration test.

Applications should always fail safe. If an application fails to an unknown state, it is likely that an attacker may be able to exploit this indeterminate state to access unauthorized functionality, or worse create, modify or destroy data.

===Fail safe ===

* Inspect the application’s fatal error handler.

* Does it fail safe? If so, how?

* Is the fatal error handler called frequently enough?

* What happens to in-flight transactions and ephemeral data?

===Debug errors ===

* Does production code contain debug error handlers or messages?

* If the language is a scripting language without effective pre-processing or compilation, can the debug flag be turned on in the browser?

* Do the debug messages leak privacy related information, or information that may lead to further successful attack?

===Exception handling ===

* Does the code use structured exception handlers (try {} catch {} etc) or function-based error handling?

* If the code uses function-based error handling, does it check every return value and handle the error appropriately?

* Would fuzz injection against the average interface fail?

===Functional return values ===

Many languages indicate an error condition by return value. E.g.:

''$query = mysql_query(“SELECT * FROM table WHERE id=4”, $conn);''

''if ( $query === false ) {''

'' // error''

''} ''

* Are all functional errors checked? If not, what can go wrong?

==Detailed error messages ==

Detailed error messages provide attackers with a mountain of useful information.

===How to determine if you are vulnerable ===

* Are detailed error messages turned on?

* Do the detailed error messages leak information that may be used to stage a further attack, or leak privacy related information?

* Does the browser cache the error message?

===How to protect yourself ===

Ensure that your application has a “safe mode” which it can return if something truly unexpected occurs. If all else fails, log the user out and close the browser window

Production code should not be capable of producing debug messages. If it does, debug mode should be triggered by editing a file or configuration option on the server. In particular, debug should not enabled by an option in the application itself

If the framework or language has a structured exception handler (ie try {} catch {}), it should be used in preference to functional error handling

If the application uses functional error handling, its use must be comprehensive and thorough

Detailed error messages, such as stack traces or leaking privacy related information, should never be presented to the user. Instead a generic error message should be used. This includes HTTP status response codes (ie 404 or 500 Internal Server error).

==Logging ==

===Where to log to? ===

Logs should be written so that the log file attributes are such that only new information can be written (older records cannot be rewritten or deleted). For added security, logs should also be written to a write once / read many device such as a CD-R.

Copies of log files should be made at regular intervals depending on volume and size (daily, weekly, monthly, etc.). .). A common naming convention should be adopted with regards to logs, making them easier to index. Verification that logging is still actively working is overlooked surprisingly often, and can be accomplished via a simple cron job!

Make sure data is not overwritten.

Log files should be copied and moved to permanent storage and incorporated into the organization's overall backup strategy.

Log files and media should be deleted and disposed of properly and incorporated into an organization's shredding or secure media disposal plan. Reports should be generated on a regular basis, including error reporting and anomaly detection trending.

Be sure to keep logs safe and confidential even when backed up.

===Handling ===

Logs can be fed into real time intrusion detection and performance and system monitoring tools. All logging components should be synced with a timeserver so that all logging can be consolidated effectively without latency errors. This time server should be hardened and should not provide any other services to the network.

No manipulation, no deletion while analyzing.

===General Debugging ===

Logs are useful in reconstructing events after a problem has occurred, security related or not. Event reconstruction can allow a security administrator to determine the full extent of an intruder's activities and expedite the recovery process.

===Forensics evidence ===

Logs may in some cases be needed in legal proceedings to prove wrongdoing. In this case, the actual handling of the log data is crucial.

===Attack detection ===

Logs are often the only record that suspicious behavior is taking place: Therefore logs can sometimes be fed real-time directly into intrusion detection systems.

===Quality of service ===

Repetitive polls can be protocol led so that network outages or server shutdowns get protocolled and the behavior can either be analyzed later on or a responsible person can take immediate actions.

===Proof of validity ===

Application developers sometimes write logs to prove to customers that their applications are behaving as expected.

* Required by law or corporate policies

* Logs can provide individual accountability in the web application system universe by tracking a user's actions.

It can be corporate policy or local law to be required to (as example) save header information of all application transactions. These logs must then be kept safe and confidential for six months before they can be deleted.

The points from above show all different motivations and result in different requirements and strategies. This means, that before we can implement a logging mechanism into an application or system, we have to know the requirements and their later usage. If we fail in doing so this can lead to unintentional results.

Failure to enable or design the proper event logging mechanisms in the web application may undermine an organization's ability to detect unauthorized access attempts, and the extent to which these attempts may or may not have succeeded. We will look into the most common attack methods, design and implementation errors as well as the mitigation strategies later on in this chapter.

There is another reason why the logging mechanism must be planned before implementation. In some countries, laws define what kind of personal information is allowed to be not only logged but also analyzed. For example, in Switzerland, companies are not allowed to log personal information of their employees (like what they do on the internet or what they write in their emails). So if a company wants to log a workers surfing habits, the corporation needs to inform her of their plans in advance.

This leads to the requirement of having anonymized logs or de-personalized logs with the ability to re-personalized them later on if need be. If an unauthorized person has access to (legally) personalized logs, the corporation is acting unlawful again. So there can be a few (not only) legal traps that must be kept in mind.

===Logging types ===

Logs can contain different kinds of data. The selection of the data used is normally affected by the motivation leading to the logging. This section contains information about the different types of logging information and the reasons why we could want to log them.

In general, the logging features include appropriate debugging information’s such as time of event, initiating process or owner of process, and a detailed description of the event. The following are types of system events that can be logged in an application. It depends on the particular application or system and the needs to decide which of these will be used in the logs:

* Reading of data file access and what kind of data is read. This not only allows to see if data was read but also by whom and when.

* Writing of data logs also where and with what mode (append, replace) data was written. This can be used to see if data was overwritten or if a program is writing at all.

* Modification of any data characteristics, including access control permissions or labels, location in database or file system, or data ownership. Administrators can detect if their configurations were changed.

* Administrative functions and changes in configuration regardless of overlap (account management actions, viewing any user's data, enabling or disabling logging, etc.)

* Miscellaneous debugging information that can be enabled or disabled on the fly.

* All authorization attempts (include time) like success/failure, resource or function being authorized, and the user requesting authorization. We can detect password guessing with these logs. These kinds of logs can be fed into an Intrusion Detection system that will detect anomalies.

* Deletion of any data (object). Sometimes applications are required to have some sort of versioning in which the deletion process can be cancelled.

* Network communications (bind, connect, accept, etc.). With this information an Intrusion Detection system can detect port scanning and brute force attacks.

* All authentication events (logging in, logging out, failed logins, etc.) that allow to detect brute force and guessing attacks too.

==Noise ==

Intentionally invoking security errors to fill an error log with entries (noise) that hide the incriminating evidence of a successful intrusion. When the administrator or log parser application reviews the logs, there is every chance that they will summarize the volume of log entries as a denial of service attempt rather than identifying the 'needle in the haystack'.

===How to protect yourself ===

This is difficult since applications usually offer an unimpeded route to functions capable of generating log events. If you can deploy an intelligent device or application component that can shun an attacker after repeated attempts, then that would be beneficial. Failing that, an error log audit tool that can reduce the bulk of the noise, based on repetition of events or originating from the same source for example. It is also useful if the log viewer can display the events in order of severity level, rather than just time based.

==Cover Tracks ==

The top prize in logging mechanism attacks goes to the contender who can delete or manipulate log entries at a granular level, "as though the event never even happened!". Intrusion and deployment of rootkits allows an attacker to utilize specialized tools that may assist or automate the manipulation of known log files. In most cases, log files may only be manipulated by users with root / administrator privileges, or via approved log manipulation applications. As a general rule, logging mechanisms should aim to prevent manipulation at a granular level since an attacker can hide their tracks for a considerable length of time without being detected. Simple question; if you were being compromised by an attacker, would the intrusion be more obvious if your log file was abnormally large or small, or if it appeared like every other day's log?

===How to protect yourself ===

Assign log files the highest security protection, providing reassurance that you always have an effective 'black box' recorder if things go wrong. This includes:

Applications should not run with Administrator, or root-level privileges. This is the main cause of log file manipulation success since super users typically have full file system access. Assume the worst case scenario and suppose your application is exploited. Would there be any other security layers in place to prevent the application's user privileges from manipulating the log file to cover tracks?

Ensuring that access privileges protecting the log files are restrictive, reducing the majority of operations against the log file to alter and read.

Ensuring that log files are assigned object names that are not obvious and stored in a safe location of the file system.

Writing log files using publicly or formally scrutinized techniques in an attempt to reduce the risk associated with reverse engineering or log file manipulation.

Writing log files to read-only media (where event log integrity is of critical importance).

Use of hashing technology to create digital fingerprints. The idea being that if an attacker does manipulate the log file, then the digital fingerprint will not match and an alert generated.

Use of host-based IDS technology where normal behavioral patterns can be 'set in stone'. Attempts by attackers to update the log file through anything but the normal approved flow would generate an exception and the intrusion can be detected and blocked. This is one security control that can safeguard against simplistic administrator attempts at modifications.

==False Alarms ==

Taking cue from the classic 1966 film "How to Steal a Million", or similarly the fable of Aesop; "The Boy Who Cried Wolf", be wary of repeated false alarms, since this may represent an attacker's actions in trying to fool the security administrator into thinking that the technology is faulty and not to be trusted until it can be fixed.

===How to protect yourself ===

Simply be aware of this type of attack, take every security violation seriously, always get to the bottom of the cause event log errors rather, and don't just dismiss errors unless you can be completely sure that you know it to be a technical problem.

===Denial of Service ===

By repeatedly hitting an application with requests that cause log entries, multiply this by ten thousand, and the result is that you have a large log file and a possible headache for the security administrator. Where log files are configured with a fixed allocation size, then once full, all logging will stop and an attacker has effectively denied service to your logging mechanism. Worse still, if there is no maximum log file size, then an attacker has the ability to completely fill the hard drive partition and potentially deny service to the entire system. This is becoming more of a rarity though with the increasing size of today's hard disks.

===How to protect yourself ===

The main defense against this type of attack are to increase the maximum log file size to a value that is unlikely to be reached, place the log file on a separate partition to that of the operating system or other critical applications and best of all, try to deploy some kind of system monitoring application that can set a threshold against your log file size and/or activity and issue an alert if an attack of this nature is underway.

==Destruction ==

Following the same scenario as the Denial of Service above, if a log file is configured to cycle round overwriting old entries when full, then an attacker has the potential to do the evil deed and then set a log generation script into action in an attempt to eventually overwrite the incriminating log entries, thus destroying them.

If all else fails, then an attacker may simply choose to cover their tracks by purging all log file entries, assuming they have the privileges to perform such actions. This attack would most likely involve calling the log file management program and issuing the command to clear the log, or it may be easier to simply delete the object which is receiving log event updates (in most cases, this object will be locked by the application). This type of attack does make an intrusion obvious assuming that log files are being regularly monitored, and does have a tendency to cause panic as system administrators and managers realize they have nothing upon which to base an investigation on.

===How to protect yourself ===

Following most of the techniques suggested above will provide good protection against this attack. Keep in mind two things:

Administrative users of the system should be well trained in log file management and review. 'Ad-hoc' clearing of log files is never advised and an archive should always be taken. Too many times a log file is cleared, perhaps to assist in a technical problem, erasing the history of events for possible future investigative purposes.

An empty security log does not necessarily mean that you should pick up the phone and fly the forensics team in. In some cases, security logging is not turned on by default and it is up to you to make sure that it is. Also, make sure it is logging at the right level of detail and benchmark the errors against an established baseline in order measure what is considered 'normal' activity.

==Audit Trails ==

Audit trails are legally protected in many countries, and should be logged into high integrity destinations to prevent casual and motivated tampering and destruction.

===How to determine if you are vulnerable ===

* Do the logs transit in the clear between the logging host and the destination?

* Do the logs have a HMAC or similar tamper proofing mechanism to prevent change from the time of the logging activity to when it is reviewed?

* Can relevant logs be easily extracted in a legally sound fashion to assist with prosecutions?

===How to protect yourself ===

* Only audit truly important events – you have to keep audit trails for a long time, and debug or informational messages are wasteful

* Log centrally as appropriate and ensure primary audit trails are not kept on vulnerable systems, particularly front end web servers

* Only review copies of the logs, not the actual logs themselves

* Ensure that audit logs are sent to trusted systems

* For highly protected systems, use write-once media or similar to provide trust worthy long term log repositories

* For highly protected systems, ensure there is end-to-end trust in the logging mechanism. World writeable logs, logging agents without credentials (such as SNMP traps, syslog etc) are legally vulnerable to being excluded from prosecution

==Further Reading ==

* Oracle Auditing

http://www.sans.org/atwork/description.php?cid=738

* Sarbanes Oxley for IT security

http://www.securityfocus.com/columnists/322

* Java Logging Overview
http://java.sun.com/javase/6/docs/technotes/guides/logging/overview.html

==Error Handling and Logging ==

All applications have failures – whether they occur during compilation or runtime. Most programming languages will throw runtime exceptions for illegally executing code (e.g. syntax errors) often in the form of cryptic system messages. These failures and resulting system messages can lead to several security risks if not handled properly including; enumeration, buffer attacks, sensitive information disclosure, etc. If an attack occurs it is important that forensics personnel be able to trace the attacker’s tracks via adequate logging.

ColdFusion provides structured exception handling and logging tools. These tools can help developers customize error handling to prevent unwanted disclosure, and provide customized logging for error tracking and audit trails. These tools should be combined with web server, J2EE application server, and operating system tools to create the full system/application security overview.

'''Error Handling'''

Hackers can use the information exposed by error messages. Even missing templates errors (HTTP 404) can expose your server to attacks (e.g. buffer overflow, XSS, etc.). If you enable the Robust Exception Information debugging option, ColdFusion will display:

Physical path of template

URI of template

Line number and line snippet

SQL statement used (if any)

Data source name (if any)

Java stack trace

ColdFusion provides tags and functions for developers to use to customize error handling. Administrators can specify default templates in the ColdFusion Administrator (CFAM) to handle unknown or unhandled exceptions. ColdFusion’s structure exception handling works in the following order:

Template level (ColdFusion templates and components)

ColdFusion exception handling tags: cftry, cfcatch, cfthrow, and cfrethrow

try and catch statements in CFScript

Application level (Application.cfc/cfm)

Specify custom templates for individual exceptions types with the cferror tag

Application.cfc onError method to handle uncaught application exceptions

System level (ColdFusion Administrator settings)

Missing Template Handler execute when a requested ColdFusion template is not found

Site-wide Error Handler executes globally for all unhandled exceptions on the server

'''Best Practices '''

Do not allow exceptions to go unhandled

Do not allow any exceptions to reach the browser

Display custom error pages to users with an email link for feedback

Do not enable “Robust Exception Information” in production.

Specify custom pages for ColdFusion to display in each of the following cases:

When a ColdFusion page is missing (the Missing Template Handler page)

When an otherwise-unhandled exception error occurs during the processing of a page (the Site-wide Error Handler page)

You specify these pages on the Settings page in the Server Settings are in the ColdFusion MX Administrator; for more information, see the ColdFusion MX Administrator Help.

Use the cferror tag to specify ColdFusion pages to handle specific types of errors.

Use the cftry, cfcatch, cfthrow, and cfrethrow tags to catch and handle exception errors directly on the page where they occur.

In CFScript, use the try and catch statements to handle exceptions.

Use the onError event in Application.cfc to handle exception errors that are not handled by try/catch code on the application pages.

'''Logging'''

Log files can help with application debugging and provide audit trails for attack detection. ColdFusion provides several logs for different server functions. It leverages the Apache Log4j libraries for customized logging. It also provides logging tags to assist in application debugging.

The following is a partial list of ColdFusion log files and their descriptions''' '''

{| border=1

|| Log file || Description

|-

|| application.log || Records every ColdFusion MX error reported to a user. Application page errors, including ColdFusion MX syntax, ODBC, and SQL errors, are written to this log file.

|-

|| exception.log || Records stack traces for exceptions that occur in ColdFusion.

|-

|| scheduler.log || Records scheduled events that have been submitted for execution. Indicates whether task submission was initiated and whether it succeeded. Provides the scheduled page URL, the date and time executed, and a task ID.

|-

|| server.log || Records start up messages and errors for ColdFusion MX.

|-

|| customtag.log || Records errors generated in custom tag processing.

|-

|| mail.log || Records errors generated by an SMTP mail server.

|-

|| mailsent.log || Records messages sent by ColdFusion MX.

|-

|| flash.log || Records entries for Macromedia Flash Remoting.

|-

|}

The CFAM contains the Logging Settings and log viewer screens. Administrators can configure the log directory, maximum log file size, and maximum number of archives. It also allows administrators to log slow running pages, CORBA calls, and scheduled task execution. The log viewer allows viewing, filtering, and searching of any log files in the log directory (default is cf_root/logs). Administrators can archive, save, and delete log files as well.

The cflog and cftrace tags allow developer to create customized logging. <cflog> can write custom messages to the Application.log, Scheduler.log, or a custom log file. The custom log file must be in the default log directory – if it does not exist ColdFusion will create it. <cftrace> tracks execution times, logic flow, and variable at the time the tag executes. It records the data in the cftrace.log (in the default logs directory) and can display this info either inline or in the debugging output of the current page request. Use <cflog> to write custom error messages, track user logins, and record user activity to a custom log file. Use <cftrace> to track variables and application state within running requests.

'''Best Practices'''

Use <cflog> for customized logging

Incorporate into custom error handling

Record application specific messages

Actively monitor and fix errors in ColdFusion’s logs

Optimize logging settings

Rotate log files to keep them current

Keep files size manageable

Enable logging of slow running pages

Set the time interval lower than the configured Timeout Request value in the CFAM Settings screen

Long running page timings are recorded in the server.log

Use <cftrace> sparingly for audit trails

Use with inline=“false”

Use it to track user input – Form and/or URL variables

'''''Best Practices in Action'''''

The following code adds error handling and logging to the dbLogin and logout methods in the code from Authentication section.

{| border=1

||

<cffunction name="dblogin" access="private" output="false" returntype="struct">

<cfargument name="strUserName" required="true" type="string">

<cfargument name="strPassword" required="true" type="string">

<cfset var retargs = StructNew()>

<cftry>

<cfif IsValid("regex", uUserName, "[A-Za-z0-9%]*") AND IsValid("regex", uPassword, "[A-Za-z0-9%]*")>

<cfquery name="loginQuery" dataSource="#Application.DB#" >

SELECT hashed_password, salt

FROM UserTable

WHERE UserName =

<cfqueryparam value="#strUserName#" cfsqltype="CF_SQL_VARCHAR" maxlength="25">

</cfquery>

<cfif loginQuery.hashed_password EQ Hash(strPassword & loginQuery.salt, "SHA-256" )>

<cfset retargs.authenticated="YES">

<cfset Session.UserName = strUserName>

<cflog text="#getAuthUser()# has logged in!"

type="Information"

file="access"

application="yes">



<cfelse>

<cfset retargs.authenticated="NO">

</cfif>

<cfelse>

<cfset retargs.authenticated="NO">

</cfif>

<cfcatch type="database">

<cflog text="Error in dbLogin(). #cfcatch.details#"

type="Error"

log="Application"

application="yes">

<cfset retargs.authenticated="NO">

<cfreturn retargs>

</cfcatch>

</cftry>

<cfreturn retargs>

</cffunction>

<cffunction name="logout" access="remote" output="true">

<cfargument name="logintype" type="string" required="yes">

<cfif isDefined("form.logout")>

<cflogout>

<cfset StructClear(Session)>

<cflog text="#getAuthUser()# has been logged out."

type="Information"

file="access"

application="yes">

<cfif arguments.logintype eq "challenge">

<cfset foo = closeBrowser()>

<cfelse>



<cflocation url="login.cfm">

</cfif>

</cfif>

</cffunction>

<cffunction name="dblogin" access="private" output="false" returntype="struct">

<cfargument name="strUserName" required="true" type="string">

<cfargument name="strPassword" required="true" type="string">

<cfset var retargs = StructNew()>

<cftry>

<cfif IsValid("regex", uUserName, "[A-Za-z0-9%]*") AND IsValid("regex", uPassword, "[A-Za-z0-9%]*")>

<cfquery name="loginQuery" dataSource="#Application.DB#" >

SELECT hashed_password, salt

FROM UserTable

WHERE UserName =

<cfqueryparam value="#strUserName#" cfsqltype="CF_SQL_VARCHAR" maxlength="25">

</cfquery>

<cfif loginQuery.hashed_password EQ Hash(strPassword & loginQuery.salt, "SHA-256" )>

<cfset retargs.authenticated="YES">

<cfset Session.UserName = strUserName>

<cflog text="#getAuthUser()# has logged in!"

type="Information"

file="access"

application="yes">



<cfelse>

<cfset retargs.authenticated="NO">

</cfif>

<cfelse>

<cfset retargs.authenticated="NO">

</cfif>

<cfcatch type="database">

<cflog text="Error in dbLogin(). #cfcatch.details#"

type="Error"

log="Application"

application="yes">

<cfset retargs.authenticated="NO">

<cfreturn retargs>

</cfcatch>

</cftry>

<cfreturn retargs>

</cffunction>

<cffunction name="logout" access="remote" output="true">

<cfargument name="logintype" type="string" required="yes">

<cfif isDefined("form.logout")>

<cflogout>

<cfset StructClear(Session)>

<cflog text="#getAuthUser()# has been logged out."

type="Information"

file="access"

application="yes">

<cfif arguments.logintype eq "challenge">

<cfset foo = closeBrowser()>

<cfelse>



<cflocation url="login.cfm">

</cfif>

</cfif>

</cffunction>

|-

|}

[[Guide Table of Contents]]
[[Category:OWASP_Guide_Project]]
[[Category:Error Handling]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Category:OWASP Logging Project

2007-12-12T14:41:59Z

Anthonylai:

The OWASP Logging Project [[OWASP Logging Project Roadmap]] .

==Logging Overview==
http://www.pisa.org.hk/event/eventlog-mgt.jpg

This is the project initiated by Hong Kong Chapter. The idea is sparked when I am required to review various system logs and establish the log standard and review practice as well as process.

In fact, how many people could spend time and put it as a serious item in their routine checklist? Logs review seems to be a low-tech without skills. However, there are many state of arts behind the scene.

Anthony Lai, Chapter Leader and Sam Ng, member of Hong Kong Chapter will be responsible to lead this group and please feel free to join us.

We need your efforts and contribution to this project. Please feel free to reach Anthony at anthonylai@owasp.org for details. In addition, you are welcomed to add relevant content and share materials/tools related to log management in this project group.

==Recent Activities==
Feb 2006 Event log management seminar held with PISA:
http://www.pisa.org.hk/event/eventlog-mgt.htm

== Feedback and Participation: ==

We hope you find the OWASP Logging Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org. To join the OWASP Logging Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-logging subscription page.]

[[Category:OWASP Project]]

Log review and management

2007-03-17T10:16:08Z

Anthonylai: /* Overview */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* Who typically does this?

Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:

It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

==Subactivity 3==

Describe the subactivity here

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-03-17T10:15:14Z

Anthonylai: /* Log Standard */

==Overview==

Purpose:

* How to detect suspicious activities as soon as possible to reduce the impact of incidence or make prevention if possible.
* How to unify the log format and elements as well as the functions?

Role:

* who typically does this?
Security Administrator or independent party who has no access rights/accounts in the reviewed systems. You can't be an user administrator. At the same time, you review your activity everyday. However, if there is a resource limitation, you need another supervisor to authorize your log review.

Frequency:
It depends on the criticality (i.e. payment system, customer information, business secret, etc.) of the system labelled by the organization, logs could be reviewed ranging from minute, every day, weekly, monthly or even 3 months. In fact, log review is a kind of detective control and the preventive control is lacking. Log review will be the Goal Keeper and frequency is critical.

However, user account and authority list should be reviewed at least 3 to 6 months and never take a check ONLY when the audit cycle is coming

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Log archive and export

* Log code and description table

* Highlighting system and user adminsitrator activities

Mandatory Fields:-
* User ID and Name (Sometimes, event may involve the action from administrator)

* Activity Date/Timestamp

* Activity Code, Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

* Show expired and inactive accounts (for example: 90 days)

==Subactivity 3==

Describe the subactivity here

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-03-17T10:07:50Z

Anthonylai: /* Log Standard */

Log review and management

2007-03-17T10:06:25Z

Anthonylai: /* Overview */

Log review and management

2007-03-17T09:55:51Z

Anthonylai: /* Subactivity 2 */

==Overview==

Purpose:

* Communicate potential risks to stakeholder.
* Communicate rationale for security-relevant decisions to stakeholder.

Role:

* who typically does this

Frequency:

*

== Log Review Tips ==

Critical systems require at least daily log review, however, what types of logs/activities should we pay attention to?

1. Consecutive login failure especially in non-office hour.

2. Login in non-office hour.

3. Authority change, addition and removal. Check them against with authorized application.

4. Any system administrator's activities

5. Any unknown workstation/server are plugged into the network?

6. Logs removal/log overwritten/log size is full

7. Pay more attention to the log reports after week-end and holiday

8. Any account unlocked/password reset by system administrators without authorized forms?

== Log Standard ==

In fact, we are suffering various log format and standard from various systems even we are working in-house or act as a consultant. Why don't we produce a standard/guidelines to developer before they design the user administrative and audit trail functions to fulfill security control.

Functions:-
* Search - By date and time, by event type, by criticality, by account/user ID, by department

* Sorting - By date and time, by event type, by criticality, by account/user ID, by department

* Paging (Optional)

* Critical event is marked by "*"

* Show expired and inactive accounts (for example: 90 days)

Mandatory Fields:-
* User ID and Name

* Activity Date/Timestamp

* Activity Type and Description

* Terminal IP address and Location

User Account List:-
* User Info - Name, Department, Role

* Last Accessed Time

* Account Creation Date/Time

* Current Authority and Role

* Account authority and information change history

==Subactivity 3==

Describe the subactivity here

[[Category:Activity]]
[[Category:Logging]]
[[Category:OWASP Logging Project]]

Log review and management

2007-03-17T09:40:06Z

Anthonylai: /* Log Review Tips */

Log review and management

2007-03-17T09:39:48Z

Anthonylai: /* Log Review Tips */

Log review and management

2007-03-17T09:39:23Z

Anthonylai: /* Log Review Tips */

Hong Kong

2007-03-17T09:24:44Z

Anthonylai: /* News from Hong Kong Chapter */

Hong Kong

2007-03-17T09:24:06Z

Anthonylai: /* News from Hong Kong Chapter */

Hong Kong

2007-03-17T09:22:34Z

Anthonylai: /* News from Hong Kong Chapter */

Hong Kong

2007-03-17T09:19:06Z

Anthonylai: /* News from Hong Kong Chapter */

OWASP Community

2007-03-16T17:46:52Z

Anthonylai: /* Events */

This page is for people to post OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.

Events from previous years are archived here:
* '''[[OWASP Community 2006]]'''

This page is monitored, and items posted here will be copied to the OWASP [[Main Page]]. Please post new items in chronological order using the following format:

'''Mon ## (##:00h) - [[Article]]'''



==Events==

'''May 21 (14:00h) - [[Israel|2nd OWASP Israel mini conference]]'''

'''Apr 20 (19:00h) - [[Hong Kong|Hong Kong chapter meeting - Ojbectives in 2007]]'''

'''Apr 17 (18:00h) - [[Rochester|Rochester chapter meeting]]'''

'''Apr 12 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''

'''Apr 11 (18:00h) - [[Toronto|Toronto chapter meeting]]'''

'''Apr 10 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''

'''Apr 4 (18:30h) - [[Boston|Boston chapter meeting]]'''

'''Apr 3 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''

'''Mar 30 - [[http://www.owasp.org/index.php/Italy#March_30th.2C_2007_-_Master_in_Security_-_University_of_Rome_.22La_Sapienza.22| Italy@Master in Security at "La Sapienza"]]'''

'''Mar 28 (11:30h) - [[San Antonio|San Antonio chapter meeting]]'''

; '''Mar 27-30 - [http://www.blackhat.com Black Hat Euro]'''
: OWASP members receive a Euro 100 Briefings discount by inserting BH7EUASSOC in the box marked “Coupon Codes”

'''Mar 22 (18:00h) - [[London|London chapter meeting]]'''

'''Mar 21-22 - [[Belgium#OWASP_Top_10_2007_Update_.28Infosecurity_Belgium.2C_21_.26_.2622_Mar_2007.29|Belgium@InfoSecurity]]'''

'''Mar 20 (18:00h) - [[Rochester|Rochester chapter meeting]]'''

'''Mar 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''

'''Mar 14 (18:00h) - [[Chicago|Chicago chapter meeting]]'''

'''Mar 13 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''

'''Mar 8 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''

'''Mar 7 (18:30h) - [[Boston|Boston chapter meeting]]'''

'''Mar 7 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''

'''Mar 6 (18:30h) - [[Philadelphia|Philadelphia chapter meeting]]'''

'''Mar 6 (18:30h) - [[San Francisco|San Francisco and San Jose chapter meeting]]'''

'''Mar 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''

'''Mar 5 (11:00h) - [[New Jersey|New Jersey chapter meeting]]'''

'''Mar 1 (11:30h) - [http://www.eusecwest.com/agenda.html EUSecWest 07: Testing Guide]'''

; '''Feb 26-Mar 1 - [http://www.blackhat.com Black Hat DC]'''
: OWASP members receive a $100 Briefings discount by inserting BH7DCASSOC in the box marked “Coupon Codes”

'''Feb 28 (18:00h) - [[Seattle|Seattle chapter meeting]]'''

'''Feb 27 (18:00h) - [[Edmonton|Edmonton chapter meeting]]'''

'''Feb 22 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''

'''Feb 22 (18:00h) - [[London|London chapter meeting]]'''

'''Feb 21 (18:30h) - [[Denver|Denver chapter meeting]]'''

'''Feb 19 (18:00h) - [[Rochester|Rochester chapter meeting]]'''

'''Feb 15 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''

'''Feb 15 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''

'''Feb 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''

'''Feb 13 (18:00h) - [[Ireland|Ireland chapter meeting]]'''

'''Feb 12 (18:30h) - [[Switzerland|Switzerland chapter meeting]]'''

'''Feb 7 (18:30h) - [[Boston|Boston chapter meeting]]'''

'''Feb 6-7 - [[Italy#February_6th-8th.2C_2007_-_InfoSecurity|Italy@InfoSecurity]]'''

'''Feb 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''

'''Feb 2 (14:00h) - [[Chennai|Chennai chapter meeting]]'''

'''Jan 31 (15:00h) - [[Mumbai|Mumbai chapter meeting]]'''

'''Jan 30 (11:30h) - [[Austin|Austin chapter meeting]]'''

'''Jan 25 (18:00h) - [[San Francisco| San Francisco chapter meeting]]'''

'''Jan 25 (14:30h) - [[Italy#October_25th.2C_2007_-_Isaca_Rome|Italy@ISACA Rome]]'''

'''Jan 24 (17:30h) - [[Israel#6th_OWASP_IL_meeting:_Wednesday.2C_January_24th_2007|6th OWASP Israel chapter meeting]]'''

'''Jan 23 (18:00h) - [[Belgium|Belgium chapter meeting]]'''

'''Jan 22 (18:00h) - [[Rochester|Rochester chapter meeting]]'''

'''Jan 17 (18:30h) - [[Denver|Denver chapter meeting]]'''

'''Jan 16 (17:45h) - [[Edmonton|Edmonton chapter meeting]]'''

'''Jan 11 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''

'''Jan 11 (18:30h) - [[Phoenix|Phoenix chapter meeting]]'''

'''Jan 11 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''

'''Jan 10 (18:00h) - [[Toronto|Toronto chapter meeting]]'''

'''Jan 8 (18:00h) - [[Seattle|Seattle chapter meeting]]'''

'''Jan 3 (18:30h) - [[Boston|Boston chapter meeting]]'''

Category:OWASP Logging Project

2006-12-21T09:11:55Z

Anthonylai: /* Recent Activities */

The OWASP Logging Project [[OWASP Logging Project Roadmap]] .

==Logging Overview==
http://www.pisa.org.hk/event/eventlog-mgt.jpg

This is the project initiated by Hong Kong Chapter. The idea is sparked when I am required to review various system logs and establish the log standard and review practice as well as process.

In fact, how many people could spend time and put it as a serious item in their routine checklist? Logs review seems to be a low-tech without skills. However, there are many state of arts behind the scene.

Anthony Lai, Chapter Leader and Sam Ng, member of Hong Kong Chapter will be responsible to lead this group and please feel free to join us.

We need your efforts and contribution to this project. Please feel free to reach Anthony at anthonylai@owasp.org for details. In addition, you are welcomed to add relevant content and share materials/tools related to log management in this project group.

==Recent Activities==
Feb 2006 Event log management seminar held with PISA:
http://www.pisa.org.hk/event/eventlog-mgt.htm

Dec 2006 A simple logs review tips will be provided in Jan 2006

== Feedback and Participation: ==

We hope you find the OWASP Logging Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org. To join the OWASP Logging Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-logging subscription page.]

[[Category:OWASP Project]]

User talk:Anthonylai

2006-12-21T09:01:42Z

Anthonylai:

I am chapter leader of OWASP (Hong Kong Chapter). I am now working on security policy implementation, assessment and web application penetration test. You could reach me at anthonylai@owasp.org

Hong Kong

2006-07-06T15:25:21Z

Anthonylai: