Belfast

2016-05-20T16:01:21Z

Gary David Robinson:

OWASP Code review V2 AppSecEU Agenda

2016-05-15T12:57:20Z

Gary David Robinson: Created page with "== OWASP AppSec EU 2016 Agenda == The OWASP Code Review Guide (v2) is attending the AppSec EU Project Summit in Rome during June 2016. At this summit we will be inviting par..."

== OWASP AppSec EU 2016 Agenda ==

The OWASP Code Review Guide (v2) is attending the AppSec EU Project Summit in Rome during June 2016. At this summit we will be inviting participants to spend some of their time to review the Beta version of the guide.

High level agenda is as follows:
* Copies of the guide will be available as PDF, either downloadable from the Internet, or on CD
* Participants will be asked to scan the document ToC, determine a section they have experience in, and review.
* Review comments will be collected and fed back into the beta review cycle.
* As incentive, the Code Review Guide will bring a 10 year old Irish Whiskey, to be raffled among the participants taking part in the review.

Any questions, contact the OWASP Code Review Guide leaders.

Belfast

2016-04-27T08:32:30Z

Gary David Robinson:

Belfast

2016-04-23T09:40:25Z

Gary David Robinson:

2015-02-04T17:08:08Z

Gary David Robinson:

{{Chapter Template|chaptername=Belfast|extra= |mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Belfast|emailarchives=http://lists.owasp.org/pipermail/owasp-Belfast}}

== OWASP Belfast Board ==

The OWASP Belfast Chapter Leaders are:
* [mailto:michelle.simpson@owasp.org Michelle Simpson]
* [mailto:philip.okane@owasp.org Philip O'Kane]
* [mailto:gary.robinson@owasp.org Gary Robinson]

== About OWASP Belfast ==

==== What is OWASP Belfast? ====

OWASP Belfast is just one of over 100 OWASP Chapters around the world, including 4 in Ireland and 12 in the UK, where people meet to learn about and discuss software security topics. The OWASP organization also has lots of active projects that volunteers can participate in to create code and documents for the worldwide security community. The OWASP Top 10 project is the most famous of those projects.

==== Who is OWASP Belfast for? ====

It's for programmers, testers, students, project managers, development managers and security experts to collaborate and drive discussion on application security topics. Participation in the mailing lists and attendance at the OWASP Belfast sessions are free, in fact many of the events will provide food and drinks to attendees.

==== Why be part of OWASP Belfast? ====

* The community organizes sessions where experts from across the industry (and globe) give presentations and seminars about application security topics.
* Attendance and participation in the community increases knowledge and skills, allowing people to stand out from the crowd.
* Opportunity to network with other Software Professionals and keep in touch with job opportunities in the region.

== Local News ==

'''OWASP Belfast Chapter Session - March 2015'''

OWASP Belfast are currently planning their next session, currently planned for 18th March 2015.

Follow the OWASP Belfast Meetup group at http://www.meetup.com/OWASP-Belfast/

Sign-up for the OWASP Belfast mailing list for more information about this session, and other security related topics, at http://lists.owasp.org/mailman/listinfo/owasp-Belfast

[[Category:OWASP Chapter]]
[[Category:Europe]]

CRV2 SecCommsHTTPHdrs

2015-02-02T17:51:20Z

Gary David Robinson:

OWASP Code Review V2 Table of Contents

2015-02-02T15:42:34Z

Gary David Robinson: /* HTTP Headers */

= '''OWASP Code Review Guide v2.0:''' =

==Forward==
# Author - Eoin Keary
# Previous version to be updated:[[https://www.owasp.org/index.php/Code_Review_Guide_History]]
'''[[CRV2_Forward|Content here]]'''

== Code Review Guide Introduction==
# Author - Eoin Keary
# Previous version to be updated:[[https://www.owasp.org/index.php/Code_Review_Introduction]]
'''[[CRV2_Introduction|Content here]]'''

=== What is source code review and Static Analysis ===
=== What is Code Review ===
# Author - Zyad Mghazli, Eoin Keary
# New Section
''' [[CRV2_WhatIsCodeReview|Content here]]'''

=== Manual Review - Pros and Cons ===
# Author - Zyad Mghazli, Eoin Keary,Gary David Robinson
# New Section
# Suggestion: Benchmark of different Stataic Analysis Tools Zyad Mghazli
# [[CRV2_ManualReviewProsCons|Put content here]]

=== Advantages of Code Review to Development Practices ===
# Author - Gary David Robinson
# New Section
# [[CRV2_AdvantagesToDevPractices|Put content here]]

=== Why code review ===
==== Scope and Objective of secure code review ====
# Author - Ashish Rao
# [[CRV2_WhyCodeReview|Put content here]]

=== We can't hack ourselves secure ===
# Author - Eoin Keary
# New Section
# [[CRV2_CantHackSecure|Put content here]]

=== 360 Review: Coupling source code review and Testing / Hybrid Reviews===
# Author - eoin Keary
# New Section
# [[CRV2_360Review|Put content here]]

=== Can static code analyzers do it all? ===
# Author - Ashish Rao
# New Section
# [[CRV2_CanStaticAnalyzersDoAll|Put content here]]

=Methodology=
===The code review approach===
#Author - Johanna Curiel
# [[CRV2_CodeReviewApproach|Put content here]]

==== Preparation and context ====
# Author - Gary David Robinson
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Preparation]]
# [[CRV2_PrepContext|Put content here]]

====Application Threat Modeling====
#Author - Larry Conklin
# Previous version to be updated: [[https://www.owasp.org/OCRG1.1:Application_Threat_Modeling]]
# [[CRV2_AppThreatModeling|Put content here]]

====Understanding Code layout/Design/Architecture====
#Author - Open
# [[CRV2_CodeLayoutDesignArch|Put content here]]
====Understanding Business Logic====
#[[CRV2_BusinessLogic|Put content here]]

===SDLC Integration===
#Author - Larry Conklin
# Previous version to be updated: [[https://www.owasp.org/index.php/Security_Code_Review_in_the_SDLC]]
# [[CRV2_SDLCInt|Put content here]]

====Deployment Models====
=====Secure deployment configurations=====
#Author -
# [[CRV2_SecDepConfig|Put content here]]

# New Section
=====Metrics and code review=====
#Author -Anthony.Scotka@tea.state.tx.us
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Metrics]]
# [[CRV2_MetricsCodeRev|Put content here]]

=====Source and sink reviews=====
#Author - Open
# New Section
# [[CRV2_SourceSinkRev|Put content here]]

=====Code review Coverage=====
#Author - Open
#Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Coverage]]
# [[CRV2_CodeRevCoverage|Put content here]]

=====Design Reviews=====
#Author - Ashish Rao
*Why to review design?
**Building security in design - secure by design principle
**Design Areas to be reviewed
**Common Design Flaws
# [[CRV2_DesignRev|Put content here]]

=====A Risk based approach to code review=====
#Author - Gary David Robinson
#New Section
*"Doing things right or doing the right things..."
**"Not all bugs are equal
# [[CRV2_RiskBasedApproach|Put content here]]

====Crawling code====
#Author - Open
# Previous version to be updated: [[https://www.owasp.org/index.php/Crawling_Code]]
*API of Interest:
**Java
**.NET
**PHP
**RUBY
*Frameworks:
**Spring
**.NET MVC
**Struts
**Zend
#New Section
*Searching for code in C/C++
#Author - Gary David Robinson

# [[CRV2_CrawlingCode|Put content here]]

====Code reviews and Compliance====
#Author -Open
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Reviews_and_Compliance]]
# [[CRV2_CodeRevCompliance|Put content here]]

=Reviewing by Technical Control=
===Reviewing code for Authentication controls===
#Author - Gary Robinson
# [[CRV2_AuthControls|Put content here]]

====Forgot password====
#Author Abbas Naderi, Larry Conklin
# [[CRV2_ForgotPassword|Put content here]]

====CAPTCHA====
#Author Larry Conklin, Joan Renchie
'''[[CRV2_CAPTCHA|Content here]]'''

====Out of Band considerations====
#Author - Gary Robinson
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Authentication]]
# [[CRV2_OutofBand|Put content here]]

===Reviewing code Authorization weakness===
#Author Eoin Keary .NET MVC added
# [[CRV2_AuthorizationWeaknesses|Put content here]]

====Checking authz upon every request====
#Author - Abbas Naderi
# [[CRV2_CheckAuthzEachRequest|Put content here]]

====Reducing the attack surface====
#Author Gary Robinson
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Authorization]]
# [[CRV2_ReducingAttSurf|Put content here]]

====SSL/TLS Implementations====
#Author - Eoin Keary
# [[CRV2_SSL-TLS|Put content here]]

====Reviewing code for Session handling====
#Author - Abbas Naderi
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Session-Management]]
# [[CRV2_SessionHandling|Put content here]]

====Reviewing client side code====
#New Section
# [[CRV2_ClientSideCodeIntro|Put content here]]

=====Javascript=====
#Author - Abbas Naderi
# [[CRV2_ClientSideCodeJScript|Put content here]]

=====JSON=====
#Author - Open
# [[CRV2_ClientSideCodeJSon|Put content here]]

=====Content Security Policy=====
#Author - Open
# [[CRV2_ClientSideCodeContSecPolicy|Put content here]]

====="Jacking"/Framing=====
#Author - Eoin Keary
# [[CRV2_ClientSideCodeJackingFraming|Put content here]]

=====HTML 5?=====
#Author - Open
# [[CRV2_ClientSideCodeHTML5|Put content here]]

=====Browser Defenses=====
#Author - Open
# [[CRV2_ClientSideCodeBrowserDefPol|Put content here]]

=====etc...=====

====Review code for input validation====
#Author - Open
# [[CRV2_InputValIntro|Put content here]]

=====Regex Gotchas=====
#Author - Open
#New Section
# [[CRV2_InputValRegexGotchas|Put content here]]

=====ESAPI=====
#Author - Open
#New Section
# Internal Link: [[https://www.owasp.org/index.php/Codereview-Input_Validation]]
# [[CRV2_InputValESAPI|Put content here]]

=====Microsoft Web Protection Library=====
#Author - Michael Hidalgo
#New Section
# Internal Link: [[https://www.owasp.org/index.php/Codereview-Input_Validation]]
# [[CRV2_InputValMicrosoftWebProtectionLibrary|Put content here]]

====Reviewing code for contextual encoding====
[[Overall approach to content encoding and anti XSS]]
=====HTML Attribute=====
#Author - Eoin Keary
# [[CRV2_ContextEncHTMLAttribute|Put content here]]

=====HTML Entity=====
#Author - Eoin Keary
# [[CRV2_ContextEncHTMLEntity|Put content here]]

=====Javascript Parameters=====
#Author - Eoin Keary
# [[CRV2_ContextEncJscriptParams|Put content here]]

=====JQuery=====
#Author - Open
# [[CRV2_ContextEncJQuery|Put content here]]

====Reviewing file and resource handling code====
#Author - Open
# [[CRV2_FileResourceHandling|Put content here]]

====Resource Exhaustion - error handling====
#Author - Open
# [[CRV2_ResourceExhaustionErrHandling|Put content here]]

=====native calls=====
#Author Open
# [[CRV2_ResourceExhaustionNativeCalls|Put content here]]

====Reviewing Logging code - Detective Security====
#Author - Gary Robinson
* Where to Log
* What to log
* What not to log
* How to log
# Internal link: [[https://www.owasp.org/index.php/Logging_Cheat_Sheet]]
# [[CRV2_LoggingCode|Put content here]]

====Reviewing Error handling and Error messages====
#Author - Gary David Robinson
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Error-Handling]]
# [[CRV2_ErrorHandlingMessages|Put content here]]

====Reviewing Security alerts====
#Author - Gary Robinson
# [[CRV2_SecurityAlerts|Put content here]]

====Review for active defense====
#Author - Colin Watson
# [[CRV2_ActiveDefense|Put content here]]

====Reviewing Secure Storage====
#Author - Open source
# New Section
# [[CRV2_SecureStorage|Put content here]]

====Hashing & Salting - When, How and Where====
=====Encryption=====
======.NET======
#Author Larry Conklin, Joan Renchie
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Cryptographic_Controls]]
*''Can we talk about key storage as well i.e. key management for encryption techniques used in the application? - Ashish Rao''
'''[[CRV2_HashingandSaltingdotNet|Content here]]'''

=Reviewing by Vulnerability=
===Review Code for XSS===
#Author Examples added by Eoin Keary
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Scripting]]
# In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
# [[CRV2_RevCodeXSS|Put content here]]

===Persistent - The Anti pattern===
#Author
# [[CRV2_RevCodePersistentAntiPatternIntro|Put content here]]

====.NET====
#Author Johanna Curiel, Eoin Keary
# [[CRV2_RevCodePersistentAntiPatterndotNet|Put content here]]

====.Java====
#Author Johanna Curiel
# [[CRV2_RevCodePersistentAntiPatternJava|Put content here]]

====PHP====
#Author Abbas Naderi
# [[CRV2_RevCodePersistentAntiPatternPHP|Put content here]]

====Ruby====
#Author Open
# [[CRV2_RevCodePersistentAntiPatternRuby|Put content here]]

===Reflected - The Anti pattern===
# [[CRV2_RevCodeReflectedAntiPatternIntro|Put content here]]

====.NET====
#Author Johanna Curiel
# [[CRV2_RevCodeReflectedAntiPatterndotNet|Put content here]]

====.Java====
#Author Johanna Curiel
# [[CRV2_RevCodeReflectedAntiPatternJava|Put content here]]

====PHP====
#Author Abbas Naderi
# [[CRV2_RevCodeReflectedAntiPatternPHP|Put content here]]

====Ruby====
# Author - Open
# [[CRV2_RevCodeReflectedAntiPatternIRuby|Put content here]]

===Stored - The Anti pattern===
# Author - Johanna Curiel
# [[CRV2_RevCodeStoredAntiPatternIntro|Put content here]]

====.NET====
#Author Johanna Curiel
# [[CRV2_RevCodeStoredAntiPatterndotNET|Put content here]]

====.Java====
#Author Johanna Curiel
# [[CRV2_RevCodeStoredAntiPatternJava|Put content here]]

====PHP====
#Author Johanna Curiel
# [[CRV2_RevCodeStoredAntiPatternPHP|Put content here]]

====Ruby====
#Author - Johanna Curiel
# [[CRV2_RevCodeStoredAntiPatternRuby|Put content here]]

===DOM XSS ===
#Author Larry Conklin
# [[CRV2_DOMXSS|Put content here]]

===JQuery mistakes===
#Author
# [[CRV2_JQueryMistakes|Put content here]]

===Reviewing code for SQL Injection===
#Author Gary Robinson
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_SQL_Injection]]
# [[CRV2_RevCodeSQLInjection|Put content here]]

====PHP====
#Author - Mennouchi Islam Azeddine
# [[CRV2_SQLInjPHP|Put content here]]

====Java====
#Author - Johanna Curiel
# [[CRV2_SQLInjJava|Put content here]]

====.NET====
#Author - Open
# [[CRV2_SQLInjdotNET|Put content here]]

====HQL====
#Author - Open
# [[CRV2_SQLInjHQL|Put content here]]

===The Anti pattern===
#Author Larry Conklin
#[[CRV2_AntiPattern| Content here]]
https://www.owasp.org/index.php/CRV2_AntiPattern
====PHP====
#Author -
# [[CRV2_AntiPatternPHP|Put content here]]

====Java====
#Author -
#=> Searching for traditional SQL,JPA,JPSQL,Criteria,...
# [[CRV2_AntiPatternJava|Put content here]]

====.NET====
#Author Open
# [[CRV2_AntiPatterndotNet|Put content here]]

====Ruby====
#Author - Open
# [[CRV2_AntiPatternRuby|Put content here]]

====Cold Fusion====
#Author - Open
# [[CRV2_AntiPatternColdFusion|Put content here]]

===Reviewing code for CSRF Issues===
#Author Abbas Naderi
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Request_Forgery]]
# This page needs to be deleted. [[CRV2_CSRFIssues|Put content here]]

===(This task has been deleted) Transactional logic / Non idempotent functions / State Changing Functions===
# [[CRV2_TransLogic|Put content here]]

===Reviewing code for poor logic /Business logic/Complex authorization===
#Author - Open
# [[CRV2_PoorLogic|Put content here]]

===Reviewing Secure Communications===
====.NET Config====
#Author Johanna Curiel, Renchie Joan
# [[CRV2_SecCommsdotNet|Put content here]]

====Spring Config====
#Author - Open
# [[CRV2_SecCommsSpringConfig|Put content here]]

====HTTP Headers====
#Author Gary Robinson
# [[CRV2_SecCommsHTTPHdrs|Put content here]]

===Tech-Stack pitfalls===
#Author Open
# [[CRV2_TechStackPitfalls|Put content here]]

===Framework specific Issues===
====Spring====
#Author - Open
# [[CRV2_FrameworkSpecIssuesSpring|Put content here]]

====Struts====
#Author - Open
# [[CRV2_FrameworkSpecIssuesStruts|Put content here]]

====Drupal====
#Author Open
# [[CRV2_FrameworkSpecIssuesDurpal|Put content here]]

====Ruby on Rails====
#Author - Open
# [[CRV2_FrameworkSpecIssuesROR|Put content here]]

====Django====
#Author Open
# [[CRV2_FrameworkSpecIssuesDjango|Put content here]]

====.NET Security / MVC====
#Author Johanna Curiel, Eoin Keary
# [[CRV2_FrameworkSpecIssuesdotNetMVC|Put content here]]

====Security in ASP.NET applications====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPNet|Put content here]]

=====Strongly Named Assemblies=====
#Author Johanna Curiel, Larry Conklin
# [[CRV2_FrameworkSpecIssuesASPNetStrongAssembiles|Put content here]]

======Round Tripping======
# Author - Open
# [[CRV2_FrameworkSpecIssuesASPNetRT|Put content here]]

======How to prevent Round tripping======
# Author - Open
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPNetRTPrevention|Put content here]]

=====Setting the right Configurations=====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPNetConfigs|Put content here]]

=====Authentication Options=====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPNetAuth|Put content here]]

=====Code Review for Managed Code - .Net 1.0 and up=====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPNetManagedCode|Put content here]]

=====Using OWASP Top 10 as your guideline=====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPTop10|Put content here]]

=====Code review for Unsafe Code (C#)=====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPNetUnsafeCode|Put content here]]

====PHP Specific Issues====
#Author Open
# [[CRV2_FrameworkSpecIssuesPHP|Put content here]]

====Classic ASP====
#Author Johanna Curiel
# [[CRV2_FrameworkSpecIssuesASPClassic|Put content here]]

====C#====
#Author Open
# [[CRV2_FrameworkSpecIssuesCsharp|Put content here]]

====C/C++====
#Author Open
# [[CRV2_FrameworkSpecIssuesCplusplus|Put content here]]

====Objective C====
#Author Open
# [[CRV2_FrameworkSpecIssuesObectiveC|Put content here]]

====Java====
#Author Open
# [[CRV2_FrameworkSpecIssuesJava|Put content here]]

====Android====
#Author Open
# [[CRV2_FrameworkSpecIssuesAndroid|Put content here]]

====Coldfusion====
#Author Open
# [[CRV2_FrameworkSpecIssuesColdfusion|Put content here]]

====CodeIgniter====

# Author Open
# [[CRV2_FrameworkSpecIssuesCodeIgniter|Put content here]]

=Security code review for Agile development=
#Author Carlos Pantelides
# [[CRV2_CodeReviewAgile|Put content here]]

=Code Review Tools=
https://www.owasp.org/index.php/CRV2_CodeReviewTools

CRV2 SecCommsHTTPHdrs

2015-01-26T09:07:44Z

Gary David Robinson:

CRV2 SecCommsHTTPHdrs

2015-01-26T08:53:45Z

Gary David Robinson: Created page with "= This is a draft version = == Overview == HTTP headers allow the server to dictate or advise the user agent and intermediary servers how to handle the content being provide..."