OWASP - User contributions [en]

Rochester

2007-06-15T03:17:51Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (nearI-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''June Meeting Details'''

Please join us for an informal gathering at [http://maps.google.com/maps?f=q&hl=en&q=macgregors+henrietta,+ny&ie=UTF8&om=1&ll=43.171132,-77.614288&spn=0.443687,0.933838&z=10&iwloc=C McGregors] on Monday, June 18 at 6:00 PM. Hope to see you there.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-06-15T03:17:24Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''June Meeting Details'''

Please join us for an informal gathering at [http://maps.google.com/maps?f=q&hl=en&q=macgregors+henrietta,+ny&ie=UTF8&om=1&ll=43.171132,-77.614288&spn=0.443687,0.933838&z=10&iwloc=C McGregors] on Monday, June 18 at 6:00 PM.

Hope to see you there.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-04-16T02:37:42Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''April Meeting Details'''

Details are not yet available, however we will be meeting at our regular time and place.

Hope to see you there.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-03-17T15:17:19Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''March Meeting Details'''

Although there will be no OWASP Rochester meeting in March, the Rochester chapter of ISSA will be having a free and open-to-the-public meeting on Monday, March 19 at 5:30 PM. James Kist, CISSP will be presenting on Web Application Security. James will be discussing common problems such as SQL Injection, as well as the not-so-common problems, such as AJAX and AJAX worms.

Full details, including the location, can be found at: http://www.rochissa.org/#meetings

Hope to see you there.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-03-17T15:16:22Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''March Meeting Details'''

Although there will be no OWASP Rochester meeting in March, the Rochester chapter of ISSA will be having a free and open-to-the-public meeting on Monday, March 19 at 5:30 PM. James Kist, CISSP will be presenting on Web Application Security. James will be discussing common problems such as SQL Injection, as well as the not-so-common problems, such as AJAX and AJAX worms.

Full details, including the location, can be found at: http://www.rochissa.org/#meetings

Hope to see you there.. Enjoy the break!

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-03-14T00:07:30Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''March Meeting Details'''

There will be no meeting in March. Enjoy the break!

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

OWASP Community

2007-02-01T02:52:07Z

Mstarks01: /* Events */

This page is for people to post OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.

Events from previous years are archived here:
* '''[[OWASP Community 2006]]'''

This page is monitored, and items posted here will be copied to the OWASP [[Main Page]]. Please post new items in chronological order using the following format:

'''Mon ## (##:00h) - [[Article]]'''



==Events==

'''May 10 (18:00h) - [[Belgium|Belgium chapter meeting]]'''

'''Apr 12 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''

'''Mar 27 (18:30h) - [[Philadelphia|Philadelphia chapter meeting]]'''

; '''Mar 27-30 - [http://www.blackhat.com Black Hat Euro]'''
: OWASP members receive a Euro 100 Briefings discount by inserting BH7EUASSOC in the box marked “Coupon Codes”

'''Mar 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''

; '''Feb 26-Mar 1 - [http://www.blackhat.com Black Hat DC]'''
: OWASP members receive a $100 Briefings discount by inserting BH7DCASSOC in the box marked “Coupon Codes”

'''Feb 22 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''

'''Feb 19 (18:00h) - [[Rochester|Rochester chapter meeting]]'''

'''Feb 15 (18:00h) - [[Seattle|Seattle chapter meeting]]'''

'''Feb 15 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''

'''Feb 15 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''

'''Feb 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''

'''Feb 13 (18:00h) - [[Ireland|Ireland chapter meeting]]'''

'''Feb 12 (18:30h) - [[Switzerland|Switzerland chapter meeting]]'''

'''Feb 7 (18:30h) - [[Boston|Boston chapter meeting]]'''

'''Feb 6-7 - [[Italy#February_6th-8th.2C_2007_-_InfoSecurity|Italy@InfoSecurity]]'''

'''Feb 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''

'''Feb 2 (14:00h) - [[Chennai|Chennai chapter meeting]]'''

'''Jan 31 (15:00h) - [[Mumbai|Mumbai chapter meeting]]'''

'''Jan 30 (11:30h) - [[Austin|Austin chapter meeting]]'''

'''Jan 25 (18:00h) - [[San Francisco| San Francisco chapter meeting]]'''

'''Jan 25 (14:30h) - [[Italy#October_25th.2C_2007_-_Isaca_Rome|Italy@ISACA Rome]]'''

'''Jan 24 (17:30h) - [[Israel#6th_OWASP_IL_meeting:_Wednesday.2C_January_24th_2007|6th OWASP Israel chapter meeting]]'''

'''Jan 23 (18:00h) - [[Belgium|Belgium chapter meeting]]'''

'''Jan 22 (18:00h) - [[Rochester|Rochester chapter meeting]]'''

'''Jan 17 (18:30h) - [[Denver|Denver chapter meeting]]'''

'''Jan 16 (17:45h) - [[Edmonton|Edmonton chapter meeting]]'''

'''Jan 11 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''

'''Jan 11 (18:30h) - [[Phoenix|Phoenix chapter meeting]]'''

'''Jan 11 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''

'''Jan 10 (18:00h) - [[Toronto|Toronto chapter meeting]]'''

'''Jan 8 (18:00h) - [[Seattle|Seattle chapter meeting]]'''

'''Jan 3 (18:30h) - [[Boston|Boston chapter meeting]]'''

Rochester

2007-02-01T02:32:05Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''February Meeting Details'''

Date: Monday, February 19, 2007, 6:00 PM

Time: 6:00 PM

Intended audience: Technical

Presenter: Ralph Durkee, CISSP, GSEC, GCIH, GSNA, Principal Security Consultant

Topic: Hands on Web Application Hacking with the OWASP Web Goat

Description: We'll continue our exploration from last month and exploit web applications vulnerabilities using the OWASP Web Goat tool, which is designed for training real-world web application hacking techniques. Group participation will be encouraged. All exploits will be done by a trained professional on an off-the-net vulnerable application that you download from OWASP web site so that you can "try this at home", but always with the appropriate permission first, of course.

Bio: Ralph Durkee: Performing a wide variety of consulting and training projects including software development, systems and networking security throughout his 25+ year career, Ralph is the president and founder of Durkee Consulting, since 1996. His specialty focuses on Internet security consulting and secure systems software development. He helped write a major portion of the Web Application Security training material for the SANS LAMP (Linux Apache MySql PHP) course. Ralph is a recent editor for the Center for Internet Security's Apache, Linux and DNS BIND benchmark. Ralph is a seasoned security consultant and trainer and holds GIAC certifications in GSEC since 2000 then GCIH since 2001 as well as the GSNA and CISSP.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-01-15T03:07:29Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM. Note: For January, we will meet the fourth Monday of the month.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''January Meeting Details'''

Date: Monday, January 22, 2006, 6:00 PM

Time: 6:00 PM

Intended audience: Technical

Presenter: Ralph Durkee, CISSP, GSEC, GCIH, GSNA, Principal Security Consultant

Topic: Hands on Web Application Hacking with the OWASP Web Goat

Description: We'll explore and exploit web applications vulnerabilities using the OWASP Web Goat tool designed for training real-world web application hacking techniques. Group participation will be encouraged. All exploits will be done by a trained professional on an off-the-net vulnerable application that you download from OWASP web site so that you can "try this at home", but always with the appropriate permission first, of course.

Bio: Ralph Durkee: Performing a wide variety of consulting and training projects including software development, systems and networking security throughout his 25+ year career, Ralph is the president and founder of Durkee Consulting, since 1996. His specialty focuses on Internet security consulting and secure systems software development. He helped write a major portion of the Web Application Security training material for the SANS LAMP (Linux Apache MySql PHP) course. Ralph is a recent editor for the Center for Internet Security's Apache, Linux and DNS BIND benchmark. Ralph is a seasoned security consultant and trainer and holds GIAC certifications in GSEC since 2000 then GCIH since 2001 as well as the GSNA and CISSP.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-01-15T02:51:54Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM. Note: For January, we will meet the fourth Monday of the month.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''January Meeting Details'''

Date: Monday, January 22, 2006, 6:00 PM

Time: 6:00 PM

Intended audience: Technical

Presenter: Ralph Durkee, CISSP, GSEC, GCIH, GSNA, Principal Security Consultant

Topic: Hands on Web Application Hacking with the OWASP Web Goat

Description: We'll explore and exploit web applications vulnerabilities using the OWASP Web Goat tool designed for training real-world web application hacking techniques. Group participation will be encouraged. All exploits will be done by a trained professional on an off-the-net vulnerable application that you download from OWASP web site so that you can "try this at home", but always with the appropriate permission first, or course.

Bio: Ralph Durkee: Performing a wide variety of consulting and training projects including software development, systems and networking security throughout his 25+ year career, Ralph is the president and founder of Durkee Consulting, since 1996. His specialty focuses on Internet security consulting and secure systems software development. He helped write a major portion of the Web Application Security training material for the SANS LAMP (Linux Apache MySql PHP) course. Ralph is a recent editor for the Center for Internet Security's Apache, Linux and DNS BIND benchmark. Ralph is a seasoned security consultant and trainer and holds GIAC certifications in GSEC since 2000 then GCIH since 2001 as well as the GSNA and CISSP.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2007-01-15T02:49:54Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM. Note: For January, we will meet the fourth Monday of the month.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''January Meeting Details'''

Date: Monday, January 22, 2006, 6:00 PM

Time: 6:00 PM

Intended audience: Technical

Presenter: Ralph Durkee, CISSP, GSEC, GCIH, GSNA Principal Security Consultant

Topic: Hands on Web Application Hacking with the OWASP Web Goat

Description: We'll explore and exploit web applications vulnerabilities using the OWASP Web Goat tool designed for training real-world web application hacking techniques. Group participation will be encouraged. All exploits will be done by a trained professional on an off-the-net vulnerable application that you download from OWASP web site so that you can "try this at home", but always with the appropriate permission first, or course.

Bio: Ralph Durkee: Performing a wide variety of consulting and training projects including software development, systems and networking security throughout his 25+ year career, Ralph is the president and founder of Durkee Consulting, since 1996. His specialty focuses on Internet security consulting and secure systems software development. He helped write a major portion of the Web Application Security training material for the SANS LAMP (Linux Apache MySql PHP) course. Ralph is a recent editor for the Center for Internet Security's Apache, Linux and DNS BIND benchmark. Ralph is a seasoned security consultant and trainer and holds GIAC certifications in GSEC since 2000 then GCIH since 2001 as well as the GSNA and CISSP.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-12-01T18:05:53Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''For this meeting, we'll be gathering at [http://maps.google.com/maps?hl=en&q=Mcgregor%27s+henrietta+ny&ie=UTF8&oe=UTF-8&filter=0&om=1&z=15&ll=43.093964,-77.652268&spn=0.015074,0.029182 MacGregors' Restaurant] for some food, drink and fun.'''

'''December Meeting Details'''

Date: Monday, December 18, 2006, 6:00 PM

Duration: 6:00 PM Until...

Intended audience: Everyone

Topic: The Coming Year

We'll be forgoing the usual formal presentation this month for a festive gathering at MacGregors' Restaurant. We'll have some food, drink, fun and talk about the coming year.

So that we may give the restaurant some advance notice, we are requesting that you [mailto:macgregorsrsvp@michaelstarks.com RSVP] by December 11.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-12-01T18:04:49Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''For this meeting, we'll be meeting at [http://maps.google.com/maps?hl=en&q=Mcgregor%27s+henrietta+ny&ie=UTF8&oe=UTF-8&filter=0&om=1&z=15&ll=43.093964,-77.652268&spn=0.015074,0.029182 MacGregors' Restaurant] for some food, drink and fun.'''

'''December Meeting Details'''

Date: Monday, December 18, 2006, 6:00 PM

Duration: 6:00 PM Until...

Intended audience: Everyone

Topic: The Coming Year

We'll be forgoing the usual formal presentation this month for a festive gathering at MacGregors' Restaurant. We'll have some food, drink, fun and talk about the coming year.

So that we may give the restaurant some advance notice, we are requesting that you [mailto:macgregorsrsvp@michaelstarks.com RSVP] by December 11.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T18:50:47Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

For this meeting, we'll be gathering in room 204. Enter the the main Bryant & Stratton entrance door, go up the stairs and turn left down the hallway to room 204. There will also be a signs on the doors.

'''November Meeting Details'''

Date: Monday, November 20, 2006, 6:00 PM

Duration: 1 hour 30 minutes
Intended audience: Technical, Technical Management

Presentation: Making Source Code Analysis Part of the Security Review Process, by Matt Rose, Fortify Software.

How do you know if your software applications are secure? Manual audits only cover a small percentage of the source code base and periodic checks only provide a snapshot in time. Source code analysis allows development organizations to manage software security by leveraging well-documented best practices that can be automated. This session will
reveal how source code analysis can be a powerful tool for software security architects, developers and QA professionals by pinpointing security vulnerabilities throughout an entire code base as an integral part of the development cycle, or as part of software security audits in order to significantly improve application security. The session will describe the ins and outs of the technology, including its limitations and newly explored areas. Real life examples from actual engagements will be used throughout.

Due to limited space, we are requesting that you [mailto:fortifyrsvp@michaelstarks.com RSVP] by Novermber 13.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T18:23:22Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

For this meeting, we'll be gathering in room 204. Enter the the main Bryant & Stratton entrance door, go up the stairs and turn left down the hallway to room 204. There will also be a signs on the doors.

'''November Meeting Details'''

Date: Monday, November 20, 2006, 6:00 PM

Duration: 1 hour 30 minutes
Intended audience: Technical, Technical Management

Presentation: Making Source Code Analysis Part of the Security Review Process, by Matt Rose, Fortify Software.

How do you know if your software applications are secure? Manual audits only cover a small percentage of the source code base and periodic checks only provide a snapshot in time. Source code analysis allows development organizations to manage software security by leveraging well-documented best practices that can be automated. This session will
reveal how source code analysis can be a powerful tool for software security architects, developers and QA professionals by pinpointing security vulnerabilities throughout an entire code base as an integral part of the development cycle, or as part of software security audits in order to significantly improve application security. The session will describe the in's and out's of the technology, including its limitations and newly explored areas. Real life examples from actual engagements will be used throughout.

Due to limited space, we are requesting that you [mailto:fortifyrsvp@michaelstarks.com RSVP] by Novermber 13.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T18:18:26Z

Mstarks01: /* Participation */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site upates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

For this meeting, we'll be gathering in room 204. Enter the the main Bryant & Stratton entrance door, go up the stairs and turn left down the hallway to room 204. There will also be a signs on the doors.

'''November Meeting Details'''

Date: Monday, November 20, 2006, 6:00 PM

Duration: 1 hour 30 minutes
Intended audience: Technical, Technical Management

Presentation: Making Source Code Analysis Part of the Security Review Process, by Matt Rose, Fortify Software.

How do you know if your software applications are secure? Manual audits only cover a small percentage of the source code base and periodic checks only provide a snapshot in time. Source code analysis allows development organizations to manage software security by leveraging well-documented best practices that can be automated. This session will
reveal how source code analysis can be a powerful tool for software security architects, developers and QA professionals by pinpointing security vulnerabilities throughout an entire code base as an integral part of the development cycle, or as part of software security audits in order to significantly improve application security. The session will describe the in's and out's of the technology, including its limitations and newly explored areas. Real life examples from actual engagements will be used throughout.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T18:02:38Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

To join the chapter mailing list, please visit our [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny mailing list] homepage. The list is used to discuss the meetings and to arrange meeting locations. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-ny email archives] to see what folks have been talking about. Please check the mailing list before coming to a meeting to confirm the location and time and to catch any last minute notes.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

For this meeting, we'll be gathering in room 204. Enter the the main Bryant & Stratton entrance door, go up the stairs and turn left down the hallway to room 204. There will also be a signs on the doors.

'''November Meeting Details'''

Date: Monday, November 20, 2006, 6:00 PM

Duration: 1 hour 30 minutes
Intended audience: Technical, Technical Management

Presentation: Making Source Code Analysis Part of the Security Review Process, by Matt Rose, Fortify Software.

How do you know if your software applications are secure? Manual audits only cover a small percentage of the source code base and periodic checks only provide a snapshot in time. Source code analysis allows development organizations to manage software security by leveraging well-documented best practices that can be automated. This session will
reveal how source code analysis can be a powerful tool for software security architects, developers and QA professionals by pinpointing security vulnerabilities throughout an entire code base as an integral part of the development cycle, or as part of software security audits in order to significantly improve application security. The session will describe the in's and out's of the technology, including its limitations and newly explored areas. Real life examples from actual engagements will be used throughout.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T18:01:49Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

To join the chapter mailing list, please visit our [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny mailing list] homepage. The list is used to discuss the meetings and to arrange meeting locations. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-ny email archives] to see what folks have been talking about. Please check the mailing list before coming to a meeting to confirm the location and time and to catch any last minute notes.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

For this meeting, we'll be gathering in room 204. Enter the the main Bryant & Stratton entrance door, go up the stairs and turn left down the hallway to room 204. There will also be a signs on the doors.

'''November Meeting Details'''

Date: Monday, November 20, 2006, 6:00 PM

Duration: 1 hour 30 minutes
Intended audience: Technical, Technical Management

Presentation: Making Source Code Analysis Part of the Security Review Process, by Matt Rose, Fortify Software.

How do you know if your software applications are secure? Manual audits only cover a small percentage of the source code base and periodic checks only provide a snapshot in time. Source code analysis allows development organizations to manage software security by leveraging well-documented best practices that can be automated. This session will
reveal how source code analysis can be a powerful tool for software security architects, developers and QA professionals by pinpointing security vulnerabilities throughout an entire code base as an integral part of the development cycle, or as part of software security audits in order to significantly improve application security. The session will describe the in's and out's of the technology, including its limitations and newly explored areas. Real life examples from actual engagements will be used throughout.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T17:48:37Z

Mstarks01: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

To join the chapter mailing list, please visit our [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny mailing list] homepage. The list is used to discuss the meetings and to arrange meeting locations. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-ny email archives] to see what folks have been talking about. Please check the mailing list before coming to a meeting to confirm the location and time and to catch any last minute notes.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

For this meeting, we'll be gathering in room 204. Enter the the main Bryant & Stratton entrance door, go up the stairs and turn left down the hallway to room 204. There will also be a signs on the doors.

'''November Meeting Details'''

Date: Monday, November 20, 2006, 6:00 PM

Duration: 1 hour 30 minutes

Presentation: Making Source Code Analysis Part of the Security Review Process, by Matt Rose, Fortify Software.

How do you know if your software applications are secure? Manual audits only cover a small percentage of the source code base and periodic checks only provide a snapshot in time. Source code analysis allows development organizations to manage software security by leveraging well-documented best practices that can be automated. This session will
reveal how source code analysis can be a powerful tool for software security architects, developers and QA professionals by pinpointing security vulnerabilities throughout an entire code base as an integral part of the development cycle, or as part of software security audits in order to significantly improve application security. The session will describe the in's and out's of the technology, including its limitations and newly explored areas. Real life examples from actual engagements will be used throughout.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T17:26:27Z

Mstarks01: /* Past Presentations */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

To join the chapter mailing list, please visit our [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny mailing list] homepage. The list is used to discuss the meetings and to arrange meeting locations. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-ny email archives] to see what folks have been talking about. Please check the mailing list before coming to a meeting to confirm the location and time and to catch any last minute notes.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''October Meeting Details'''

Date: Monday, October 16, 2006, 6:00 PM

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio: Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-30T17:09:53Z

Mstarks01: /* Local Officers */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

To join the chapter mailing list, please visit our [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny mailing list] homepage. The list is used to discuss the meetings and to arrange meeting locations. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-ny email archives] to see what folks have been talking about. Please check the mailing list before coming to a meeting to confirm the location and time and to catch any last minute notes.

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary and Treasurer: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''October Meeting Details'''

Date: Monday, October 16, 2006, 6:00 PM

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio: Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2006-10-10T02:40:30Z

Mstarks01: /* Meeting Dates & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Location: 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

Meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

'''October Meeting Details'''

Date: Monday, October 16, 2006, 6:00 PM

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio: Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T02:32:27Z

Mstarks01: /* Meeting Dates & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Dates: Meetings are held the third Monday of every month, starting at 6:00 PM.

Location: Bryant and Stratton Professional Skills Center, 1225 Jefferson Rd, Rochester, NY 14623 (near I-390)

Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

[http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006, 6:00 PM

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio: Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T02:24:24Z

Mstarks01:

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Dates & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton Professional Skills Center, 1225 Jefferson Rd, Rochester, NY 14623 (near I-390)

Enter the plaza behind Bill Grays and Tulleys, near the Post Office. Enter the PSC (Professional Skills Center) door which is left of the main entrance door. There will be a sign on the door indicating the room in which we will meet.

[http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio: Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T02:21:35Z

Mstarks01: /* Meeting Times & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton Professional Skills Center, 1225 Jefferson Rd, Rochester, NY 14623 (near I-390)

Enter the plaza behind Bill Grays and Tulleys, near the Post Office. Enter the PSC (Professional Skills Center) door which is left of the main entrance door. There will be a sign on the door indicating the room in which we will meet.

[http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio: Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T02:20:45Z

Mstarks01: /* Meeting Times & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton Professional Skills Center, 1225 Jefferson Rd, Rochester, NY 14623 (near I-390)

Enter the plaza behind Bill Grays and Tulleys, near the Post Office. Enter the PSC (Professional Skills Center) door which is left of the main entrance door. There will be a sign on the door indicating the room in which we will meet.

[http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio:

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T02:20:14Z

Mstarks01: /* Meeting Times & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton Professional Skills Center, 1225 Jefferson Rd, Rochester, NY 14623 (near I-390)

Enter the plaza behind Bill Grays and Tulleys, near the Post Office. Enter the PSC (Professional Skills Center) door which is left of the main entrance door. There will be a sign on the door indicating the room in which we will meet.

[http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Bio

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T02:18:11Z

Mstarks01: /* Meeting Times & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton Professional Skills Center, 1225 Jefferson Rd, Rochester, NY 14623 (near I-390)

Enter the plaza behind Bill Grays and Tulleys, near the Post Office. Enter the PSC (Professional Skills Center) door which is left of the main entrance door. There will be a sign on the door indicating the room in which we will meet.

[http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T01:31:08Z

Mstarks01:

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton College, 1225 Jefferson Rd, Rochester, NY (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T01:30:37Z

Mstarks01:

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton College, 1225 Jefferson Rd, Rochester, NY (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T01:27:43Z

Mstarks01: /* Meeting Times & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month.

Location: Bryant and Stratton College, 1225 Jefferson Rd, Rochester, NY (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Date: Monday, October 16, 2006

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T01:18:01Z

Mstarks01: /* Meeting Times & Location */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month. Our October meeting will be on Monday, October 16. The meeting location is Bryant and Stratton college, Jefferson Rd, near I-390. [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T00:32:49Z

Mstarks01:

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Meeting Times & Location ==

Meetings are held the third Monday of every month. Our October meeting will be on Monday, October 16. The meeting location is Bryant and Stratton college, Jefferson Rd, near I-390. [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting Details'''

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

== Past Presentations ==

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T00:18:12Z

Mstarks01: /* Local News */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Local News ==

Meetings are held the third Monday of every month. Our October meeting will be on Monday, October 16. The meeting location is Bryant and Stratton college, Jefferson Rd, near I-390. [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting'''

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

'''Past Presentations'''

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T00:17:38Z

Mstarks01: /* Local News */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Local News ==

Meetings are held the third Monday of every month. Our October meeting will be on Monday, October 16. The meeting location is Bryant and Stratton college, Jefferson Rd, near I-390. [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting'''

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

'''Past Presentations'''

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of Sql Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T00:16:59Z

Mstarks01: /* Local News */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Local News ==

Meetings are held the third Monday of every month. Our October meeting will be on Monday, October 16. The meeting location is Bryant and Stratton college, Jefferson Rd, near I-390. [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting'''

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

'''Past Presentations'''

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

January 2005 Intro to OWASP by Ralf Durkee. Demonstration of Sql Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-10T00:13:54Z

Mstarks01: /* Local News */

{{Chapter Template|chaptername=Rochester|extra=The chapter leader is [mailto:rd@rd1.net Ralf Durkee]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny|emailarchives=http://lists.owasp.org/pipermail/owasp-rochester-ny}}

== Local Officers ==

<ul>
*President: Ralf Durkee
*Vice President: Chris Karr
*Secretary: Steve Buck
*Web and Communications: Michael Starks
</ul>

== Local News ==

Meetings are held the third Monday of every month. Our October meeting will be on Monday, October 16. The meeting location is Bryant and Stratton college, Jefferson Rd, near I-390. [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Map]

'''October Meeting'''

Presentation: The first of the OWASP top ten: unvalidated input, by Steve Buck.

At this meeting we will be discussing the first of the OWASP top ten list: unvalidated input. We will discuss the problems posed by not validating input on the server side. These problems include: forced browsing, command insertion, cross site scripting, buffer overflows, bypassing site security, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation.

We will cover how to determine if you are vulnerable to one of these attacks, and also how to protect yourself. We will also have a demo of some of these exploits in action. Finally, we will have an open discussion with any questions about the subject matter.

Biography

Steve Buck is a consultant for Mindex Technologies. He has been working with various web technologies since 1996, involving everything from Perl and C CGIs to J2EE.

Steve has experience as a UNIX system administrator instructor with a specialty in system security.

'''Past Presentations'''

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

January 2005 Access Control and Session Management, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

January 2005 Intro to OWASP by Ralf Durkee. Demonstration of Sql Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

Rochester

2006-10-09T23:32:03Z

Mstarks01: /* Local News */

Rochester

2006-10-09T23:30:17Z

Mstarks01: /* Local News */

Rochester

2006-09-23T00:47:30Z

Mstarks01: /* Local News */

Rochester

2006-09-23T00:36:36Z

Mstarks01: /* Local Officers */