OWASP - User contributions [en]

Threat Risk Modeling

2010-09-29T19:56:21Z

ParanoidMike: added threat modeling category

__TOC__

When you start a web application design, it is essential to apply threat risk modeling; otherwise you will squander resources, time, and money on useless controls that fail to focus on the real risks.

The method used to assess risk is not nearly as important as actually performing a structured threat risk modeling. Microsoft notes that the single most important factor in their security improvement program was the corporate adoption of threat risk modeling.

OWASP recommends Microsoft’s threat modeling process because it works well for addressing the unique challenges facing web application security and is simple to learn and adopt by designers, developers, code reviewers, and the quality assurance team.

The following sections provide some overview information (or see Section 6.9, Further Reading, for additional resources).

== Threat Risk Modeling ==
Threat risk modeling is an essential process for secure web application development. It allows organizations to determine the correct controls and to produce effective countermeasures within budget. For example, there is little point in spending $100,000 for fraud control for a system that has negligible fraud risk.

== Performing threat risk modeling using the Microsoft Threat Modeling Process ==
The threat risk modeling process has five steps, enumerated below and shown graphically in Figure 1. They are:
# Identify Security Objectives
# Survey the Application
# Decompose it
# Identify Threats
# Identify Vulnerabilities

[[Image:Threat_Model_Flow.gif|Figure 1: Threat Model Flow]]

Let’s consider the steps in more detail.

=== Identify Security Objectives ===
The business (or project management) leadership, in concert with the software development and quality assurance teams, all need to understand the security objectives. To facilitate this, start by breaking down the application’s security objectives into the following categories:

* '''Identity:''' Does the application protect user identity from abuse? Are there adequate controls in place to ensure evidence of identity (as required for many banking applications?)
* '''Financial:''' Assess the level of risk the organization is prepared to absorb in remediation, as a potential financial loss. For example, forum software may have a lower estimated financial risk than an Internet banking application.
* '''Reputation:''' Quantify or estimate of the loss of reputation derived from the application being misused or successfully attacked.
* '''Privacy and Regulatory:''' To what extent will the application have to protect user data? Forum software by its nature is public, but a tax preparation application is subject to tax regulations and privacy legislation requirements in most countries.
* '''Availability Guarantees:''' Is the application required to be available per a '''''Service Level Agreement (SLA)''''' or similar guarantee? Is it a nationally protected infrastructure? To what level will the application have to be available? High availability techniques are significantly more expensive, so applying the correct controls up front will save a great deal of time, resources, and money.

This is by no means an exhaustive list, but it gives an idea of some of the business risk decisions leading into selecting and building security controls.

Other sources of risk guidance come from:
* Laws (such as privacy or finance laws)
* Regulations (such as banking or e-commerce regulations)
* Standards (such as ISO 17799)
* Legal Agreements (such as payment card industry standards or merchant agreements)
* Corporate Information Security Policy

=== Application Overview ===
Once the security objectives have been defined, analyze the application design to identify the '''''components''''', '''''data flows''''', and '''''trust boundaries'''''.

Do this by surveying the application’s architecture and design documentation. In particular, look for UML component diagrams. Such high level component diagrams are generally sufficient to understand how and why data flows to various places. For example, data movement across a trust boundary (such as from the Internet to the web tier, or from the business logic to the database server), needs to be carefully analyzed, whereas data that flows within the same trust level does not need as much scrutiny.

=== Decompose Application ===
Once the application architecture is understood then decompose it further, to identify the features and modules with a security impact that need to be evaluated. For example, when investigating the authentication module, it is necessary to understand how data enters the module, how the module validates and processes the data, where the data flows, how the data is stored, and what fundamental decisions and assumptions are made by the module.

=== Identify Threats ===
It is impossible to write down unknown threats, but it is likewise unlikely that new malware will be created to exploit new vulnerabilities within custom systems. Therefore, concentrate on known risks, which can be easily demonstrated using tools or techniques from Bugtraq.

Microsoft suggests two different approaches for writing up threats. One is a threat graph, as shown in Figure 2, and the other is a structured list. 
[[Category:FIXME|Change 3rd orange box in graphic to "Authorization MAY fail"]]

[[Image:Threat_Graph.gif|Figure 2: Threat Graph]]

Typically, a threat graph imparts more information quickly but it takes longer to construct, while a structured list is easier to create but it will take longer for the threat impacts to become obvious.

# Attacker may be able to read other user’s messages
# User may not have logged off on a shared PC
# Data validation may allow SQL injection
# Implement data validation
# Authorization may fail, allowing unauthorized access
# Implement authorization checks
# Browser cache may contain contents of message
# Implement anti-caching directive in HTTP headers
# If eavesdropping risk is high, use SSL

Note that it takes a motivated attacker to exploit a threat; they generally want something from your application or to obviate controls. To understand the relevant threats, use the following categories to understand who might attack the application:

* '''Accidental Discovery:''' An ordinary user stumbles across a functional mistake in your application, just using a web browser, and gains access to privileged information or functionality.
* '''Automated Malware:''' Programs or scripts, which are searching for known vulnerabilities, and then report them back to a central collection site.
* '''The Curious Attacker:''' a security researcher or ordinary user, who notices something wrong with the application, and decides to pursue further.
* '''Script Kiddies:''' Common renegades, seeking to compromise or deface applications for collateral gain, notoriety, or a political agenda, perhaps using the attack categories described in the ''OWASP Web Application Penetration Checklist.''
* '''The Motivated Attacker:''' Potentially, a disgruntled staff member with inside knowledge or a paid professional attacker.
* '''Organized Crime:''' Criminals seeking high stake payouts, such as cracking e-commerce or corporate banking applications, for financial gain.

It is vital to understand the level of attacker you are defending against. For example, a motivated attacker, who understands your internal processes is often more dangerous than script kiddies.

=== STRIDE ===
STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker). The STRIDE acronym is formed from the first letter of each of the following categories.

'''''Spoofing Identity'''''
“Identity spoofing” is a key risk for applications that have many users but provide a single execution context at the application and database level. In particular, users should not be able to become any other user or assume the attributes of another user.

'''''Tampering with Data'''''
Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth. The application should not send data to the user, such as interest rates or periods, which are obtainable only from within the application itself. The application should also carefully check data received from the user and validate that it is sane and applicable before storing or using it.

'''''Repudiation'''''
Users may dispute transactions if there is insufficient auditing or recordkeeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss.

Therefore, consider if the application requires non-repudiation controls, such as web access logs, audit trails at each tier, or the same user context from top to bottom. Preferably, the application should run with the user’s privileges, not more, but this may not be possible with many off-the-shelf application frameworks.

'''''Information Disclosure'''''
Users are rightfully wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data at large, whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

Also, consider if the user’s web browser may leak information. Some web browsers may ignore the no caching directives in HTTP headers or handle them incorrectly. In a corresponding fashion, every secure application has a responsibility to minimize the amount of information stored by the web browser, just in case it leaks or leaves information behind, which can be used by an attacker to learn details about the application, the user, or to potentially become that user.

Finally, in implementing persistent values, keep in mind that the use of hidden fields is insecure by nature. Such storage should not be relied on to secure sensitive information or to provide adequate personal privacy safeguards.

'''''Denial of Service'''''
Application designers should be aware that their applications may be subject to a denial of service attack. Therefore, the use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users, and not available to anonymous users.

For applications that do not have this luxury, every facet of the application should be engineered to perform as little work as possible, to use fast and few database queries, to avoid exposing large files or unique links per user, in order to prevent simple denial of service attacks.

'''''Elevation of Privilege'''''
If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one. In particular, simply not displaying privileged role links is insufficient. Instead, all actions should be gated through an authorization matrix, to ensure that only the permitted roles can access privileged functionality.

=== DREAD ===
DREAD is a classification scheme for quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. The DREAD acronym is formed from the first letter of each category below.

DREAD modeling influences the thinking behind setting the risk rating, and is also used directly to sort the risks. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.

'''Risk_DREAD''' = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

The calculation always produces a number between 0 and 10; the higher the number, the more serious the risk.

Here are some examples of how to quantify the DREAD categories.

'''''Damage Potential'''''
* If a threat exploit occurs, how much damage will be caused?
**0 = Nothing
**5 = Individual user data is compromised or affected.
**10 = Complete system or data destruction

'''''Reproducibility'''''
* How easy is it to reproduce the threat exploit?
**0 = Very hard or impossible, even for administrators of the application.
**5 = One or two steps required, may need to be an authorized user.
**10 = Just a web browser and the address bar is sufficient, without authentication.

'''''Exploitability'''''
* What is needed to exploit this threat?
**0 = Advanced programming and networking knowledge, with custom or advanced attack tools.
**5 = Malware exists on the Internet, or an exploit is easily performed, using available attack tools.
**10 = Just a web browser

'''''Affected Users'''''
* How many users will be affected?
**0 = None
**5 = Some users, but not all
**10 = All users

'''''Discoverability'''''
* How easy is it to discover this threat?
**0 = Very hard to impossible; requires source code or administrative access.
**5 = Can figure it out by guessing or by monitoring network traces.
**9 = Details of faults like this are already in the public domain and can be easily discovered using a search engine.
**10 = The information is visible in the web browser address bar or in a form.

'''Note:''' When performing a security review of an existing application, “Discoverability” will often be set to 10 by convention, as it is assumed the threat issues will be discovered.

'''Note:''' Using DREAD can be difficult at first. It may be helpful to think of Damage Potential and Affected Users in terms of Impact, while thinking of Reproducibility, Exploitability, and Discoverability in terms of Probability. Using the Impact vs Probability approach (which follows best practices such as defined in NIST-800-30), I would alter the formula to make the Impact score equal to the Probability score. Otherwise the probability scores have more weight in the total.

== Alternative Threat Modeling Systems ==
OWASP recognizes that the adoption of the Microsoft modeling process may not fit all organizations. If STRIDE and DREAD are unacceptable for some reason, we recommend that your organization “dry run” the other threat risk models discussed against an existing application or design. This will allow you to determine which approach works best for you, and to adopt the most appropriate threat modeling tools for your organization.

'''In summary, performing threat modeling provides a far greater return than most any other control in this Guide. Therefore, make threat risk modeling an early priority in your application design process.'''

=== Trike ===
Trike is a threat modeling framework with similarities to the Microsoft threat modeling processes. However, Trike differs because it uses a risk based approach with distinct implementation, threat, and risk models, instead of using the STRIDE/DREAD aggregated threat model (attacks, threats, and weaknesses).
From the Trike paper, Trike’s goals are:
* With assistance from the system stakeholders, to ensure that the risk this system entails to each asset is acceptable to all stakeholders.
* Be able to tell whether we have done this.
* Communicate what we’ve done and its effects to the stakeholders.
* Empower stakeholders to understand and reduce the risks to them and other stakeholders implied by their actions within their domains.

For more information on Trike, please see Section 6.9, reference 8.

=== AS/NZS 4360:2004 Risk Management ===
The Australian/New Zealand Standard AS/NZS 4360, first issued in 1999, and revised in 2004, is the world’s first formal standard for documenting and managing risk and is still one of the few formal standards for managing it.
The standard’s approach is simple (it’s only 28 pages long), flexible, and iterative. Furthermore, it does not lock organizations into a particular risk management methodology, provided the methodology fulfils the AS/NZS 4360 five steps. It also provides several sets of risk tables as examples, and allows organizations to freely develop and adopt their own.

'''The five steps of the AS/NZS 4360 process are:'''
* '''Establish Context:''' Establish the risk domain, i.e., which assets/systems are important?
* '''Identify the Risks:''' Within the risk domain, what specific risks are apparent?
* '''Analyze the Risks:''' Look at the risks and determine if there are any supporting controls in place.
* '''Evaluate the Risks:''' Determine the residual risk.
* '''Treat the Risks:''' Describe the method to treat the risks so that risks selected by the business will be mitigated.
AS/NZS 4360 assumes that risk will be managed by an '''''operational risk group''''', and that the organization has adequate skills and risk management resources in house to identify, analyze, and treat the risks.

'''The advantages of AS/NZS 4360:'''
* AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.
* AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as just using likelihood and consequence to determine an overall risk.
* AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS/NZS 4360 compatible approach.
* You are an Australian organization, and may be required to use it if you are audited on a regular basis, or to justify why you aren’t using it. Luckily, the STRIDE/DREAD model discussed earlier is AS/NZS 4360 compatible.

'''The limitations of AS/NZS 4360:'''
* The AS/NZS 4360 approach works best for business or systemic risks than for technical risks.
* AS/NZS 4360 does not define the methodology to perform a structured threat risk modeling exercise.
* As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.
Although AS/NZS 4360 may be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methodologies described earlier.

=== CVSS ===
The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco Systems, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the group’s outputs is the '''''Common Vulnerability Scoring System (CVSS).'''''

'''The advantages of CVSS:'''
* You have just received notification from a security researcher or other source that your product has vulnerability, and you wish to ensure that it has an accurate and normalized severity rating, so as to alert your customers to the appropriate level of action required when you release the patch.
* You are a security researcher, and have found several threat exploits within an application. You would like to use the CVSS ranking system to produce reliable risk rankings, to ensure that the ISV will take the exploits seriously as indicated by their rating.
* CVSS has been recommended by the working group for use by US Government departments. However, it is unclear if it will become policy or be widely adopted at the time of this writing.
[[Category:FIXME|The first two are more scenarios than advantages]]

'''The limitations of CVSS:'''
* CVSS does not find or reduce the attack surface area (i.e. design flaws), or help enumerate risks within any arbitrary piece of code, as it is just a scoring system, not a modeling methodology.
* CVSS is more complex than STRIDE/DREAD, as it aims to calculate the risk of announced vulnerabilities as applied to deployed software and environmental factors.
* The CVSS risk ranking is complex – a spreadsheet is required to calculate the risk components as the assumption behind CVSS is that a specific vulnerability has been identified and announced, or a worm or Trojan has been released targeting a small number of attack vectors.
* The overhead of calculating the CVSS risk ranking is quite high if applied to a thorough code review, which may have 250 or more threats to rank.

=== OCTAVE ===
OCTAVE is a heavyweight risk methodology approach originating from Carnegie Mellon University’s Software Engineering Institute (SEI) in collaboration with CERT. OCTAVE focuses on organizational risk, not technical risk.
OCTAVE comes in two versions: Full OCTAVE, for large organizations, and OCTAVE-S for small organizations, both of which have specific catalogs of practices, profiles, and worksheets to document the modeling outcomes.

'''OCTAVE is popular with many sites and is useful when:'''
* Implementing an organizational culture of risk management and controls becomes necessary.
* Documenting and measuring business risk becomes timely.
* Documenting and measuring the overall IT security risk, particularly as it relates to the corporate IT risk management, becomes necessary.
* When documenting risks surrounding complete systems becomes necessary.
* To accommodate a fundamental reorganization, such as when an organization does not have a working risk methodology in place, and requires a robust risk management framework to be put in place.

'''The limitations of OCTAVE are:'''
* OCTAVE is incompatible with AS/NZS 4360, as it mandates Likelihood = 1 (i.e., It assumes a threat will always occur) and this is inappropriate for many organizations. OCTAVE-S makes the inclusion of this probability optional, but this is not part of the more comprehensive OCTAVE standard.
* Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement.
* It does not provide a list of “out of the box” practices for assessing and mitigating web application security risks.

Because of these issues, OWASP does not anticipate that OCTAVE will be used at large by application designers or developers, because it fails to take threat risk modeling into consideration, which is useful during all stages of development, by all participants, to reduce the overall risk of an application becoming vulnerable to attack.

== Conclusion ==
In this chapter, we have touched on the basic principles of threat risk modeling, risk management, and web application security. Applications that leverage the underlying intent of these principles will be more secure than their counterparts, which will only be minimally compliant just by including specific controls.

== Further Reading ==
* [http://www.microsoft.com/downloads/details.aspx?FamilyId=59888078-9DAF-4E96-B7D1-944703479451 Threat Analysis & Modeling v2.1.2], © Microsoft Corporation, 2007. [[category:FIXME |link not working, please replace]]
* [http://msdn.microsoft.com/library/ms978516.aspx Threat Modeling Web Applications], J.D. Meier, Alex Mackman, Blaine Wastell, © Microsoft Corporation, May 2005.
* [http://msdn.microsoft.com/library/ms994921.aspx Improving Web Application Security: Threats and Countermeasures], J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan, © Microsoft Corporation, June 2003.
* [http://www.microsoft.com/downloads/details.aspx?FamilyID=62830f95-0e61-4f87-88a6-e7c663444ac1&displaylang=en Threat Modeling], Frank Swiderski and Window Snyder, Microsoft Press, June 2004, ISBN 0-7356-1991-3.
* Writing Secure Code, 2nd Edition, Howard and LeBlanc, (pp. 69 – 124), Microsoft Press, 2003, ISBN 0-7356-1722-8.
* [http://msdn.microsoft.com/library/ms954176.aspx The STRIDE Threat Model], © Microsoft Corporation, 2005.
* [http://blogs.msdn.com/david_leblanc/archive/2007/08/13/dreadful.aspx DREADful] - the DREAD system, © Microsoft Corporation, 2005.
* [http://dymaxion.org/trike/Trike_v1_Methodology_Document-draft.pdf A Conceptual Model for Threat Modeling Applications], Saitta, Larcom, and Michael Eddington, July 2005, http://dymaxion.org/trike/.
* [http://www.standards.co.nz/web-shop/?action=viewSearchProduct&mod=catalog&pid=4360:2004(AS|NZS) AS/NZS 4360:2004 Risk Management], Standards Australia and Standards New Zealand.
* [http://www.dhs.gov/interweb/assetlibrary/NIAC_CyberVulnerabilitiesPaper_Feb05.pdf CVSS], U.S. Department of Homeland Security library, February 2005. [[category:FIXME |link not working, please replace]]
* [http://www.cert.org/octave/ OCTAVE], CERT library.

== Appendix: Alternative open-source Risk Management tools ==
* [http://sourceforge.net/projects/osmr/ OSMR]
* [http://sourceforge.net/projects/marco/ MARCO]
* [http://sourceforge.net/projects/coras/ CORAS Risk Assessment Platform]
* [http://sourceforge.net/projects/ratiso17799/ ISO 17799 Risk Assessment Toolkit]
* [http://sourceforge.net/projects/easy-tra/ Easy Threat Risk Assessment]
* [http://sourceforge.net/projects/arms-17799/ ARMS]
* [http://sourceforge.net/projects/minaccia/ Minaccia]
* [http://sourceforge.net/projects/threatmind/ ThreatMind]
* [http://sourceforge.net/projects/osrmt/ Open Source Requirements Management Tool]

== Reference ==
[[Guide Table of Contents|Development Guide Table of Contents]]

[[Category:OWASP_Guide_Project]]
[[Category:Activity]]
[[Category:Externally Linked Page]]
[[Category:Threat_Modeling]]

Application Threat Modeling

2010-09-29T19:55:43Z

ParanoidMike: added threat modeling category

__TOC__

===Introduction===
Threat modeling is an approach for analyzing the security of an application. It is a structured approach that enables you to identify, quantify, and address the security risks associated with an application. Threat modeling is not an approach to reviewing code, but it does complement the security code review process. The inclusion of threat modeling in the SDLC can help to ensure that applications are being developed with security built-in from the very beginning. This, combined with the documentation produced as part of the threat modeling process, can give the reviewer a greater understanding of the system. This allows the reviewer to see where the entry points to the application are and the associated threats with each entry point. The concept of threat modeling is not new but there has been a clear mindset change in recent years. Modern threat modeling looks at a system from a potential attacker's perspective, as opposed to a defender's viewpoint. Microsoft have been strong advocates of the process over the past number of years. They have made threat modeling a core component of their SDLC, which they claim to be one of the reasons for the increased security of their products in recent years.

When source code analysis is performed outside the SDLC, such as on existing applications, the results of the threat modeling help in reducing the complexity of the source code analysis by promoting an in-depth first approach vs. breadth first approach. Instead of reviewing all source code with equal focus, you can prioritize the security code review of components whose threat modeling has ranked with high risk threats.

The threat modeling process can be decomposed into 3 high level steps:

'''Step 1:''' Decompose the Application.
The first step in the threat modeling process is concerned with gaining an understanding of the application and how it interacts with external entities. This involves creating use-cases to understand how the application is used, identifying entry points to see where a potential attacker could interact with the application, identifying assets i.e. items/areas that the attacker would be interested in, and identifying trust levels which represent the access rights that the application will grant to external entities. This information is documented in the Threat Model document and it is also used to produce data flow diagrams (DFDs) for the application. The DFDs show the different paths through the system, highlighting the privilege boundaries.

'''Step 2:''' Determine and rank threats.
Critical to the identification of threats is using a threat categorization methodology. A threat categorization such as STRIDE can be used, or the Application Security Frame (ASF) that defines threat categories such as Auditing & Logging, Authentication, Authorization, Configuration Management, Data Protection in Storage and Transit, Data Validation, Exception Management. The goal of the threat categorization is to help identify threats both from the attacker (STRIDE) and the defensive perspective (ASF). DFDs produced in step 1 help to identify the potential threat targets from the attacker's perspective, such as data sources, processes, data flows, and interactions with users. These threats can be identified further as the roots for threat trees; there is one tree for each threat goal. From the defensive perspective, ASF categorization helps to identify the threats as weaknesses of security controls for such threats. Common threat-lists with examples can help in the identification of such threats. Use and abuse cases can illustrate how existing protective measures could be bypassed, or where a lack of such protection exists. The determination of the security risk for each threat can be determined using a value-based risk model such as DREAD or a less subjective qualitative risk model based upon general risk factors (e.g. likelihood and impact).

'''Step 3:''' Determine countermeasures and mitigation.
A lack of protection against a threat might indicate a vulnerability whose risk exposure could be mitigated with the implementation of a countermeasure. Such countermeasures can be identified using threat-countermeasure mapping lists. Once a risk ranking is assigned to the threats, it is possible to sort threats from the highest to the lowest risk, and prioritize the mitigation effort, such as by responding to such threats by applying the identified countermeasures. The risk mitigation strategy might involve evaluating these threats from the business impact that they pose and reducing the risk. Other options might include taking the risk, assuming the business impact is acceptable because of compensating controls, informing the user of the threat, removing the risk posed by the threat completely, or the least preferable option, that is, to do nothing.

Each of the above steps are documented as they are carried out. The resulting document is the threat model for the application. This guide will use an example to help explain the concepts behind threat modeling. The same example will be used throughout each of the 3 steps as a learning aid. The example that will be used is a college library website. At the end of the guide we will have produced the threat model for the college library website. Each of the steps in the threat modeling process are described in detail below.

== Decompose the Application ==
The goal of this step is to gain an understanding of the application and how it interacts with external entities. This goal is achieved by information gathering and documentation. The information gathering process is carried out using a clearly defined structure, which ensures the correct information is collected. This structure also defines how the information should be documented to produce the Threat Model.

==Threat Model Information==
The first item in the threat model is the information relating to the threat model.
This must include the the following:

# '''Application Name''' - The name of the application.
# '''Application Version''' - The version of the application.
# '''Description''' - A high level description of the application.
# '''Document Owner''' - The owner of the threat modeling document.
# '''Participants''' - The participants involved in the threat modeling process for this application.
# '''Reviewer''' - The reviewer(s) of the threat model. 
Example: 
[[Category:FIXME|the list above includes an Application name, but the example does not have one]]

<table align="center" cellspacing="1" CELLPADDING="7">

<tr bgcolor="#cccccc">
<th colspan="2" align="center">Threat Model Information</th>
</tr>

<tr bgcolor="#cccccc">
<th align="left">Application Version:</th>
<td>1.0</td>
</tr>

<tr bgcolor="#dddddd">
<th align="left"> Description:</th>
<td>The college library website is the first implementation of a website to provide librarians and library patrons (students and college staff) with online services.
As this is the first implementation of the website, the functionality will be limited. There will be three users of the application: 
1. Students 
2. Staff 
3. Librarians 
Staff and students will be able to log in and search for books, and staff members can request books. Librarians will be able to log in, add books, add users, and search for books.</td>
</tr>

<tr bgcolor="#cccccc">
<th align="left">Document Owner:</th>
<td>David Lowry</td>
</tr>

<tr bgcolor="#dddddd">
<th align="left">Participants:</th>
<td>David Rook</td>
</tr>

<tr bgcolor="#cccccc">
<th align="left">Reviewer:</th>
<td>Eoin Keary</td>
</tr>

</table>
 

==External Dependencies==
External dependencies are items external to the code of the application that may pose a threat to the application. These items are typically still within the control of the organization, but possibly not within the control of the development team. The first area to look at when investigating external dependencies is how the application will be deployed in a production environment, and what are the requirements surrounding this. This involves looking at how the application is or is not intended to be run. For example if the application is expected to be run on a server that has been hardened to the organization's hardening standard and it is expected to sit behind a firewall, then this information should be documented in the external dependencies section. External dependencies should be documented as follows:

# '''ID''' - A unique ID assigned to the external dependency.
# '''Description''' - A textual description of the external dependency.
 
Example:
 
<table align="center" cellspacing="1" CELLPADDING="7">

<tr bgcolor="#cccccc">
<th colspan="2" align="center">External Dependencies</th>
</tr>

<tr bgcolor="#cccccc">
<th>ID</th>
<th>Description</th>
</tr>

<tr bgcolor="#dddddd">
<td>1</td>
<td>The college library website will run on a Linux server running Apache. This server will be hardened as per the college's server hardening standard. This includes the application of the latest operating system and application security patches.</td>
</tr>

<tr bgcolor="#cccccc">
<td>2</td>
<td>The database server will be MySQL and it will run on a Linux server. This server will be hardened as per the college's server hardening standard. This will include the application of the lastest operating system and application security patches.</td>
</tr>

<tr bgcolor="#dddddd">
<td>3</td>
<td>The connection between the Web Server and the database server will be over a private network.</td>
</tr>

<tr bgcolor="#cccccc">
<td>4</td>
<td>The Web Server is behind a firewall and the only communication available is TLS.</td>
</tr>

</table>
 

==Entry Points==
Entry points define the interfaces through which potential attackers can interact with the application or supply it with data. In order for a potential attacker to attack an application, entry points must exist. Entry points in an application can be layered, for example each web page in a web application may contain multiple entry points. Entry points should be documented as follows:

# '''ID''' - A unique ID assigned to the entry point. This will be used to cross reference the entry point with any threats or vulnerabilities that are identified. In the case of layer entry points, a major.minor notation should be used.
# '''Name''' - A descriptive name identifying the entry point and its purpose.
# '''Description''' - A textual description detailing the interaction or processing that occurs at the entry point.
# '''Trust Levels''' - The level of access required at the entry point is documented here. These will be cross referenced with the trusts levels defined later in the document.
 
Example:
 
<table align="center" cellspacing="1" CELLPADDING="7">

<tr bgcolor="#cccccc">
<th colspan="4" align="center">Entry Points</th>
</tr>

<tr bgcolor="#cccccc">
<th width="5%">ID</th>
<th width="15%">Name</th>
<th width="45%">Description</th>
<th width="25%">Trust Levels</th>
</tr>

<tr bgcolor="#dddddd">
<td>1</td>
<td>HTTPS Port</td>
<td>The college library website will be only be accessable via TLS. All pages within the college library website are layered on this entry point.</td>
<td>(1) Anonymous Web User 
(2) User with Valid Login Credentials 
(3) User with Invalid Login Credentials 
(4) Librarian 
</tr>

<tr bgcolor="#cccccc">
<td>1.1</td>
<td>Library Main Page</td>
<td>The splash page for the college library website is the entry point for all users.</td>
<td>(1) Anonymous Web User 
(2) User with Valid Login Credentials 
(3) User with Invalid Login Credentials 
(4) Librarian 
</tr>

<tr bgcolor="#dddddd">
<td>1.2</td>
<td>Login Page</td>
<td>Students, faculty members and librarians must log in to the college library website before they can carry out any of the use cases.</td>
<td>(1) Anonymous Web User 
(2) User with Login Credentials 
(3) User with Invalid Login Credentials 
(4) Librarian 
</td>
</tr>

<tr bgcolor="#cccccc">
<td>1.2.1</td>
<td>Login Function</td>
<td>The login function accepts user supplied credentials and compares them with those in the database.</td>
<td>
(2) User with Valid Login Credentials 
(3) User with Invalid Login Credentials 
(4) Librarian</td>
</tr>

<tr bgcolor="#dddddd">
<td>1.3</td>
<td>Search Entry Page</td>
<td>The page used to enter a search query.</td>
<td>
(2) User with Valid Login Credentials 
(4) Librarian</td>
</tr>

</table>
 

==Assets==
The system must have something that the attacker is interested in; these items/areas of interest are defined as assets. Assets are essentially threat targets, i.e. they are the reason threats will exist. Assets can be both physical assets and abstract assets. For example, an asset of an application might be a list of clients and their personal information; this is a physical asset. An abstract asset might be the reputation of an organsation. Assets are documented in the threat model as follows:

# '''ID''' - A unique ID is assigned to identify each asset. This will be used to cross reference the asset with any threats or vulnerabilities that are identified.
# '''Name''' - A descriptive name that clearly identifies the asset.
# '''Description''' - A textual description of what the asset is and why it needs to be protected.
# '''Trust Levels''' - The level of access required to access the entry point is documented here. These will be cross referenced with the trust levels defined in the next step.
 
Example:
 
<table align="center" cellspacing="1" CELLPADDING="7">

<tr bgcolor="#cccccc">
<th colspan="4" align="center">Assets</th>
</tr>

<tr bgcolor="#cccccc">
<th width="5%">ID</th>
<th width="15%">Name</th>
<th width="55%">Description</th>
<th width="25%">Trust Levels</th>
</tr>

<tr bgcolor="#cccccc">
<td>1</td>
<td>Library Users and Librarian</td>
<td>Assets relating to students, faculty members, and librarians.</td>
<td></td>
</tr>

<tr bgcolor="#dddddd">
<td>1.1</td>
<td>User Login Details</td>
<td>The login credentials that a student or a faculty member will use to log into the College Library website.</td>
<td>
(2) User with Valid Login Credentials 
(4) Librarian 
(5) Database Server Administrator 
(7) Web Server User Process 
(8) Database Read User 
(9) Database Read/Write User
</td></tr>

<tr bgcolor="#dddddd">
<td>1.2</td>
<td>Librarian Login Details</td>
<td>The login credentials that a Librarian will use to log into the College Library website.</td>
<td>
(4) Librarian 
(5) Database Server Administrator 
(7) Web Server User Process 
(8) Database Read User 
(9) Database Read/Write User
</td></tr>

<tr bgcolor="#dddddd">
<td>1.3</td>
<td>Personal Data</td>
<td>The College Library website will store personal information relating to the students, faculty members, and librarians.</td>
<td>
(4) Librarian 
(5) Database Server Administrator 
(6) Website Administrator 
(7) Web Server User Process 
(8) Database Read User 
(9) Database Read/Write User

</td></tr>

<tr bgcolor="#cccccc">
<td>2</td>
<td>System</td>
<td>Assets relating to the underlying system.</td>
<td></td>
</tr>

<tr bgcolor="#dddddd">
<td>2.1</td>
<td>Availability of College Library Website</td>
<td>The College Library website should be available 24 hours a day and can be accessed by all students, college faculty members, and librarians.</td>
<td>
(5) Database Server Administrator 
(6) Website Administrator 
</td>
</tr>

<tr bgcolor="#dddddd">
<td>2.2</td>
<td>Ability to Execute Code as a Web Server User</td>
<td>This is the ability to execute source code on the web server as a web server user.</td>
<td>
(6) Website Administrator 
(7) Web Server User Process 
</td>
</tr>

<tr bgcolor="#dddddd">
<td>2.3</td>
<td>Ability to Execute SQL as a Database Read User</td>
<td>This is the ability to execute SQL select queries on the database, and thus retrieve any information stored within the College Library database.</td>
<td>
(5) Database Server Administrator 
(8) Database Read User 
(9) Database Read/Write User 
</td>
</tr>

<tr bgcolor="#dddddd">
<td>2.4</td>
<td>Ability to Execute SQL as a Database Read/Write User</td>
<td>This is the ability to execute SQL. Select, insert, and update queries on the database and thus have read and write access to any information stored within the College Library database.</td>
<td>
(5) Database Server Administrator 
(9) Database Read/Write User 
</td>
</tr>

<tr bgcolor="#cccccc">
<td>3</td>
<td>Website</td>
<td>Assets relating to the College Library website.</td>
<td></td>
</tr>

<tr bgcolor="#dddddd">
<td>3.1</td>
<td>Login Session</td>
<td>This is the login session of a user to the College Library website. This user could be a student, a member of the college faculty, or a Librarian.</td>
<td>
(2) User with Valid Login Credentials 
(4) Librarian 
</td>
</tr>

<tr bgcolor="#dddddd">
<td>3.2</td>
<td>Access to the Database Server</td>
<td>Access to the database server allows you to administer the database, giving you full access to the database users and all data contained within the database.</td>
<td>
(5) Database Server Administrator 
</td>
</tr>

<tr bgcolor="#dddddd">
<td>3.3</td>
<td>Ability to Create Users</td>
<td>The ability to create users would allow an individual to create new users on the system. These could be student users, faculty member users, and librarian users.</td>
<td>
(4) Librarian 
(6) Website Administrator 
</td>
</tr>

<tr bgcolor="#dddddd">
<td>3.3</td>
<td>Access to Audit Data</td>
<td>The audit data shows all audit-able events that occurred within the College Library application by students, staff, and librarians.</td>
<td>
(6) Website Administrator 
</td>
</tr>

</table>

 

==Trust Levels==
Trust levels represent the access rights that the application will grant to external entities. The trust levels are cross referenced with the entry points and assets. This allows us to define the access rights or privileges required at each entry point, and those required to interact with each asset. Trust levels are documented in the threat model as follows:

# '''ID''' - A unique number is assigned to each trust level. This is used to cross reference the trust level with the entry points and assets.
# '''Name''' - A descriptive name that allows you to identify the external entities that have been granted this trust level.
# '''Description''' - A textual description of the trust level detailing the external entity who has been granted the trust level.
 
Example:
 
<table align="center" cellspacing="1" CELLPADDING="7">

<tr bgcolor="#cccccc">
<th colspan="4" align="center">Trust Levels</th>
</tr>

<tr bgcolor="#cccccc">
<th width="5%">ID</th>
<th width="25%">Name</th>
<th width="70%">Description</th>
</tr>

<tr bgcolor="#dddddd">
<td>1</td>
<td>Anonymous Web User</td>
<td>A user who has connected to the college library website but has not provided valid credentials.</td>
</tr>

<tr bgcolor="#cccccc">
<td>2</td>
<td>User with Valid Login Credentials</td>
<td>A user who has connected to the college library website and has logged in using valid login credentials.</td>
</tr>

<tr bgcolor="#cccccc">
<td>3</td>
<td>User with Invalid Login Credentials</td>
<td>A user who has connected to the college library website and is attempting to log in using invalid login credentials.</td>
</tr>

<tr bgcolor="#dddddd">
<td>4</td>
<td>Librarian</td>
<td>The librarian can create users on the library website and view their personal information.</td>
</tr>

<tr bgcolor="#cccccc">
<td>5</td>
<td>Database Server Administrator</td>
<td>The database server administrator has read and write access to the database that is used by the college library website.</td>
</tr>

<tr bgcolor="#dddddd">
<td>6</td>
<td>Website Administrator</td>
<td>The Website administrator can configure the college library website.</td>
</tr>

<tr bgcolor="#cccccc">
<td>7</td>
<td>Web Server User Process</td>
<td>This is the process/user that the web server executes code as and authenticates itself against the database server as.</td>
</tr>

<tr bgcolor="#dddddd">
<td>8</td>
<td>Database Read User</td>
<td>The database user account used to access the database for read access.</td>
</tr>

<tr bgcolor="#cccccc">
<td>9</td>
<td>Database Read/Write User</td>
<td>The database user account used to access the database for read and write access.</td>
</tr>
</table>
 

==Data Flow Diagrams==
All of the information collected allows us to accurately model the application through the use of Data Flow Diagrams (DFDs). The DFDs will allow us to gain a better understanding of the application by providing a visual representation of how the application processes data. The focus of the DFDs is on how data moves through the application and what happens to the data as it moves. DFDs are hierarchical in structure, so they can be used to decompose the application into subsystems and lower-level subsystems. The high level DFD will allow us to clarify the scope of the application being modeled. The lower level iterations will allow us to focus on the specific processes involved when processing specific data. There are a number of symbols that are used in DFDs for threat modeling. These are described below:

'''External Entity''' 
The external entity shape is used to represent any entity outside the application that interacts with the application via an entry point. 
[[Image:DFD_external_entity.gif]]
 

'''Process''' 
The process shape represents a task that handles data within the application. The task may process the data or perform an action based on the data. 
[[Image:DFD_process.gif]]
 

'''Multiple Process''' 
The multiple process shape is used to present a collection of subprocesses. The multiple process can be broken down into its subprocesses in another DFD. 
[[Image:DFD_multiple_process.gif]]
 

'''Data Store''' 
The data store shape is used to represent locations where data is stored. Data stores do not modify the data, they only store data. 
[[Image:DFD_data_store.gif]]
 

'''Data Flow''' 
The data flow shape represents data movement within the application. The direction of the data movement is represented by the arrow. 
[[Image:DFD_data_flow.gif]]
 
'''Privilege Boundary''' 
The privilege boundary shape is used to represent the change of privilege levels as the data flows through the application. 
[[Image:DFD_privilge_boundary.gif]]
 

===Example===
 '''Data Flow Diagram for the College Library Website'''
 
[[Image:Data flow1.jpg]]
 
'''User Login Data Flow Diagram for the College Library Website'''
 
[[Image:Data flow2.jpg]]
 

== Determine and Rank Threats ==
===Threat Categorization===
The first step in the determination of threats is adopting a threat categorization. A threat categorization provides a set of threat categories with corresponding examples so that threats can be systematically identified in the application in a structured and repeatable manner.

====STRIDE====
A threat categorization such as STRIDE is useful in the identification of threats by classifying attacker goals such as:
*Spoofing
*Tampering
*Repudiation
*Information Disclosure
*Denial of Service
*Elevation of Privilege.

A threat list of generic threats organized in these categories with examples and the affected security controls is provided in the following table:

 
<table align="center" cellspacing="1" CELLPADDING="7">

<tr bgcolor="#cccccc">
<th colspan="4" align="center">STRIDE Threat List</th>
</tr>

<tr bgcolor="#cccccc">
<th>Type</th>
<th>Examples</th>
<th>Security Control</th>
</tr>

<tr bgcolor="#cccccc">
<td>Spoofing</td>
<td>Threat action aimed to illegally access and use another user's credentials, such as username and password.</td>
<td>Authentication</td>
</tr>

<tr bgcolor="#cccccc">
<td>Tampering</td>
<td>Threat action aimed to maliciously change/modify persistent data, such as persistent data in a database, and the alteration of data in transit between two computers over an open network, such as the Internet.</td>
<td>Integrity</td>
</tr>

<tr bgcolor="#dddddd">
<td>Repudiation</td>
<td>Threat action aimed to perform illegal operations in a system that lacks the ability to trace the prohibited operations.</td>
<td>Non-Repudiation</td>
</tr>

<tr bgcolor="#cccccc">
<td>Information disclosure</td>
<td>Threat action to read a file that one was not granted access to, or to read data in transit. </td>
<td>Confidentiality</td>
</tr>

<tr bgcolor="#dddddd">
<td>Denial of service</td>
<td>Threat aimed to deny access to valid users, such as by making a web server temporarily unavailable or unusable.
</td>
<td>Availability</td>
</tr>

<tr bgcolor="#cccccc">
<td>Elevation of privilege</td>
<td>Threat aimed to gain privileged access to resources for gaining unauthorized access to information or to compromise a system.</td>
<td>Authorization</td>

</table>
 

==Security Controls==
Once the basic threat agents and business impacts are understood, the review team should try to identify the set of controls that could prevent these threat agents from causing those impacts. The primary focus of the code review should be to ensure that these security controls are in place, that they work properly, and that they are correctly invoked in all the necessary places. The checklist below can help to ensure that all the likely risks have been considered.

'''Authentication:'''
*Ensure all internal and external connections (user and entity) go through an appropriate and adequate form of authentication. Be assured that this control cannot be bypassed.
*Ensure all pages enforce the requirement for authentication.
*Ensure that whenever authentication credentials or any other sensitive information is passed, only accept the information via the HTTP “POST” method and will not accept it via the HTTP “GET” method.
*Any page deemed by the business or the development team as being outside the scope of authentication should be reviewed in order to assess any possibility of security breach.
*Ensure that authentication credentials do not traverse the wire in clear text form.
*Ensure development/debug backdoors are not present in production code.

'''Authorization: '''
*Ensure that there are authorization mechanisms in place.
*Ensure that the application has clearly defined the user types and the rights of said users.
*Ensure there is a least privilege stance in operation.
*Ensure that the Authorization mechanisms work properly, fail securely, and cannot be circumvented.
*Ensure that authorization is checked on every request.
*Ensure development/debug backdoors are not present in production code.

'''Cookie Management: '''
*Ensure that sensitive information is not comprised.
*Ensure that unauthorized activities cannot take place via cookie manipulation.
*Ensure that proper encryption is in use.
*Ensure secure flag is set to prevent accidental transmission over “the wire” in a non-secure manner.
*Determine if all state transitions in the application code properly check for the cookies and enforce their use.
*Ensure the session data is being validated.
*Ensure cookies contain as little private information as possible.
*Ensure entire cookie is encrypted if sensitive data is persisted in the cookie.
*Define all cookies being used by the application, their name, and why they are needed.

'''Data/Input Validation: '''
*Ensure that a DV mechanism is present.
*Ensure all input that can (and will) be modified by a malicious user such as HTTP headers, input fields, hidden fields, drop down lists, and other web components are properly validated.
*Ensure that the proper length checks on all input exist.
*Ensure that all fields, cookies, http headers/bodies, and form fields are validated.
*Ensure that the data is well formed and contains only known good chars if possible.
*Ensure that the data validation occurs on the server side.
*Examine where data validation occurs and if a centralized model or decentralized model is used.
*Ensure there are no backdoors in the data validation model.
*'''Golden Rule: All external input, no matter what it is, is examined and validated. '''

'''Error Handling/Information leakage: '''
*Ensure that all method/function calls that return a value have proper error handling and return value checking.
*Ensure that exceptions and error conditions are properly handled.
*Ensure that no system errors can be returned to the user.
*Ensure that the application fails in a secure manner.
*Ensure resources are released if an error occurs.

'''Logging/Auditing: '''
*Ensure that no sensitive information is logged in the event of an error.
*Ensure the payload being logged is of a defined maximum length and that the logging mechanism enforces that length.
*Ensure no sensitive data can be logged; e.g. cookies, HTTP “GET” method, authentication credentials.
*Examine if the application will audit the actions being taken by the application on behalf of the client (particularly data manipulation/Create, Update, Delete (CUD) operations).
*Ensure successful and unsuccessful authentication is logged.
*Ensure application errors are logged.
*Examine the application for debug logging with the view to logging of sensitive data.

'''Cryptography: '''
*Ensure no sensitive data is transmitted in the clear, internally or externally.
*Ensure the application is implementing known good cryptographic methods.

'''Secure Code Environment: '''
*Examine the file structure. Are any components that should not be directly accessible available to the user?
*Examine all memory allocations/de-allocations.
*Examine the application for dynamic SQL and determine if it is vulnerable to injection.
*Examine the application for “main()” executable functions and debug harnesses/backdoors.
*Search for commented out code, commented out test code, which may contain sensitive information.
*Ensure all logical decisions have a default clause.
*Ensure no development environment kit is contained on the build directories.
*Search for any calls to the underlying operating system or file open calls and examine the error possibilities.

'''Session Management: '''
*Examine how and when a session is created for a user, unauthenticated and authenticated.
*Examine the session ID and verify if it is complex enough to fulfill requirements regarding strength.
*Examine how sessions are stored: e.g. in a database, in memory etc.
*Examine how the application tracks sessions.
*Determine the actions the application takes if an invalid session ID occurs.
*Examine session invalidation.
*Determine how multithreaded/multi-user session management is performed.
*Determine the session HTTP inactivity timeout.
*Determine how the log-out functionality functions.

==Threat Analysis==
The prerequisite in the analysis of threats is the understanding of the generic definition of risk that is the probability that a threat agent will exploit a vulnerability to cause an impact to the application. From the perspective of risk management, threat modeling is the systematic and strategic approach for identifying and enumerating threats to an application environment with the objective of minimizing risk and the associated impacts.

Threat analysis as such is the identification of the threats to the application, and involves the analysis of each aspect of the application functionality and architecture and design to identify and classify potential weaknesses that could lead to an exploit.

In the first threat modeling step, we have modeled the system showing data flows, trust boundaries, process components, and entry and exit points. An example of such modeling is shown in the Example: Data Flow Diagram for the College Library Website.

Data flows show how data flows logically through the end to end, and allows the identification of affected components through critical points (i.e. data entering or leaving the system, storage of data) and the flow of control through these components. Trust boundaries show any location where the level of trust changes. Process components show where data is processed, such as web servers, application servers, and database servers. Entry points show where data enters the system (i.e. input fields, methods) and exit points are where it leaves the system (i.e. dynamic output, methods), respectively. Entry and exit points define a trust boundary.

Threat lists based on the STRIDE model are useful in the identification of threats with regards to the attacker goals. For example, if the threat scenario is attacking the login, would the attacker brute force the password to break the authentication? If the threat scenario is to try to elevate privileges to gain another user’s privileges, would the attacker try to perform forceful browsing?

It is vital that all possible attack vectors should be evaluated from the attacker’s point of view. For this reason, it is also important to consider entry and exit points, since they could also allow the realization of certain kinds of threats. For example, the login page allows sending authentication credentials, and the input data accepted by an entry point has to validate for potential malicious input to exploit vulnerabilities such as SQL injection, cross site scripting, and buffer overflows. Additionally, the data flow passing through that point has to be used to determine the threats to the entry points to the next components along the flow. If the following components can be regarded critical (e.g. the hold sensitive data), that entry point can be regarded more critical as well. In an end to end data flow, for example, the input data (i.e. username and password) from a login page, passed on without validation, could be exploited for a SQL injection attack to manipulate a query for breaking the authentication or to modify a table in the database.

Exit points might serve as attack points to the client (e.g. XSS vulnerabilities) as well for the realization of information disclosure vulnerabilities. For example, in the case of exit points from components handling confidential data (e.g. data access components), exit points lacking security controls to protect the confidentiality and integrity can lead to disclosure of such confidential information to an unauthorized user.

In many cases threats enabled by exit points are related to the threats of the corresponding entry point. In the login example, error messages returned to the user via the exit point might allow for entry point attacks, such as account harvesting (e.g. username not found), or SQL injection (e.g. SQL exception errors).

From the defensive perspective, the identification of threats driven by security control categorization such as ASF, allows a threat analyst to focus on specific issues related to weaknesses (e.g. vulnerabilities) in security controls. Typically the process of threat identification involves going through iterative cycles where initially all the possible threats in the threat list that apply to each component are evaluated.

At the next iteration, threats are further analyzed by exploring the attack paths, the root causes (e.g. vulnerabilities, depicted as orange blocks) for the threat to be exploited, and the necessary mitigation controls (e.g. countermeasures, depicted as green blocks). A threat tree as shown in figure 2 is useful to perform such threat analysis

[[Image:Threat_Graph.gif|Figure 2: Threat Graph]]

Once common threats, vulnerabilities, and attacks are assessed, a more focused threat analysis should take in consideration use and abuse cases. By thoroughly analyzing the use scenarios, weaknesses can be identified that could lead to the realization of a threat. Abuse cases should be identified as part of the security requirement engineering activity. These abuse cases can illustrate how existing protective measures could be bypassed, or where a lack of such protection exists. A use and misuse case graph for authentication is shown in figure below:

[[Image:UseAndMisuseCase.jpg|640px|Figure 3: Use and Misuse Case]]

Finally, it is possible to bring all of this together by determining the types of threat to each component of the decomposed system. This can be done by using a threat categorization such as STRIDE or ASF, the use of threat trees to determine how the threat can be exposed by a vulnerability, and use and misuse cases to further validate the lack of a countermeasure to mitigate the threat.

To apply STRIDE to the data flow diagram items the following table can be used:

TABLE

==Ranking of Threats==
Threats can be ranked from the perspective of risk factors. By determining the risk factor posed by the various identified threats, it is possible to create a prioritized list of threats to support a risk mitigation strategy, such as deciding on which threats have to be mitigated first. Different risk factors can be used to determine which threats can be ranked as High, Medium, or Low risk. In general, threat risk models use different factors to model risks such as those shown in figure below:

[[Image:Riskfactors.JPG|Figure 3: Risk Model Factors]]

==DREAD==
In the Microsoft DREAD threat-risk ranking model, the technical risk factors for impact are Damage and Affected Users, while the ease of exploitation factors are Reproducibility, Exploitability and Discoverability. This risk factorization allows the assignment of values to the different influencing factors of a threat. To determine the ranking of a threat, the threat analyst has to answer basic questions for each factor of risk, for example:

*For Damage: How big would the damage be if the attack succeeded?
*For Reproducibility: How easy is it to reproduce an attack to work?
*For Exploitability: How much time, effort, and expertise is needed to exploit the threat?
*For Affected Users: If a threat were exploited, what percentage of users would be affected?
*For Discoverability: How easy is it for an attacker to discover this threat?

By referring to the college library website it is possible to document sample threats releated to the use cases such as:

'''Threat: Malicious user views confidential information of students, faculty members and librarians.'''
# '''Damage potential:''' Threat to reputation as well as financial and legal liability:8
# '''Reproducibility:''' Fully reproducible:10
# '''Exploitability:''' Require to be on the same subnet or have compromised a router:7
# '''Affected users:''' Affects all users:10
# '''Discoverability:''' Can be found out easily:10

Overall DREAD score: (8+10+7+10+10) / 5 = 9

In this case having 9 on a 10 point scale is certainly an high risk threat

==Generic Risk Model==
A more generic risk model takes into consideration the Likelihood (e.g. probability of an attack) and the Impact (e.g. damage potential):

'''Risk = Likelihood x Impact'''

The likelihood or probability is defined by the ease of exploitation, which mainly depends on the type of threat and the system characteristics, and by the possibility to realize a threat, which is determined by the existence of an appropriate countermeasure.

The following is a set of considerations for determining ease of exploitation:
# Can an attacker exploit this remotely?
# Does the attacker need to be authenticated?
# Can the exploit be automated?

The impact mainly depends on the damage potential and the extent of the impact, such as the number of components that are affected by a threat.

Examples to determine the damage potential are:
# Can an attacker completely take over and manipulate the system?
# Can an attacker gain administration access to the system?
# Can an attacker crash the system?
# Can the attacker obtain access to sensitive information such as secrets, PII

Examples to determine the number of components that are affected by a threat:
# How many data sources and systems can be impacted?
# How “deep” into the infrastructure can the threat agent go?

These examples help in the calculation of the overall risk values by assigning qualitative values such as High, Medium and Low to Likelihood and Impact factors. In this case, using qualitative values, rather than numeric ones like in the case of the DREAD model, help avoid the ranking becoming overly subjective.

==Countermeasure Identification==
The purpose of the countermeasure identification is to determine if there is some kind of protective measure (e.g. security control, policy measures) in place that can prevent each threat previosly identified via threat analysis from being realized. Vulnerabilities are then those threats that have no countermeasures. Since each of these threats has been categorized either with STRIDE or ASF, it is possible to find appropriate countermeasures in the application within the given category.

Provided below is a brief and limited checklist which is by no means an exhaustive list for identifying countermeasures for specific threats.

Example of countermeasures for ASF threat types are included in the following table:

<table align="center" cellspacing="1" CELLPADDING="7">
<tr bgcolor="#cccccc">
<th colspan="4" align="center">ASF Threat & Countermeasures List</th>
</tr>

<tr bgcolor="#cccccc">
<th>Threat Type</th>
<th>Countermeasure</th>
</tr>

<tr bgcolor="#cccccc">
<td>Authentication</td>
<td>
#Credentials and authentication tokens are protected with encryption in storage and transit
#Protocols are resistant to brute force, dictionary, and replay attacks
#Strong password policies are enforced
#Trusted server authentication is used instead of SQL authentication
#Passwords are stored with salted hashes
#Password resets do not reveal password hints and valid usernames
#Account lockouts do not result in a denial of service attack
</td>
</tr>

<tr bgcolor="#cccccc">
<td>Authorization</td>
<td>
#Strong ACLs are used for enforcing authorized access to resources
#Role-based access controls are used to restrict access to specific operations
#The system follows the principle of least privilege for user and service accounts
#Privilege separation is correctly configured within the presentation, business and data access layers</td>
</tr>

<tr bgcolor="#cccccc">
<td>Configuration Management</td>
<td>
#Least privileged processes are used and service accounts with no administration capability
#Auditing and logging of all administration activities is enabled
#Access to configuration files and administrator interfaces is restricted to administrators
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Data Protection in Storage and Transit</td>
<td>
#Standard encryption algorithms and correct key sizes are being used
#Hashed message authentication codes (HMACs) are used to protect data integrity
#Secrets (e.g. keys, confidential data ) are cryptographically protected both in transport and in storage
#Built-in secure storage is used for protecting keys
#No credentials and sensitive data are sent in clear text over the wire
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Data Validation / Parameter Validation</td>
<td>
#Data type, format, length, and range checks are enforced
#All data sent from the client is validated
#No security decision is based upon parameters (e.g. URL parameters) that can be manipulated
#Input filtering via white list validation is used
#Output encoding is used
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Error Handling and Exception Management</td>
<td>
#All exceptions are handled in a structured manner
#Privileges are restored to the appropriate level in case of errors and exceptions
#Error messages are scrubbed so that no sensitive information is revealed to the attacker

</td>
</tr>
<tr bgcolor="#cccccc">
<td>User and Session Management</td>
<td>
#No sensitive information is stored in clear text in the cookie
#The contents of the authentication cookies is encrypted
#Cookies are configured to expire
#Sessions are resistant to replay attacks
#Secure communication channels are used to protect authentication cookies
#User is forced to re-authenticate when performing critical functions
#Sessions are expired at logout
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Auditing and Logging</td>
<td>
#Sensitive information (e.g. passwords, PII) is not logged
#Access controls (e.g. ACLs) are enforced on log files to prevent un-authorized access
#Integrity controls (e.g. signatures) are enforced on log files to provide non-repudiation
#Log files provide for audit trail for sensitive operations and logging of key events
#Auditing and logging is enabled across the tiers on multiple servers
</td>
</tr>
</table>

When using STRIDE, the following threat-mitigation table can be used to identify techniques that can be employed to mitigate the threats.

<table align="center" cellspacing="1" CELLPADDING="7">
<tr bgcolor="#cccccc">
<th colspan="4" align="center">STRIDE Threat & Mitigation Techniques List</th>
</tr>

<tr bgcolor="#cccccc">
<th>Threat Type</th>
<th>Mitigation Techniques</th>
</tr>

<tr bgcolor="#cccccc">
<td>Spoofing Identity</td>
<td>
#Appropriate authentication
#Protect secret data
#Don't store secrets
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Tampering with data</td>
<td>
#Appropriate authorization
#Hashes
#MACs
#Digital signatures
#Tamper resistant protocols
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Repudiation</td>
<td>
#Digital signatures
#Timestamps
#Audit trails
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Information Disclosure</td>
<td>
#Authorization
#Privacy-enhanced protocols
#Encryption
#Protect secrets
#Don't store secrets
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Denial of Service</td>
<td>
#Appropriate authentication
#Appropriate authorization
#Filtering
#Throttling
#Quality of service
</td>
</tr>
<tr bgcolor="#cccccc">
<td>Elevation of privilege</td>
<td>
#Run with least privilege
</td>
</tr>
</table>

Once threats and corresponding countermeasures are identified it is possible to derive a threat profile with the following criteria:

# '''Non mitigated threats:''' Threats which have no countermeasures and represent vulnerabilities that can be fully exploited and cause an impact
# '''Partially mitigated threats:''' Threats partially mitigated by one or more countermeasures which represent vulnerabilities that can only partially be exploited and cause a limited impact
# '''Fully mitigated threats:''' These threats have appropriate countermeasures in place and do not expose vulnerability and cause impact

===Mitigation Strategies===
The objective of risk management is to reduce the impact that the exploitation of a threat can have to the application. This can be done by responding to a theat with a risk mitigation strategy. In general there are five options to mitigate threats
# '''Do nothing:''' for example, hoping for the best
# '''Inform about the risk:''' for example, warning user population about the risk
# '''Mitigate the risk:''' for example, by putting countermeasures in place
# '''Accept the risk:''' for example, after evaluating the impact of the exploitation (business impact)
# '''Transfer the risk:''' for example, through contractual agreements and insurance

The decision of which strategy is most appropriate depends on the impact an exploitation of a threat can have, the likelihood of its occurrence, and the costs for transferring (i.e. costs for insurance) or avoiding (i.e. costs or losses due redesign) it. That is, such decision is based on the risk a threat poses to the system. Therefore, the chosen strategy does not mitigate the threat itself but the risk it poses to the system. Ultimately the overall risk has to take into account the business impact, since this is a critical factor for the business risk management strategy. One strategy could be to fix only the vulnerabilities for which the cost to fix is less than the potential business impact derived by the exploitation of the vulnerability. Another strategy could be to accept the risk when the loss of some security controls (e.g. Confidentiality, Integrity, and Availability) implies a small degradation of the service, and not a loss of a critical business function. In some cases, transfer of the risk to another service provider might also be an option.

[[Category:OWASP Code Review Project]]
[[Category:Threat_Modeling]]

ASP.NET POET Vulnerability

2010-09-20T21:45:35Z

ParanoidMike: Added introductory sentences as a first step towards Dinis' recommended "good/objective description of the problem, good technical desciption of the problem and tons of references"

__TOC__
This page contains details about the ASP.NET POET vulnerability disclosed on 2010-09-17. This vulnerability exists in all versions of ASP.NET (all versions released through 2010-09-18). As of 2010-09-20, there is no fix available to resolve the vulnerability; in the meantime, Microsoft strongly urges all ASP.NET deployments [http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx| perform the recommended workaround] to mitigate the vulnerability in the short-term.

===Advisory===
* Microsoft Security Advisory (2416728) : http://www.microsoft.com/technet/security/advisory/2416728.mspx

=== Fixes (via web.config change)===
* Important: ASP.NET Security Vulnerability (ScottGu's blog) http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
* DotNetNuke ASP.NET Security Vulnerability Fix: http://www.subodh.com/Blog/PostID/116/DotNetNuke-ASP-NET-Security-Vulnerability-Fix

===Blogs, News, Articles===
* Understanding the ASP.NET Vulnerability: http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
* ASP.NET POET Vulnerability - What Else Can I Do? http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
* Automated Padding Oracle Attacks with PadBuster http://www.gdssecurity.com/l/b/2010/09/14/automated-padding-oracle-attacks-with-padbuster/
* Microsoft investigating ASP.NET vulnerabilities - http://www.thetechherald.com/article.php/201038/6170/Microsoft-investigating-ASP-NET-vulnerabilities
* Security researchers 'destroy' Microsoft ASP.NET security http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
* Argentina joins Axis of Evil with zero day ASP.NET exploit http://www.techeye.net/security/argentina-joins-axis-of-evil-with-zero-day-asp-net-exploit
* Padding Oracle Exploit Tool http://netifera.com/research/
* Video demonstration of using POET tool to attack vulnerable ASP.NET deployment http://www.youtube.com/watch?v=yghiC_U2RaM
* Google Search: http://www.google.co.uk/search?q=ASP.NET+vulnerability

=== discussion Threads===
* Security researchers 'destroy' Microsoft ASP.NET security http://news.ycombinator.com/item?id=1701502
* Quite serious security hole in ASP.NET discovered: http://www.reddit.com/r/programming/comments/df72k/quite_serious_security_hole_in_aspnet_discovered

[[Category:OWASP .NET Project]]

Template:Reflist

2010-09-20T21:35:17Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

<div class="references-small {{#if: {{{colwidth|}}} | references-column-width | {{#iferror: {{#ifexpr: {{{1|1}}}>1 | references-column-count references-column-count-{{{1}}} }} }} }}" {{#if: {{{colwidth|}}}| style="-moz-column-width:{{{colwidth}}}; column-width:{{{colwidth}}};" | {{#if: {{{1|}}}| style="-moz-column-count:{{{1}}}; column-count:{{{1}}};" }} }}>
{{#tag:references|{{{refs|}}}|group={{{group|}}}}}</div><noinclude>
{{documentation}}</noinclude>

Template:Citation/make link

2010-09-20T21:33:12Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

{{#if:{{{1|}}}
|[{{{1}}} {{{2}}}]
|{{{2}}}
}}<noinclude>{{documentation}}</noinclude>

Template:Citation/core

2010-09-20T21:32:13Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

<span class="citation {{{Citation class|{{{Citation type|}}}}}}"
{{
#switch:{{{Ref|}}}
||none =
|#default = id="{{anchorencode:{{{Ref}}}}}"
|harv = {{#if:{{{Surname1|}}}{{{EditorSurname1|}}}
|id="CITEREF{{anchorencode:{{#if:{{{Surname1|}}}
|{{{Surname1}}}{{{Surname2|}}}{{{Surname3|}}}{{{Surname4|}}}
|{{{EditorSurname1|}}}{{{EditorSurname2|}}}{{{EditorSurname3|}}}{{{EditorSurname4|}}}
}}{{{Year|{{{Date|}}}}}}}}"
}}
}}>{{

#if:{{{Surname1|}}}
|{{
#if: {{{AuthorMask|}}}
|{{
#iferror: {{ #expr: 1*{{{AuthorMask}}} }}
|{{{AuthorMask}}}
|<del>{{loop|{{{AuthorMask}}}|2=&emsp;}}</del>
}}
|{{
#if: {{{Authorlink1|}}}
|[[{{{Authorlink1}}} |{{{Surname1}}}{{
#if: {{{Given1|}}}
|{{{NameSep|, }}}{{{Given1}}}
}}]]
|{{{Surname1}}}{{
#if: {{{Given1|}}}
|{{{NameSep|, }}}{{{Given1}}}
}}
}}
}}{{
#if: {{{Surname2|}}}
|{{#ifexpr:{{{Trunc|8}}}<2
| ''et al''.
|{{
#iferror: {{ #expr: 1*0.0{{{AuthorMask|}}} }}
| 
|{{
#if: {{{Surname3|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}
}}{{
#if: {{{Authorlink2|}}}
|[[{{{Authorlink2}}} |{{{Surname2}}}{{
#if: {{{Given2|}}}
|{{{NameSep|, }}}{{{Given2}}}
}}]]
|{{{Surname2}}}{{
#if: {{{Given2|}}}
|{{{NameSep|, }}}{{{Given2}}}
}}
}}{{
#if: {{{Surname3|}}}
|{{#ifexpr:{{{Trunc|8}}}<3
| ''et al''.
|{{
#if: {{{Surname4|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Authorlink3|}}}
|[[{{{Authorlink3}}} |{{{Surname3}}}{{
#if: {{{Given3|}}}
|{{{NameSep|, }}}{{{Given3}}}
}}]]
|{{{Surname3}}}{{
#if: {{{Given3|}}}
|{{{NameSep|, }}}{{{Given3}}}
}}
}}{{
#if:{{{Surname4|}}}
|{{#ifexpr:{{{Trunc|8}}}<4
| ''et al''.
|{{
#if: {{{Surname5|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Authorlink4|}}}
|[[{{{Authorlink4}}} |{{{Surname4}}}{{
#if: {{{Given4|}}}
|{{{NameSep|, }}}{{{Given4}}}
}}]]
|{{{Surname4}}}{{
#if: {{{Given4|}}}
|{{{NameSep|, }}}{{{Given4}}}
}}
}}{{
#if:{{{Surname5|}}}
|{{#ifexpr:{{{Trunc|8}}}<5
| ''et al''.
|{{
#if: {{{Surname6|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Authorlink5|}}}
|[[{{{Authorlink5}}} |{{{Surname5}}}{{
#if: {{{Given5|}}}
|{{{NameSep|, }}}{{{Given5}}}
}}]]
|{{{Surname5}}}{{
#if: {{{Given5|}}}
|{{{NameSep|, }}}{{{Given5}}}
}}
}}{{
#if:{{{Surname6|}}}
|{{#ifexpr:{{{Trunc|8}}}<6
| ''et al''.
|{{
#if: {{{Surname7|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Authorlink6|}}}
|[[{{{Authorlink6}}} |{{{Surname6}}}{{
#if: {{{Given6|}}}
|{{{NameSep|, }}}{{{Given6}}}
}}]]
|{{{Surname6}}}{{
#if: {{{Given6|}}}
|{{{NameSep|, }}}{{{Given6}}}
}}
}}{{
#if:{{{Surname7|}}}
|{{#ifexpr:{{{Trunc|8}}}<7
| ''et al''.
|{{
#if: {{{Surname8|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Authorlink7|}}}
|[[{{{Authorlink7}}} |{{{Surname7}}}{{
#if: {{{Given7|}}}
|{{{NameSep|, }}}{{{Given7}}}
}}]]
|{{{Surname7}}}{{
#if: {{{Given7|}}}
|{{{NameSep|, }}}{{{Given7}}}
}}
}}{{
#if:{{{Surname8|}}}
|{{#ifexpr:{{{Trunc|8}}}<8
| ''et al''.
|{{
#if: {{{Surname9|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Authorlink8|}}}
|[[{{{Authorlink8}}} |{{{Surname8}}}{{
#if: {{{Given8|}}}
|{{{NameSep|, }}}{{{Given8}}}
}}]]
|{{{Surname8}}}{{
#if: {{{Given8|}}}
|{{{NameSep|, }}}{{{Given8}}}
}}
}}{{
#if:{{{Surname9|}}}
| ''et al''.
}}
}}
}}
}}
}}
}}
}}
}}
}}
}}
}}
}}
}}
}}

}}{{
#if: {{{Coauthors|}}}
|{{{AuthorSep|; }}}{{{Coauthors|}}}|
}}{{
#if: {{{Date|}}}
| ({{{Date}}}){{
#if:{{{YearNote|}}}
| [{{{YearNote}}}]
}}
}}
|{{
#if: {{{EditorSurname1|}}}
|{{
#if: {{{Editorlink1|}}}
|[[{{{Editorlink1}}} |{{{EditorSurname1}}}{{
#if: {{{EditorGiven1|}}}
|, {{{EditorGiven1}}}
}}]]
|{{{EditorSurname1}}}{{
#if: {{{EditorGiven1|}}}
|, {{{EditorGiven1}}}
}}
}}{{
#if: {{{EditorSurname2|}}}
|{{
#if: {{{EditorSurname3|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Editorlink2|}}}
|[[{{{Editorlink2}}} |{{{EditorSurname2}}}{{
#if: {{{EditorGiven2|}}}
|, {{{EditorGiven2}}}
}}]]
|{{{EditorSurname2}}}{{
#if: {{{EditorGiven2|}}}
|, {{{EditorGiven2}}}
}}
}}{{
#if: {{{EditorSurname3|}}}
|{{
#if: {{{EditorSurname4|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Editorlink3|}}}
|[[{{{Editorlink3}}} |{{{EditorSurname3}}}{{
#if: {{{EditorGiven3|}}}
|, {{{EditorGiven3}}}
}}]]
|{{{EditorSurname3}}}{{
#if: {{{EditorGiven3|}}}
|, {{{EditorGiven3}}}
}}
}}{{
#if:{{{EditorSurname4|}}}
| et al.
}}
}}
}}, ed{{#if:{{{EditorSurname2|}}}|s}}{{#ifeq:{{{Sep|,}}}|.||.}}{{
#if: {{{Date|}}}
| ({{{Date}}}){{
#if:{{{YearNote|}}}
| [{{{YearNote}}}]
}}
}}
}}
}}{{

#if: {{{IncludedWorkTitle|}}}{{#if:{{{Periodical|}}}||{{#if:{{{TransItalic|}}}||{{{TransTitle|}}}}}}}
|{{
#if:{{{Surname1|}}}{{{EditorSurname1|}}}
|{{{Sep|,}}} 
}}{{Citation/make link
| 1={{
#if: {{{IncludedWorkURL|}}}
|{{{IncludedWorkURL}}}
|{{
#if: {{{URL|}}}
|{{{URL}}}

|{{#ifexpr:{{#time: U}} > {{#time: U | {{{Embargo|2001-10-10}}} }}
|{{
#if: {{{PMC|}}}
|http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid={{{PMC}}}
}}
}}
}}
}}
| 2={{
#if: {{{Periodical|}}}
|''<nowiki />{{{IncludedWorkTitle}}}<nowiki />''
|"{{{IncludedWorkTitle|}}}{{
#if: {{{TransTitle|}}}
|{{
#if: {{{IncludedWorkTitle|}}}
| 
}}[{{{TransTitle}}}]
}}"
}}
}}
}}{{

#if: {{{Place|}}}
|{{
#ifeq: {{{Place|}}} | {{{PublicationPlace|}}}
|
|{{
#if: {{{Surname1|}}}{{{EditorSurname1|}}}{{{IncludedWorkTitle|}}}
|{{{Sep|,}}} written at {{{Place}}}
}}
}}
}}{{

#if: {{{EditorSurname1|}}}
|{{
#if: {{{Surname1|}}}
|{{{Sep|,}}} {{
#if: {{{IncludedWorkTitle|}}}
|in 
}}{{
#if: {{{Editorlink1|}}}
|[[{{{Editorlink1}}} |{{{EditorSurname1}}}{{
#if: {{{EditorGiven1|}}}
|, {{{EditorGiven1}}}
}}]]
|{{{EditorSurname1}}}{{
#if: {{{EditorGiven1|}}}
|, {{{EditorGiven1}}}
}}}}{{
#if: {{{EditorSurname2|}}}
|{{
#if: {{{EditorSurname3|}}}
|{{{AuthorSep|; }}}
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Editorlink2|}}}
|[[{{{Editorlink2}}}|{{{EditorSurname2}}}{{
#if: {{{EditorGiven2|}}}
|, {{{EditorGiven2}}}
}}]]
|{{{EditorSurname2}}}{{
#if: {{{EditorGiven2|}}}
|, {{{EditorGiven2}}}
}}
}}{{
#if: {{{EditorSurname3|}}}
|{{
#if: {{{EditorSurname4|}}}
|; 
|{{#if:{{{amp|}}}| & |{{{AuthorSep|; }}}}}
}}{{
#if: {{{Editorlink3|}}}
|[[{{{Editorlink3}}}|{{{EditorSurname3}}}{{
#if: {{{EditorGiven3|}}}
|, {{{EditorGiven3}}}
}}]]
|{{{EditorSurname3}}}{{
#if: {{{EditorGiven3|}}}
|, {{{EditorGiven3}}}
}}
}}{{
#if:{{{EditorSurname4|}}}
| et al.
}}
}}
}}{{
#if: {{{IncludedWorkTitle|}}}
|
|{{{Sep|,}}} ed{{#if:{{{EditorSurname2|}}}|s}}{{#ifeq:{{{Sep|,}}}|.||.}}
}}
}}
}}{{

#if: {{{Periodical|}}}
|{{
#if: {{{Other|}}}
|{{{Sep|,}}} {{{Other|}}}
}}{{
#if: {{{Surname1|}}}{{{EditorSurname1|}}}{{{IncludedWorkTitle|}}}
|{{{Sep|,}}} }}{{
#if: {{{Title|}}}{{{TransTitle|}}}
|{{Citation/make link
| 1={{
#if: {{{IncludedWorkTitle|}}}
|{{
#if: {{{IncludedWorkURL|}}}
|{{
#if: {{{URL|}}}
|{{{URL}}}
|{{
#ifexpr: {{#time: U}} > {{#time: U | {{{Embargo|2001-10-10}}} }} | {{
#if: {{{PMC|}}}
| http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid={{{PMC}}}
}}
}}
}}
}}
|{{
#if: {{{URL|}}}
|{{{URL}}}
|{{#ifexpr:{{#time: U}} > {{#time: U | {{{Embargo|2001-10-10}}} }} |{{
#if: {{{PMC|}}}
| http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid={{{PMC}}}
}}
}}
}}
}}
| 2="{{{Title}}}{{
#if: {{{TransTitle|}}}
|{{
#if: {{{Title|}}}
| 
}}[{{{TransTitle}}}]
}}"
}}{{
#if: {{{TitleNote|}}}
|{{{Sep|,}}} {{{TitleNote}}}
}}
}}
}}{{
#if: {{{language|}}}
| (in {{{language}}})
}}{{
#if: {{{format|}}}
| ({{{format}}})
}}{{
#if: {{{Periodical|}}}
|{{
#if:{{{IncludedWorkTitle|}}}{{{Title|}}}{{{TransTitle|}}}
|{{{Sep|,}}} 
}}''<nowiki />{{{Periodical}}}<nowiki />''{{
#if: {{{Series|}}}
|{{{Sep|,}}} {{{Series}}}
}}{{
#if: {{{PublicationPlace|}}}
|{{
#if: {{{Publisher|}}}
| ({{{PublicationPlace}}}<nowiki>: </nowiki>{{{Publisher}}})
| ({{{PublicationPlace}}})
}}
|{{
#if: {{{Publisher|}}}
| ({{{Publisher}}})
}}
}}{{
#if: {{{Volume|}}}
| '''<nowiki />{{{Volume}}}<nowiki />'''{{
#if: {{{Issue|}}}
| ({{{Issue}}})
}}
|{{
#if: {{{Issue|}}}
| ({{{Issue}}})
}}
}}{{
#if: {{{At|}}}
|<nowiki>: </nowiki> {{{At}}}
}}
|{{

#if: {{{Title|}}}{{{TransItalic|}}}
|{{
#if: {{{Surname1|}}}{{{EditorSurname1|}}}{{{IncludedWorkTitle|}}}{{{Periodical|}}}
|{{{Sep|,}}}
}} {{Citation/make link
| 1={{
#if: {{{IncludedWorkTitle|}}}
|{{
#if: {{{IncludedWorkURL|}}}
|{{
#if: {{{URL|}}}
|{{{URL}}}
|{{#ifexpr:{{#time: U}} > {{#time: U | {{{Embargo|2001-10-10}}} }}|{{
#if: {{{PMC|}}}
| http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid={{{PMC}}}
}}}}
}}
}}
|{{
#if: {{{URL|}}}
|{{{URL}}}
|{{#ifexpr:{{#time: U}} > {{#time: U | {{{Embargo|2001-10-10}}} }}|{{
#if: {{{PMC|}}}
| http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid={{{PMC}}}
}}}}
}}
}}
| 2=''<nowiki />{{{Title|}}}{{
#if:{{{TransItalic|}}}| [{{{TransItalic}}}]
}}<nowiki />''
}}
}}{{
#if: {{{TitleType|}}}
| ({{{TitleType}}})
}}{{
#if: {{{Series|}}}
|{{{Sep|,}}} {{{Series}}}
}}{{
#if: {{{Volume|}}}
|{{{Sep|,}}} '''<nowiki />{{{Volume}}}<nowiki />'''
}}{{
#if: {{{Other|}}}
|{{{Sep|,}}} {{{Other|}}}
}}{{
#if: {{{Edition|}}}
| ({{{Edition}}} ed.)
}}{{
#if: {{{PublicationPlace|}}}
|{{{Sep|,}}} {{{PublicationPlace}}}
}}{{
#if: {{{Publisher|}}}
|{{
#if: {{{PublicationPlace|}}}
|<nowiki>:</nowiki>
|{{{Sep|,}}}
}} {{{Publisher}}}
}}
}}{{

#if: {{{Surname1|}}}{{{EditorSurname1|}}}
|
|{{
#if: {{{Date|}}}
|{{{Sep|,}}} {{{Date}}}{{
#if:{{{YearNote|}}}
| [{{{YearNote}}}]
}}
}}
}}{{

#if: {{{PublicationDate|}}}
|{{
#ifeq: {{{PublicationDate|}}} | {{{Date|}}}
|
|{{
#if: {{{EditorSurname1|}}}
|{{
#if: {{{Surname1|}}}
|{{{Sep|,}}} {{{PublicationDate}}}
| (published {{{PublicationDate}}})
}}
|{{
#if: {{{Periodical|}}}
|{{{Sep|,}}} {{{PublicationDate}}}
| (published {{{PublicationDate}}})
}}
}}
}}
}}{{

#if: {{{Periodical|}}}
|
|{{
#if: {{{At|}}}
|{{{Sep|,}}} {{{At}}}
}}
}}{{

#if:{{{DOI|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=doi |input1={{{DOI|}}} |input2={{{DoiBroken|}}} }}
}}{{

#if: {{{ID|}}}
|{{
#if: {{{Surname1|}}}{{{EditorSurname1|}}}{{{IncludedWorkTitle|}}}{{{Periodical|}}}{{{Title|}}}{{{TransItalic|}}}
|{{{Sep|,}}} {{{ID}}}
|{{{ID}}}
}}
}}{{

#if: {{{ISBN|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=isbn |input1={{{ISBN|}}} }}
}}{{

#if: {{{ISSN|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=issn |input1={{{ISSN|}}} }}
}}{{

#if: {{{OCLC|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=oclc |input1={{{OCLC|}}} }}
}}{{

#if: {{{PMID|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=pmid |input1={{{PMID|}}} }}
}}{{

#if: {{{PMC|}}}
|{{
#if: {{{URL|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=pmc |input1={{{PMC|}}} }}
|{{only in print|{{{Sep|,}}} {{citation/identifier |identifier=pmc |input1={{{PMC|}}} }} }}
}}
}}{{

#if: {{{Bibcode|}}}
|{{{Sep|,}}} {{citation/identifier |identifier=bibcode |input1={{{Bibcode|}}} }}
}}{{

#if: {{{Archive|}}}
|{{{Sep|,}}} {{{Archive}}}[[Category:Pages using deprecated citation archive parameters]]
|{{
#if:{{{ArchiveURL|}}}{{{ArchiveDate|}}}
|{{{Sep|,}}} {{#ifeq:{{{Sep}}}|.|A|a}}rchived{{
#if:{{{OriginalURL|}}}{{{IncludedWorkURL|}}}
|{{#if:{{{ArchiveURL|}}}| from {{Citation/make link|{{{OriginalURL|{{{IncludedWorkURL|}}}}}}|the original}}}}
}}{{
#if:{{{ArchiveDate|}}}
| on {{{ArchiveDate}}}
}}{{
#if:{{#if:{{{ArchiveURL|}}}||A}}{{#if:{{{OriginalURL|}}}{{{IncludedWorkURL|}}}||B}}{{#if:{{{ArchiveDate|}}}||C}}
|. {{citation error
|If you specify <code>|{{#if:{{{ArchiveURL|}}}|archiveurl|archivedate}}=</code>, you must {{#if:{{{OriginalURL|}}}{{{IncludedWorkURL|}}}| also specify <code>|{{#if:{{{ArchiveURL|}}}|archivedate|archiveurl}}=</code>|first specify <code>|url=</code>}}}}
}}
}}
}}{{

#if: {{{URL|}}}{{{IncludedWorkURL|}}}
|{{
#if: {{{Title|}}}{{{IncludedWorkTitle|}}}{{{TransTitle|}}}
|{{{Sep|,}}} {{
#if: {{{IncludedWorkURL|}}}
|{{{IncludedWorkURL}}}
|{{{URL}}}
}}
|{{{Sep|,}}} {{
#if: {{{IncludedWorkURL|}}}
|{{{IncludedWorkURL}}}
|{{{URL}}}
}}
}}{{
#if: {{{AccessDate|}}}
| {{#ifeq:{{{Sep|,}}}|,|, r|. R}}etrieved {{{AccessDate}}}
}}
}}{{#if:{{{laysummary|}}}
|{{{Sep|,}}} [{{{laysummary}}} Lay summary]{{#if: {{{laysource|}}}| – ''<nowiki />{{{laysource}}}<nowiki />''}}
}}{{#if:{{{laydate|}}}
| ({{{laydate}}})
}}{{#if:{{{quote|}}}
|{{{Sep|,}}} "{{{quote}}}"
}}{{{PS|}}}<span
class="Z3988"
title="ctx_ver=Z39.88-2004&rft_val_fmt={{urlencode:info:ofi/fmt:kev:mtx:}}{{
#if: {{{Periodical|}}}
|journal&rft.genre=article&rft.atitle={{urlencode:{{{Title|}}}}}&rft.jtitle={{urlencode:{{{Periodical|}}}}}
|book{{
#if: {{{IncludedWorkTitle|}}}
|&rft.genre=bookitem&rft.btitle={{urlencode:{{{IncludedWorkTitle|}}}}}&rft.atitle={{urlencode:{{{Title|}}}}}
|&rft.genre=book&rft.btitle={{urlencode:{{{Title|}}}}}
}}
}}{{
#if: {{{Surname1|}}} |&rft.aulast={{urlencode:{{{Surname1}}}}}{{
#if: {{{Given1|}}} |&rft.aufirst={{urlencode:{{{Given1}}}}}
}}
}}{{
#if: {{{Surname1|}}} |&rft.au={{urlencode:{{{Surname1}}}}}{{
#if: {{{Given1|}}} |{{urlencode:{{{NameSep|, }}}{{{Given1}}}}}
}}
}}{{
#if: {{{Surname2|}}} |&rft.au={{urlencode:{{{Surname2}}}}}{{
#if: {{{Given2|}}} |{{urlencode:{{{NameSep|, }}}{{{Given2}}}}}
}}
}}{{
#if: {{{Surname3|}}} |&rft.au={{urlencode:{{{Surname3}}}}}{{
#if: {{{Given3|}}} |{{urlencode:{{{NameSep|, }}}{{{Given3}}}}}
}}
}}{{
#if: {{{Surname4|}}} |&rft.au={{urlencode:{{{Surname4}}}}}{{
#if: {{{Given4|}}} |{{urlencode:{{{NameSep|, }}}{{{Given4}}}}}
}}
}}{{
#if: {{{Surname5|}}} |&rft.au={{urlencode:{{{Surname5}}}}}{{
#if: {{{Given5|}}} |{{urlencode:{{{NameSep|, }}}{{{Given5}}}}}
}}
}}{{
#if: {{{Surname6|}}} |&rft.au={{urlencode:{{{Surname6}}}}}{{
#if: {{{Given6|}}} |{{urlencode:{{{NameSep|, }}}{{{Given6}}}}}
}}
}}{{
#if: {{{Surname7|}}} |&rft.au={{urlencode:{{{Surname7}}}}}{{
#if: {{{Given7|}}} |{{urlencode:{{{NameSep|, }}}{{{Given7}}}}}
}}
}}{{
#if: {{{Surname8|}}} |&rft.au={{urlencode:{{{Surname8}}}}}{{
#if: {{{Given8|}}} |{{urlencode:{{{NameSep|, }}}{{{Given8}}}}}
}}
}}{{
#if: {{{Surname9|}}} |&rft.au={{urlencode:{{{Surname9}}}}}{{
#if: {{{Given9|}}} |{{urlencode:{{{NameSep|, }}}{{{Given9}}}}}
}}
}}{{
#if: {{{Date|}}} |&rft.date={{urlencode:{{{Date}}}}}
}}{{
#if: {{{Series|}}} |&rft.series={{urlencode:{{{Series}}}}}
}}{{
#if: {{{Volume|}}} |&rft.volume={{urlencode:{{{Volume}}}}}
}}{{
#if: {{{Issue|}}} |&rft.issue={{urlencode:{{{Issue}}}}}
}}{{
#if: {{{At|}}} |&rft.pages={{urlencode:{{{At}}}}}
}}{{
#if: {{{Edition|}}} |&rft.edition={{urlencode:{{{Edition}}}}}
}}{{
#if: {{{PublicationPlace|}}}{{{Place|}}} |&rft.place={{urlencode:{{{PublicationPlace|{{{Place}}}}}}}}
}}{{
#if: {{{Publisher|}}} |&rft.pub={{urlencode:{{{Publisher}}}}}
}}{{
#if: {{{DOI|}}} |&rft_id=info:doi/{{urlencode:{{{DOI}}}}}
}}{{
#if: {{{PMID|}}} |&rft_id=info:pmid/{{urlencode:{{{PMID}}}}}
}}{{
#if: {{{Bibcode|}}} |&rft_id=info:bibcode/{{urlencode:{{{Bibcode}}}}}
}}{{
#if: {{{OCLC|}}} |&rft_id=info:oclcnum/{{urlencode:{{{OCLC}}}}}
}}{{
#if: {{{ISBN|}}} |&rft.isbn={{urlencode:{{{ISBN}}}}}
}}{{
#if: {{{ISSN|}}} |&rft.issn={{urlencode:{{{ISSN}}}}}
}}{{
#if: {{{URL|}}}{{{IncludedWorkURL|}}} |&rft_id={{urlencode:{{{URL|{{{IncludedWorkURL|}}}}}}}}
}}&rfr_id=info:sid/en.wikipedia.org:{{FULLPAGENAMEE}}"> <noinclude>
{{Pp-template|small=yes}}
{{Documentation}}
</noinclude>

Template:Other uses

2010-09-20T21:30:24Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

{{about|||{{{1|{{PAGENAME}} (disambiguation)}}}}}<noinclude>
{{documentation}}
</noinclude>

Template:Template other

2010-09-20T21:29:31Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

#REDIRECT [[Template:Other uses]]

Template:Pp-meta

2010-09-20T21:28:44Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

{{#ifeq:{{#switch:{{lc:{{{type}}}}}
|move={{#ifeq:
{{#switch:{{lc:{{{demolevel|undefined}}}}}
|semi
|autoconfirmed=autoconfirmed
|administrator
|full
|sysop=sysop
|undefined={{PROTECTIONLEVEL:move}}
|#default=}}
|sysop|yes|no
}}
|create={{#if:
{{#switch:{{lc:{{{demolevel|undefined}}}}}
|semi
|autoconfirmed=autoconfirmed
|administrator
|full
|sysop=sysop
|undefined={{PROTECTIONLEVEL:create}}
|#default=}}
|yes|no
}}
|#default={{#if:
{{#switch:{{lc:{{{demolevel|undefined}}}}}
|semi
|autoconfirmed=autoconfirmed
|administrator
|full
|sysop=sysop
|undefined={{PROTECTIONLEVEL:edit}}
|#default=}}
|{{#ifeq:{{#switch:{{lc:{{{disallowlevel|}}}}}
|semi
|autoconfirmed=autoconfirmed
|administrator
|full
|sysop=sysop
|#default=}}
|{{#switch:{{lc:{{{demolevel|undefined}}}}}
|semi
|autoconfirmed=autoconfirmed
|administrator
|full
|sysop=sysop
|undefined={{PROTECTIONLEVEL:edit}}
|#default=}}
|no|yes
}}
|no}}
}}|yes|{{#ifeq:{{lc:{{{small|}}}}}|yes|
<div class="metadata topicon" id="protected-icon" style="display:none; right:55px;">[[Image:{{{image|{{#switch:{{lc:{{{type}}}}}
|full=Padlock.svg
|semi=Padlock-silver-medium.svg
|move=Padlock-olive.svg
|indef=Padlock-red.svg
|office=Padlock-black.svg
|create=Padlock-skyblue.svg
|#default=Transparent.gif
}}}}}|20px|link={{{icon-link|Wikipedia:Protection policy#{{lc:{{{type}}}}}}}}|{{{icon-text|This {{pagetype|subjectspace=yes}} is {{#switch:{{lc:{{{type}}}}}
|semi=semi-
|move=move-
|indef=permanently<nowiki> </nowiki>
|create=creation-
|office=
|full
|#default=
}}protected{{#ifeq:{{lc:{{{type}}}}}|indef||{{#if:{{{expiry|}}}|<nowiki> </nowiki>until {{#time:F j, Y|{{{expiry}}}}}}}}}{{#if:{{{icon-reason|}}}|<nowiki> </nowiki>{{{icon-reason}}}}}.}}}|alt=Page {{#switch:{{lc:{{{type}}}}}
|semi=semi-
|move=move-
|indef=permanently<nowiki> </nowiki>
|create=creation-
|office=
|full
|#default=
}}protected]]</div>
|
{{mbox
| demospace = {{{demospace|}}}
| type = protection
| image = [[Image:{{{image|{{#switch:{{lc:{{{type}}}}}
|full=Padlock.svg
|semi=Padlock-silver-medium.svg
|move=Padlock-olive.svg
|indef=Padlock-red.svg
|office=Padlock-black.svg
|create=Padlock-skyblue.svg
|#default=Transparent.gif
}}}}}|40px|{{{icon-text|This page is {{#switch:{{lc:{{{type}}}}}
|semi=semi-
|move=move-
|indef=permanently<nowiki> </nowiki>
|create=creation-
|office=
|full
|#default=
}}protected.}}}]]
| text = '''{{{reason-text|{{#switch:{{lc:{{{type}}}}}
|full=This page is currently [[Wikipedia:This page is protected|protected]] from editing
|semi=Editing of this {{pagetype|subjectspace=yes}} by [[Wikipedia:User access levels#Autoconfirmed_users|new]] or [[Wikipedia:User access levels#Anonymous_users|unregistered]] users is currently [[Wikipedia:Protection policy|disabled]]
|move=This {{pagetype|subjectspace=yes}} is currently [[Wikipedia:This page is protected|protected]] from [[Help:Moving a page|page moves]]
|indef=This page is [[Wikipedia:This page is protected|protected]] from editing ''indefinitely''
|office=This {{pagetype|subjectspace=yes}} is currently [[Wikipedia:This page is protected|protected]] from editing
|create=[[Help:Starting a new page|Recreation]] of this {{pagetype|subjectspace=yes}} [[Wikipedia:This page is protected|has been disabled]]
}}{{#ifeq:{{lc:{{{type}}}}}|indef||{{#if:{{{expiry|}}}| until {{#time:F j, Y|{{{expiry}}}}}}}}}{{{reason<includeonly>|</includeonly>}}}.}}}''' {{{explanation-text|{{#ifeq:{{lc:{{{dispute}}}}}|yes|This protection is '''not''' an endorsement of the {{#ifeq:{{{type}}}|move|[{{fullurl:Special:Log|type=move&page={{FULLPAGENAMEE}}}} current title]|[{{fullurl:{{FULLPAGENAMEE}}|action=history}} current version]}}.}} See the [[Wikipedia:Protection policy|protection policy]] and [{{fullurl:Special:Log|type=protect&page={{FULLPAGENAMEE}}}} protection log] for more details. {{#switch:{{lc:{{{type}}}}}
|full|indef=Please discuss any changes on the [[{{TALKPAGENAME}}|talk page]]; you may use the {{tlx|editprotected}} template to ask an [[Wikipedia:Administrator|administrator]] to make the edit if it is supported by [[Wikipedia:Consensus|consensus]]. {{#ifeq:{{NAMESPACE}}|{{ns:8}}||You may also [[Wikipedia:Requests for page protection|request]] that this page be unprotected.}}
|semi=If you cannot edit this {{pagetype|subjectspace=yes}} and you wish to make a change, you can {{#ifeq:{{NAMESPACE}}|{{TALKSPACE}}||[[Template:Editsemiprotected|request an edit]], [[{{TALKPAGENAME}}|discuss changes on the talk page]],}} [[Wikipedia:Requests for page protection#Current requests for unprotection|request unprotection]], [[Special:Userlogin|log in]], or [http://en.wikipedia.org/w/index.php?title=Special:Userlogin&type=signup create an account].
|move=The page may still be edited but cannot be moved until unprotected. Please discuss any suggested moves on the [[{{TALKPAGENAME}}|talk page]] or at [[Wikipedia:Requested moves]]. You can also [[Wikipedia:Requests for page protection|request]] that the page be unprotected.
|office=If you are able to edit this page, please discuss all changes and additions on the [[{{TALKPAGENAME}}|talk page]] first. '''Do not remove protection from this article unless you are authorized by the Wikimedia Foundation to do so.'''
|create=Please see the {{#if:{{{xfd|}}}|'''[[{{{xfd}}}|deletion discussion]]''' or the}} [{{fullurl:Special:Log|type=delete&page={{FULLPAGENAMEE}}}} deletion log] for details of why this page was deleted. If you would like to create a page at this title, you must first [[Wikipedia:Requests for page protection|request]] for it to be unprotected, or contact the administrator who deleted the page for the deleted material to be restored. If unsuccessful, you can use [[Wikipedia:Deletion review|deletion review]].
}}}}}
}}
}}|[[Category:Wikipedia pages with incorrect protection templates]]}}<includeonly>{{#ifeq:{{lc:{{{categories|no}}}}}|no||{{{categories|}}}}}</includeonly><noinclude>

{{documentation}}

</noinclude>

Template:Fmbox

2010-09-20T21:27:58Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

<table {{#if:{{{id|}}}|id="{{{id|}}}"}} class="plainlinks fmbox
{{#switch:{{{type|}}}
| warning = fmbox-warning
| editnotice = fmbox-editnotice
| system 
| #default = fmbox-system
}} {{{class|}}}" style="{{{style|}}}">
<tr>
{{#ifeq:{{{image|}}}|none
| 
| <td class="mbox-image">
{{#if:{{{image|}}}
| {{{image}}}
| [[File:{{#switch:{{{type|}}}
| warning = Cmbox deletion.png
| editnotice = Imbox notice.png
| system 
| #default = Imbox notice.png
}}|40x40px|link=|alt=]]
}}</td>
}}
<td class="mbox-text" style="{{{textstyle|}}}"> {{{text}}} </td>
{{#if:{{{imageright|}}}
| <td class="mbox-imageright"> {{{imageright}}} </td>
}}
</tr>
</table>{{#switch:{{{type|}}}
| 
| warning
| editnotice
| system = 
| #default = <div style="text-align: center;">This message box is using an invalid "type={{{type|}}}" parameter and needs fixing.</div>[[Category:Wikipedia message box parameter needs fixing|{{main other|Main:}}{{FULLPAGENAME}}]]
}}<noinclude>

{{pp-template}}
{{documentation}}

</noinclude>

Template:Documentation/core/doc

2010-09-20T21:26:56Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

{{Documentation subpage}}


This is the {{tl|documentation/core}} sub-template.

Do not use this template directly, use {{tl|documentation}} instead.

{{tlf|documentation}} calls {{tl|documentation/core2}} which in turn calls this template. This template holds most of the code for {{tlf|documentation}}, while {{tlf|documentation}} and {{tlf|documentation/core2}} do parameter preprocessing. Thus simplifying the code.

=== Technical details ===

This sub-template currently expects these parameters:

<pre>
{{documentation/core
| heading = {{{heading|¬}}} 
| heading-style = {{{heading-style|}}}
| content = {{{content|}}} 
| link box = {{{link box|}}} 

| docpage = 
| doc exist = 
| docname fed = 

| sandbox = 
| testcases = 

| template page = 
}}
</pre>

For more documentation see {{tl|documentation}}.

<includeonly>

[[Category:Template documentation]]
[[pt:Predefinição:Documentation/core]]
</includeonly>

Template:Documentation/core

2010-09-20T21:25:46Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

<div id="template-documentation" class="template-documentation iezoomfix">{{#ifeq: {{{heading|¬}}} | 
| 
| <div style="padding-bottom: 3px; border-bottom: 1px solid #aaa; margin-bottom: 1ex;">{{
#if: {{{content|}}}
|
| 
{{
#if: {{{doc exist|yes}}}
| [[{{fullurl:{{{docpage|{{FULLPAGENAME}}/doc}}}|action=edit}} edit]] [{{purge|purge}}]
| 
[[{{fullurl:{{{docpage|{{FULLPAGENAME}}/doc}}}| action=edit&preload={{
#ifeq: {{SUBJECTSPACE}} | {{ns:File}}
| Template:Documentation/preload-filespace
| Template:Documentation/preload
}} }} create]]
}}
}} {{#switch: {{{heading|¬}}}
| ¬ =

{{#switch: {{SUBJECTSPACE}}
| {{ns:Template}} = [[Image:Template-info.svg|50px|alt=]] Template documentation
| {{ns:File}} = Summary
| #default = Documentation
}}
| #default =

{{{heading|}}}
}}</div>
}}
{{#if: {{{content|}}}
| {{{content|}}}
| {{#if: {{{doc exist|yes}}}
| {{ {{{docpage|{{FULLPAGENAME}}/doc}}} }}
}}
}}
<div style="clear: both;"></div>
</div>{{#if:

{{#ifeq: {{{link box|}}} | off
|
| {{{doc exist|yes}}}{{
#switch: {{SUBJECTSPACE}}
| {{ns:User}}
| {{ns:Template}} = yes
}}
}}

| {{fmbox
| id = documentation-meta-data
| image = none
| style = background-color: #ecfcf4;
| textstyle = font-style: italic;
| text =
{{#if: {{{link box|}}}
| {{{link box}}} 
| {{#if: {{{doc exist|yes}}}
| 
The above [[Wikipedia:Template documentation|documentation]] is [[Wikipedia:Transclusion|transcluded]] from [[{{{docpage|{{FULLPAGENAME}}/doc}}}]]. ([{{fullurl:{{{docpage|{{FULLPAGENAME}}/doc}}}|action=edit}} edit] | [{{fullurl:{{{docpage|{{FULLPAGENAME}}/doc}}}|action=history}} history]) 
}}{{#switch: {{SUBJECTSPACE}}
| {{ns:User}}
| {{ns:Template}} =
Editors can experiment in this template's {{
#ifexist: {{{sandbox| {{FULLPAGENAME}}/sandbox }}}
| [[{{{sandbox| {{FULLPAGENAME}}/sandbox }}}|sandbox]] ([{{fullurl: {{{sandbox| {{FULLPAGENAME}}/sandbox }}} | action=edit }} edit] {{!}} [{{fullurl:Wikipedia:pagediff | withJS={{urlencode:MediaWiki:Common.js/pagediff.js}}&oldpage={{urlencode:{{{template page|{{FULLPAGENAME}}}}}}}&newpage={{urlencode:{{{sandbox|{{FULLPAGENAME}}/sandbox}}}}}}} diff])
| sandbox ([{{fullurl: {{{sandbox| {{FULLPAGENAME}}/sandbox }}} | action=edit&preload=Template:Documentation/preload-sandbox }} create])
}} and {{
#ifexist: {{{testcases| {{FULLPAGENAME}}/testcases }}}
| [[{{{testcases| {{FULLPAGENAME}}/testcases }}}|testcases]] ([{{fullurl: {{{testcases| {{FULLPAGENAME}}/testcases }}} | action=edit }} edit])
| testcases ([{{fullurl: {{{testcases| {{FULLPAGENAME}}/testcases }}} | action=edit&preload=Template:Documentation/preload-testcases }} create])
}} pages. 
}}{{#if: {{{content|}}} {{{docname fed|}}}
|
| Please add categories and interwikis to the [[{{{docpage|{{FULLPAGENAME}}/doc}}}|/doc]] subpage.
}}{{#switch: {{SUBJECTSPACE}}
| {{ns:File}} = 
| {{ns:Template}} = [[Special:PrefixIndex/{{{template page|{{FULLPAGENAME}}}}}/|Subpages of this template]].
| #default = [[Special:PrefixIndex/{{{template page|{{FULLPAGENAME}}}}}/|Subpages of this page]].
}}
}}{{#ifexist:{{FULLPAGENAME}}/Print
|A [[Help:Books/for experts#Improving the book layout|print version]] of this template exists at [[/Print]]. If you make a change to this template, please update the print version as well.[[Category:Templates with print versions]]
}}
}}
}}{{#if:


{{#switch: {{SUBPAGENAME}}
| doc
| testcases = strange
}}


| <includeonly>[[Category:Wikipedia pages with strange ((documentation)) usage|{{main other|Main:}}{{FULLPAGENAME}}]]</includeonly>

}}<noinclude>

{{pp-template}}

</noinclude>

Template:Documentation/core2

2010-09-20T21:25:05Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

{{documentation/core
| heading = {{{heading|¬}}} 
| heading-style = {{{heading-style|}}}
| content = {{{content|}}}
| link box = {{{link box|}}} 

| docpage =
{{#if: {{{1|}}}
| {{{1|}}}
| {{{docspace|{{NAMESPACE}}}}}:{{{template page|{{PAGENAME}}}}}/doc
}}
| doc exist =
{{#ifexist:
{{#if: {{{1|}}}
| {{{1|}}} 
| {{{docspace|{{NAMESPACE}}}}}:{{{template page|{{PAGENAME}}}}}/doc
}}
| yes
}}
| docname fed =
{{#if: {{{1|}}}
| yes
}}

| sandbox =
{{{docspace|{{NAMESPACE}}}}}:{{{template page|{{PAGENAME}}}}}/sandbox
| testcases =
{{{docspace|{{NAMESPACE}}}}}:{{{template page|{{PAGENAME}}}}}/testcases

| template page =
{{NAMESPACE}}:{{{template page|{{PAGENAME}}}}}

}}<noinclude>

{{pp-template}}

</noinclude>

Template:Pp-template

2010-09-20T21:24:11Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

<includeonly>{{pp-meta
|type={{#switch:{{{demolevel|{{#ifeq:{{PROTECTIONLEVEL:edit}}-{{PROTECTIONLEVEL:move}}|-sysop|move|{{PROTECTIONLEVEL:edit}}}}}}}
|semi
|autoconfirmed=semi
|administrator
|full
|sysop=indef
|move=move
|#default=indef}}
|small={{{small|yes}}}
|demospace={{{demospace|}}}
|demolevel={{#ifeq:{{PAGENAME}}/{{NAMESPACE}}|{{SUBPAGENAME}}/{{ns:Template}}|{{{demolevel|undefined}}}|{{#ifeq:{{lc:{{SUBPAGENAME}}}}|sandbox|sysop|{{{demolevel|undefined}}}}}}}
|expiry=
|dispute=no
|icon-text=This {{#ifeq:{{NAMESPACE}}|{{ns:6}}|image, included in a high-risk template or message,|high-risk template}} is indefinitely {{#switch:{{{demolevel|{{#ifeq:{{PROTECTIONLEVEL:edit}}-{{PROTECTIONLEVEL:move}}|-sysop|move|{{PROTECTIONLEVEL:edit}}}}}}}
|semi
|autoconfirmed=semi-protected from editing
|move=move-protected
|administrator
|full
|sysop
|#default=protected from editing}} to prevent vandalism.
|reason-text=This {{#switch:{{NAMESPACE}}
|{{ns:image}}=image, used in one or more [[Wikipedia:High-risk templates|high-risk templates]]{{#switch:{{{demolevel|{{PROTECTIONLEVEL:edit}}}}}
|semi
|autoconfirmed=
|administrator
|full
|sysop=<nowiki> </nowiki>and/or [[Special:Allmessages|system messages]],
|#default=}}
|#default=[[Wikipedia:High-risk templates|high-risk template]]
}} has been [[Wikipedia:This page is protected|{{#switch:{{{demolevel|{{#ifeq:{{PROTECTIONLEVEL:edit}}-{{PROTECTIONLEVEL:move}}|-sysop|move|{{PROTECTIONLEVEL:edit}}}}}}}
|semi
|autoconfirmed=semi-
|move=move-
|administrator
|full
|sysop
|#default=}}protected]]{{#ifeq:{{PROTECTIONLEVEL:edit}}-{{PROTECTIONLEVEL:move}}|-sysop||<nowiki> </nowiki>from editing}} to prevent [[Wikipedia:Vandalism|vandalism]]. {{#switch:{{{demolevel|{{PROTECTIONLEVEL:edit}}}}}
|semi
|autoconfirmed=
|administrator
|full
|sysop
|#default={{#switch:{{NAMESPACE}}|{{ns:image}}= '''Do not move this image''' to [[commons:|Wikimedia Commons]].}}}}
|categories={{{categories|{{#ifeq:{{NAMESPACE}}|{{ns:10}}|{{#switch:{{{demolevel|{{#ifeq:{{PROTECTIONLEVEL:edit}}-{{PROTECTIONLEVEL:move}}|-sysop|move|{{PROTECTIONLEVEL:edit}}}}}}}
|semi
|autoconfirmed=[[Category:Wikipedia semi-protected templates|{{PAGENAME}}]]{{#ifeq:{{PROTECTIONLEVEL:move}}|sysop|[[Category:Wikipedia move-protected templates|{{PAGENAME}}]]}}
|move=[[Category:Wikipedia move-protected templates|{{PAGENAME}}]]
|administrator
|full
|sysop
|#default=[[Category:Wikipedia protected templates|{{PAGENAME}}]]}}}}{{#ifeq:{{NAMESPACE}}|{{ns:6}}|[[Category:{{#switch:{{{demolevel|{{PROTECTIONLEVEL:edit}}}}}
|semi
|autoconfirmed=Semi-protected
|administrator
|full
|sysop
|#default=Protected}} images|{{PAGENAME}}]]}}}}}}}</includeonly><noinclude>
{{pp-template|categories=no}} 
{{pp-template|small=no}} 
{{Documentation}}

</noinclude>

Template:Documentation

2010-09-20T21:23:15Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

{{#ifeq: {{SUBPAGENAME}} | sandbox
| <div style="clear: both;"></div>{{template sandbox notice}}
}}{{template other
| {{#ifeq: {{PROTECTIONLEVEL:move}} | sysop
| {{pp-template}}
| {{#if: {{PROTECTIONLEVEL:edit}}
| {{pp-template}}
| 
}}
}}
}}{{documentation/core2
| heading = {{{heading|¬}}} 
| heading-style = {{{heading-style|}}}
| content = {{{content|}}}
| link box = {{{link box|}}} 


| docspace =
{{#switch: {{SUBJECTSPACE}}
| {{ns:0}}
| {{ns:File}}
| {{ns:MediaWiki}}
| {{ns:Category}} = {{TALKSPACE}}
| #default = {{SUBJECTSPACE}}
}}

| 1 = {{{1|}}} 


| template page =
{{#switch: {{SUBPAGENAME}}
| sandbox
| testcases = {{BASEPAGENAME}}
| #default = {{PAGENAME}}
}}

}}<noinclude>


</noinclude>

Template:Cite web

2010-09-20T21:22:10Z

ParanoidMike: Attempting to implement Cite_web template to support ASP.NET POET Vulnerability page - depends on other templates. Let's see how far down the stack of turtles this goes.

<includeonly>{{Citation/core
|Citation class=web
|Surname1 = {{#if:{{{last|}}}
|{{{last}}}
|{{#if:{{{last1|}}}
|{{{last1}}}
|{{{author|}}}
}}
}}
|Surname2 = {{{last2|{{{surname2|{{{author2|}}}}}}}}}
|Surname3 = {{{last3|}}}
|Surname4 = {{{last4|}}}
|Surname5 = {{{last5|}}}
|Surname6 = {{{last6|}}}
|Surname7 = {{{last7|}}}
|Surname8 = {{{last8|}}}
|Surname9 = {{{last9|}}}
|Given1 = {{#if:{{{first|}}}|{{{first}}}|{{{first1|}}}}}
|Given2 = {{{first2|}}}
|Given3 = {{{first3|}}}
|Given4 = {{{first4|}}}
|Given5 = {{{first5|}}}
|Given6 = {{{first6|}}}
|Given7 = {{{first7|}}}
|Given8 = {{{first8|}}}
|Given9 = {{{first9|}}}
|Authorlink1 = {{#if:{{{authorlink|}}}|{{{authorlink}}}|{{{authorlink1|}}}}}
|Authorlink2 = {{{authorlink2|}}}
|Authorlink3 = {{{authorlink3|}}}
|Authorlink4 = {{{authorlink4|}}}
|Authorlink5 = {{{authorlink5|}}}
|Authorlink6 = {{{authorlink6|}}}
|Authorlink7 = {{{authorlink7|}}}
|Authorlink8 = {{{authorlink8|}}}
|Authorlink9 = {{{authorlink9|}}}
|Coauthors = {{{coauthor|{{{coauthors|}}}}}}
|EditorSurname1 = {{{editor-last|{{{editor-surname|{{{editor1-last|{{{editor1-surname|{{{editor1|{{{editor|{{{editors|}}}}}}}}}}}}}}}}}}}}}
|EditorSurname2 = {{{editor2-last|{{{editor2-surname|{{{editor2|}}}}}}}}}
|EditorSurname3 = {{{editor3-last|{{{editor3-surname|{{{editor3|}}}}}}}}}
|EditorSurname4 = {{{editor4-last|{{{editor4-surname|{{{editor4|}}}}}}}}}
|EditorGiven1 = {{{editor-first|{{{editor-given|{{{editor1-first|{{{editor1-given|}}}}}}}}}}}}
|EditorGiven2={{{editor2-first|{{{editor2-given|}}}}}}
|EditorGiven3={{{editor3-first|{{{editor3-given|}}}}}}
|EditorGiven4={{{editor4-first|{{{editor4-given|}}}}}}
|Editorlink1={{{editor-link|{{{editor1-link|}}}}}}
|Editorlink2={{{editor2-link|}}}
|Editorlink3={{{editor3-link|}}}
|Editorlink4={{{editor4-link|}}}
|Year={{#if:{{{year|}}}|{{{year}}} 
|{{#if: {{{date|}}}
|{{#iferror: {{#time:Y|{{{date|}}} }}
|{{#iferror:{{#time:Y|{{{publication-date|einval}}} }}||{{#time:Y|{{{publication-date|}}} }}}}
|{{#time:Y|{{{date|}}} }}
}}
|{{{publication-date|}}} 
}}
}}
|Date = {{#if:{{{date|}}}|{{{date}}}|{{{day|}}} {{{month|}}} {{#if:{{{year|}}}|{{{year}}}|{{{publication-date|}}}}}}}
|Title={{{work|}}}
|TransTitle={{{trans_title|}}}
|At = {{#if:{{{page|}}}|p. {{{page}}}|{{#if:{{{pages|}}}|pp. {{{pages|}}}|{{{at|}}} }} }}
|IncludedWorkTitle = {{
#if:{{{title|}}}
|{{{title}}}
|{{
#if:{{{trans_title|}}}
|
|{{Citation error|no <code>|title=</code> specified|Cite web}}
}}
}}
|IncludedWorkURL = {{#if:{{{archiveurl|}}}|{{{archiveurl|}}}|{{{url|}}}}}
|PublicationPlace = {{{location|}}}
|Publisher = {{{publisher|}}}
|language = {{{language|}}}
|format = {{{format|}}}
|DOI={{{doi|{{{DOI|}}}}}}
|AccessDate={{#if:{{{accessdate|}}}
|{{#if: {{{accessyear|}}}
|{{{accessdate}}} {{{accessyear}}}
|{{{accessdate}}}
}}
|{{{accessday|}}} {{{accessmonth|}}} {{{accessyear|}}}
}}
|DateFormat={{#if:{{{dateformat|}}}|{{{dateformat}}}|none}}
|quote = {{{quote|}}}
|Ref={{{ref|}}}
|Sep = {{#ifeq:{{{separator|{{{seperator}}} }}}|;|;|{{{separator|{{{seperator|.}}} }}} }}
|PS={{#if:{{{quote|}}}||{{{postscript|.}}}}}
|ArchiveURL = {{{archiveurl|}}}
|OriginalURL = {{{url|}}}
|ArchiveDate= {{{archivedate|}}}
}}{{#if:{{{accessdaymonth|}}}{{{accessmonthday|}}}{{{accessday|}}}{{{accessmonth|}}}{{{accessyear|}}}{{{day|}}}{{{access-date|}}}{{{dateformat|}}}|[[Category:Pages containing cite templates with deprecated parameters|{{NAMESPACE}} {{PAGENAME}}]]}}</includeonly><noinclude>
{{Pp-template|small=yes}}
{{Documentation}}
</noinclude>

User:ParanoidMike

2010-09-20T21:03:35Z

ParanoidMike:

Who: Mike Lonergan

What: Security Consultant in the Security Center of Excellence group at Intel.

Where: Portland, OR

Why: I'm here to make what contributions I can to this site (which to me appears to be one of the strongest online resources dedicated to Threat Modeling and to providing actionable mitigations for software vulnerabilities).

[http://paranoidmike.blogspot.com Sporadic blog]

[http://www.codeplex.com/site/users/view/MikeSL My Codeplex open-source software projects]

ASP.NET POET Vulnerability

2010-09-20T21:01:31Z

ParanoidMike: Added link to YouTube video

__TOC__
This page contains details about the recently disclosed ASP.NET POET Vulnerability:

===Advisory===
* Microsoft Security Advisory (2416728) : http://www.microsoft.com/technet/security/advisory/2416728.mspx

=== Fixes (via web.config change)===
* Important: ASP.NET Security Vulnerability (ScottGu's blog) http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
* DotNetNuke ASP.NET Security Vulnerability Fix: http://www.subodh.com/Blog/PostID/116/DotNetNuke-ASP-NET-Security-Vulnerability-Fix

===Blogs, News, Articles===
* Understanding the ASP.NET Vulnerability: http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
* ASP.NET POET Vulnerability - What Else Can I Do? http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
* Automated Padding Oracle Attacks with PadBuster http://www.gdssecurity.com/l/b/2010/09/14/automated-padding-oracle-attacks-with-padbuster/
* Microsoft investigating ASP.NET vulnerabilities - http://www.thetechherald.com/article.php/201038/6170/Microsoft-investigating-ASP-NET-vulnerabilities
* Security researchers 'destroy' Microsoft ASP.NET security http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
* Argentina joins Axis of Evil with zero day ASP.NET exploit http://www.techeye.net/security/argentina-joins-axis-of-evil-with-zero-day-asp-net-exploit
* Padding Oracle Exploit Tool http://netifera.com/research/
* Video demonstration of using POET tool to attack vulnerable ASP.NET deployment http://www.youtube.com/watch?v=yghiC_U2RaM
* Google Search: http://www.google.co.uk/search?q=ASP.NET+vulnerability

=== discussion Threads===
* Security researchers 'destroy' Microsoft ASP.NET security http://news.ycombinator.com/item?id=1701502
* Quite serious security hole in ASP.NET discovered: http://www.reddit.com/r/programming/comments/df72k/quite_serious_security_hole_in_aspnet_discovered

[[Category:OWASP .NET Project]]

Template:Vulnerability

2008-09-01T20:49:37Z

ParanoidMike: Doesn't it stand to reason that any page labelled with this Template would also fit the bill for getting the Category tag?

This is a '''Vulnerability'''. To view all vulnerabilities, please see the [[:Category:Vulnerability|Vulnerability Category]] page.

[[Category:OWASP ASDR Project]]

[[Category:Vulnerability]]

__NOTOC__

Appendix A: Testing Tools

2008-09-01T20:42:15Z

ParanoidMike: improving formatting & heading breaks, removed extraneous tags

{{Template:OWASP Testing Guide v3}}

==Open Source Black Box Testing tools==

=== General Testing ===

* '''[[OWASP_WebScarab_Project|OWASP WebScarab]]'''
* '''[[OWASP_CAL9000_Project|OWASP CAL9000]]'''
** CAL9000 is a collection of browser-based tools that enable more effective and efficient manual testing efforts.
** Includes an XSS Attack Library, Character Encoder/Decoder, HTTP Request Generator and Response Evaluator, Testing Checklist, Automated Attack Editor and much more.
* '''[[:Category:OWASP Pantera Web Assessment Studio Project|OWASP Pantera Web Assessment Studio Project]]'''
* SPIKE - http://www.immunitysec.com
* Paros - http://www.parosproxy.org
* Burp Proxy - http://www.portswigger.net
* Achilles Proxy - http://www.mavensecurity.com/achilles
* Odysseus Proxy - http://www.wastelands.gen.nz/odysseus/
* Webstretch Proxy - http://sourceforge.net/projects/webstretch
* Firefox LiveHTTPHeaders, Tamper Data and Developer Tools - http://www.mozdev.org
* Sensepost Wikto (Google cached fault-finding) - http://www.sensepost.com/research/wikto/index2.html
* Grendel-Scan - http://www.grendel-scan.com

=== Testing for specific vulnerabilities ===

==== Testing AJAX ====
* '''[[:Category:OWASP Sprajax Project|OWASP Sprajax Project]]'''
==== Testing for SQL Injection ====
* '''[[:Category:OWASP_SQLiX_Project|OWASP SQLiX]]'''
* Multiple DBMS Sql Injection tool - [[SQL Power Injector]]
* MySql Blind Injection Bruteforcing, Reversing.org - [sqlbftools]
* Antonio Parata: Dump Files by sql inference on Mysql - [SqlDumper]
* Sqlninja: a SQL Server Injection & Takeover Tool - http://sqlninja.sourceforge.net
* Bernardo Damele and Daniele Bellucci: sqlmap, a blind SQL injection tool - http://sqlmap.sourceforge.net
* Absinthe 1.1 (formerly SQLSqueal) - http://www.0x90.org/releases/absinthe/
* SQLInjector - http://www.databasesecurity.com/sql-injector.htm
* bsqlbf-1.2-th - http://www.514.es
==== Testing Oracle ====
* TNS Listener tool (Perl) - http://www.jammed.com/%7Ejwa/hacks/security/tnscmd/tnscmd-doc.html
* Toad for Oracle - http://www.quest.com/toad
==== Testing SSL ====
* Foundstone SSL Digger - http://www.foundstone.com/resources/proddesc/ssldigger.htm
==== Testing for Brute Force Password ====
* THC Hydra - http://www.thc.org/thc-hydra/
* John the Ripper - http://www.openwall.com/john/
* Brutus - http://www.hoobie.net/brutus/
* Medusa - http://www.foofus.net/~jmk/medusa/medusa.html
==== Testing for HTTP Methods ====
* NetCat - http://www.vulnwatch.org/netcat
==== Testing Buffer Overflow ====
* OllyDbg - http://www.ollydbg.de
** "A windows based debugger used for analyzing buffer overflow vulnerabilities"
* Spike - http://www.immunitysec.com/downloads/SPIKE2.9.tgz
** A fuzzer framework that can be used to explore vulnerabilities and perform length testing
* Brute Force Binary Tester (BFB) - http://bfbtester.sourceforge.net
** A proactive binary checker
* Metasploit - http://www.metasploit.com/projects/Framework/
** A rapid exploit development and Testing frame work
==== Fuzzer ====
* '''[[OWASP_WSFuzzer_Project|OWASP WSFuzzer]]'''
==== Googling ====
* Foundstone Sitedigger (Google cached fault-finding) - http://www.foundstone.com/resources/proddesc/sitedigger.htm

==Commercial Black Box Testing tools==

* Typhon - http://www.ngssoftware.com/products/internet-security/ngs-typhon.php
* NGSSQuirreL - http://www.ngssoftware.com/products/database-security/
* Watchfire AppScan - http://www.watchfire.com
* Cenzic Hailstorm - http://www.cenzic.com/products_services/cenzic_hailstorm.php
* SPI Dynamics WebInspect - http://www.spidynamics.com
* Burp Intruder - http://portswigger.net/intruder
* Acunetix Web Vulnerability Scanner - http://www.acunetix.com
* ScanDo - http://www.kavado.com
* WebSleuth - http://www.sandsprite.com
* NT Objectives NTOSpider - http://www.ntobjectives.com/products/ntospider.php
* Fortify Pen Testing Team Tool - http://www.fortifysoftware.com/products/tester
* Sandsprite Web Sleuth - http://sandsprite.com/Sleuth/
* MaxPatrol Security Scanner - http://www.maxpatrol.com
* Ecyware GreenBlue Inspector - http://www.ecyware.com
* Parasoft WebKing (more QA-type tool)
* MatriXay - http://www.dbappsecurity.com
* N-Stalker Web Application Security Scanner - http://www.nstalker.com

==Source Code Analyzers==

===Open Source / Freeware===

* '''[[:Category:OWASP_LAPSE_Project|OWASP LAPSE]]'''
* PMD - http://pmd.sourceforge.net/
* FlawFinder - http://www.dwheeler.com/flawfinder
* Microsoft’s [[FxCop]]
* Splint - http://splint.org
* Boon - http://www.cs.berkeley.edu/~daw/boon
* Pscan - http://www.striker.ottawa.on.ca/~aland/pscan
* FindBugs - http://findbugs.sourceforge.net

===Commercial ===

* Fortify - http://www.fortifysoftware.com
* Ounce labs Prexis - http://www.ouncelabs.com
* Veracode - http://www.veracode.com
* GrammaTech - http://www.grammatech.com
* ParaSoft - http://www.parasoft.com
* ITS4 - http://www.cigital.com/its4
* CodeWizard - http://www.parasoft.com/products/wizard
* Armorize CodeSecure - http://www.armorize.com/product/
* Checkmarx CxSuite - http://www.checkmarx.com

==Acceptance Testing Tools==
Acceptance testing tools are used to validate the functionality of web applications. Some follow a scripted approach and typically make use of a Unit Testing framework to construct test suites and test cases. Most, if not all, can be adapted to perform security specific tests in addition to functional tests.

===Open Source Tools===

* WATIR - http://wtr.rubyforge.org
** A Ruby based web testing framework that provides an interface into Internet Explorer.
** Windows only.
* HtmlUnit - http://htmlunit.sourceforge.net
** A Java and JUnit based framework that uses the Apache HttpClient as the transport.
** Very robust and configurable and is used as the engine for a number of other testing tools.
* jWebUnit - http://jwebunit.sourceforge.net
** A Java based meta-framework that uses htmlunit or selenium as the testing engine.
* Canoo Webtest - http://webtest.canoo.com
** An XML based testing tool that provides a facade on top of htmlunit.
** No coding is necessary as the tests are completely specified in XML.
** There is the option of scripting some elements in Groovy if XML does not suffice.
** Very actively maintained.
* HttpUnit - http://httpunit.sourceforge.net
** One of the first web testing frameworks, suffers from using the native JDK provided HTTP transport, which can be a bit limiting for security testing.
* Watij - http://watij.com
** A Java implementation of WATIR.
** Windows only because it uses IE for its tests (Mozilla integration is in the works).
* Solex - http://solex.sourceforge.net
** An Eclipse plugin that provides a graphical tool to record HTTP sessions and make assertions based on the results.
* Selenium - http://www.openqa.org/selenium/
** JavaScript based testing framework, cross-platform and provides a GUI for creating tests.
** Mature and popular tool, but the use of JavaScript could hamper certain security tests.

==Other Tools==

===Runtime Analysis===

* Rational PurifyPlus - http://www-306.ibm.com/software/awdtools

===Binary Analysis===

* BugScam - http://sourceforge.net/projects/bugscam
* BugScan - http://www.hbgary.com
* Veracode - http://www.veracode.com

===Requirements Management===

* Rational Requisite Pro - http://www-306.ibm.com/software/awdtools/reqpro

===Site Mirroring===
* wget - http://www.gnu.org/software/wget, http://www.interlog.com/~tcharron/wgetwin.html
* curl - http://curl.haxx.se
* Sam Spade - http://www.samspade.org
* Xenu - http://home.snafu.de/tilman/xenulink.html

Template:OWASP Testing Guide v3

2008-09-01T20:41:08Z

ParanoidMike: added period, removed spaces

[[OWASP Testing Guide v3 Table of Contents]]

This is a draft of a section of the new Testing Guide v3. For a stable version, please download the OWASP Testing Guide v2 '''[http://www.owasp.org/index.php/Image:OWASP_Testing_Guide_v2_pdf.zip here]'''.

__TOC__
[[Category:OWASP Testing Project]]
[[Category:Test]]

Source Code Analysis Tools

2008-09-01T04:48:56Z

ParanoidMike: fixed the LAPSE Project link

Source Code Analysis tools are designed to analyze source code and/or compiled version of code in order to help find security flaws. Ideally, such tools would automatically find security flaws with a high degree of confidence that what is found is indeed a flaw. However, this is beyond the state of the art for many types of application security flaws. Thus, such tools frequently serve as aids for an analyst to help them zero in on security relevant portions of code so they can find flaws more efficiently, rather than a tool that simply finds flaws automatically.

Some tools are starting to move into the IDE. For the types of problems that can be detected during the software development phase itself, this is a powerful phase within the development lifecycle to employ such tools, as it provides immediate feedback to the developer on issues they might be introducing into the code during code development itself. This immediate feedback is very useful as compared to finding vulnerabilities much later in the development cycle.

==Strengths and Weaknesses of such tools==

=== Strengths ===
* Scales Well (Can be run on lots of software, and can be repeatedly (like in nightly builds))
* For things that such tools can automatically find with high confidence, such as buffer overflows, SQL Injection Flaws, etc. they are great.

=== Weaknesses ===
* Many types of security vulnerabilities are very difficult to find automatically, such as authentication problems, access control issues, insecure use of cryptography, etc. The current state of the art only allows such tools to automatically find a relatively small percentage of application security flaws. Tools of this type are getting better, however.
* High numbers of false positives.
* Frequently can't find configuration issues, since they are not represented in the code.
* Difficult to 'prove' that an identified security issue is an actual vulnerability.
* Many of these tools have difficulty analyzing code that can't be compiled. Analysts frequently can't compile code because they don't have the right libraries, all the compilation instructions, all the code, etc.

==Important Selection Criteria==

* Requirement: Must support your language, but not usually a key factor once it does.

* Types of Vulnerabilities it can detect (Out of the OWASP Top Ten?) (plus more?)
* Does it require a fully buildable set of source?
* Can it run against binaries instead of source?
* Can it be integrated into the developer's IDE?

==OWASP Tools Of This Type==

* [[OWASP_LAPSE_Project | OWASP LAPSE Project]]

==Open Source or Free Tools Of This Type==

* [[FxCop]] (Microsoft)
* PreFast (Microsoft)
* [http://www.securitycompass.com/inner_swaat.shtml SWAAT] - Simplistic Beta Tool - Languages: Java, JSP, ASP .Net, and PHP
* [http://www.securesoftware.com/resources/download_rats.html RATS] (Secure Software) - Scans C, C++, Perl, PHP and Python source code for security problems like buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions

==Commercial Tools from OWASP Members Of This Type==

These vendors have decided to support OWASP by becoming [[Membership|members]]. OWASP appreciates the support from these organizations, but cannot endorse any commercial products or services.

* [http://www.armorize.com/corpweb/en/products/codesecure Static Source Code Analysis with CodeSecure™] (Armorize Technologies)
* [http://www.fortifysoftware.com/products/sca.jsp Source Code Analysis] (Fortify)
* [http://www.ouncelabs.com/ Ounce] (Ounce Labs)

==Other Well Known Commercial Tools Of This Type==

* [http://www.coverity.com/products/prevent.html Prevent] (Coverity)
* [http://www.klocwork.com/products/klocworkk7.asp K7] (KlocWork)

==More Info==

* TODO: add comments from: http://lists.owasp.org/pipermail/owasp-dotnet/2006-August/000002.html
* [[Appendix_A:_Testing_Tools | Appendix A: Testing Tools]]
* [http://samate.nist.gov/index.php/Source_Code_Security_Analyzers NIST's list of Source Code Security Analysis Tools]

[[Category:OWASP .NET Project]]

[[Category:OWASP Tools Project]]

__NOTOC__

OWASP LAPSE Project

2008-09-01T04:47:51Z

ParanoidMike: Added to make the internal links work better

#REDIRECT [[Category:OWASP LAPSE Project]]

.NET Security for Developers

2008-09-01T04:14:16Z

ParanoidMike: improved formatting, updated links

==Summary==
Developers are responsible for creating secure, trustworthy web applications and services. This section is to provide tools and guidance for the .NET Developer.

==Areas of Concern==
* [[Secure Development Lifecycle]]
** Overview
** Checklists
** Tools

* [[.NET Secure Coding | .NET Secure Coding]]
** Partial Trust
** Cross Platform

* [[.NET CIA | Confidentiality, Integrity and Availability in Practice]]
** Cryptography
** Debugging and Instrumentation
** Adaptive Web Applications and failing gracefully

* [[.NET Security Features | .NET Security Features (by Version)]]
** Authentication Best Practices
** Authorization
** Security Demands

* [[.NET Unit and Integration Testing | Unit and Integration Testing]]
** Test First (TDD) and Design Patterns
** Fuzzing

* .NET Web Technologies
** [[ASP.NET_WebForms | ASP.NET WebForms]]
** [[ASP.NET_MVC | ASP.NET Model View Controller]]
** [[SilverLight | Silverlight]]
** [[WSS | SharePoint (WSS)]]
** [[WCF Security Best Practices | Windows Communications Foundation Security Best Practices]]

==Articles & Projects==
[http://msdn.microsoft.com/security/bb896640.aspx "How Do I?" Microsoft Security Videos]

==Community Contributions==
[http://keepitlocked.net/archive/2008/04/11/developing-asp-net-in-partial-trust.aspx Developing ASP.NET in Partial Trust]

==References==
[http://go.microsoft.com/?linkid=8685076 Microsoft Security Development Lifecycle 3.2]

==Tools==
[[Source_Code_Analysis_Tools | Source Code Analysis Tools]]

Source Code Analysis Tools

2008-09-01T03:54:30Z

ParanoidMike: updated links, improved formatting

Source Code Analysis tools are designed to analyze source code and/or compiled version of code in order to help find security flaws. Ideally, such tools would automatically find security flaws with a high degree of confidence that what is found is indeed a flaw. However, this is beyond the state of the art for many types of application security flaws. Thus, such tools frequently serve as aids for an analyst to help them zero in on security relevant portions of code so they can find flaws more efficiently, rather than a tool that simply finds flaws automatically.

Some tools are starting to move into the IDE. For the types of problems that can be detected during the software development phase itself, this is a powerful phase within the development lifecycle to employ such tools, as it provides immediate feedback to the developer on issues they might be introducing into the code during code development itself. This immediate feedback is very useful as compared to finding vulnerabilities much later in the development cycle.

==Strengths and Weaknesses of such tools==

=== Strengths ===
* Scales Well (Can be run on lots of software, and can be repeatedly (like in nightly builds))
* For things that such tools can automatically find with high confidence, such as buffer overflows, SQL Injection Flaws, etc. they are great.

=== Weaknesses ===
* Many types of security vulnerabilities are very difficult to find automatically, such as authentication problems, access control issues, insecure use of cryptography, etc. The current state of the art only allows such tools to automatically find a relatively small percentage of application security flaws. Tools of this type are getting better, however.
* High numbers of false positives.
* Frequently can't find configuration issues, since they are not represented in the code.
* Difficult to 'prove' that an identified security issue is an actual vulnerability.
* Many of these tools have difficulty analyzing code that can't be compiled. Analysts frequently can't compile code because they don't have the right libraries, all the compilation instructions, all the code, etc.

==Important Selection Criteria==

* Requirement: Must support your language, but not usually a key factor once it does.

* Types of Vulnerabilities it can detect (Out of the OWASP Top Ten?) (plus more?)
* Does it require a fully buildable set of source?
* Can it run against binaries instead of source?
* Can it be integrated into the developer's IDE?

==OWASP Tools Of This Type==

* [[Category:OWASP_LAPSE_Project | OWASP LAPSE Project]]

==Open Source or Free Tools Of This Type==

* [[FxCop]] (Microsoft)
* PreFast (Microsoft)
* [http://www.securitycompass.com/inner_swaat.shtml SWAAT] - Simplistic Beta Tool - Languages: Java, JSP, ASP .Net, and PHP
* [http://www.securesoftware.com/resources/download_rats.html RATS] (Secure Software) - Scans C, C++, Perl, PHP and Python source code for security problems like buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions

==Commercial Tools from OWASP Members Of This Type==

These vendors have decided to support OWASP by becoming [[Membership|members]]. OWASP appreciates the support from these organizations, but cannot endorse any commercial products or services.

* [http://www.armorize.com/corpweb/en/products/codesecure Static Source Code Analysis with CodeSecure™] (Armorize Technologies)
* [http://www.fortifysoftware.com/products/sca.jsp Source Code Analysis] (Fortify)
* [http://www.ouncelabs.com/ Ounce] (Ounce Labs)

==Other Well Known Commercial Tools Of This Type==

* [http://www.coverity.com/products/prevent.html Prevent] (Coverity)
* [http://www.klocwork.com/products/klocworkk7.asp K7] (KlocWork)

==More Info==

* TODO: add comments from: http://lists.owasp.org/pipermail/owasp-dotnet/2006-August/000002.html
* [[Appendix_A:_Testing_Tools | Appendix A: Testing Tools]]
* [http://samate.nist.gov/index.php/Source_Code_Security_Analyzers NIST's list of Source Code Security Analysis Tools]

[[Category:OWASP .NET Project]]

[[Category:OWASP Tools Project]]

__NOTOC__

FxCop

2008-08-22T18:12:53Z

ParanoidMike: /* Tool, Documentation and Community */ added link to released version of FxCop 1.36

== What is FxCop? ==
FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet [[FxCop#References | below]]), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.

== Resources ==
=== Tool, Documentation and Community ===
* Download - [http://www.microsoft.com/downloads/details.aspx?FamilyID=9aeaa970-f281-4fb0-aba1-d59d7ed09772 FxCop v1.36]
* Download - [http://code.msdn.microsoft.com/codeanalysis FxCop v1.35]
* Download - [http://web.archive.org/web/*/http://www.gotdotnet.com/team/fxcop/FxCopInstall1.32.EXE FxCop v1.32 (''via archive.org'')] - only necessary if you wish to perform analysis of code written in Visual Studio 2003 or earlier.
* Download - [http://code.msdn.microsoft.com/codeanalysis/Release/ProjectReleases.aspx?ReleaseId=556 Rules comparison spreadsheet] - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
* Documentation - [http://msdn.microsoft.com/library/bb429476.aspx FxCop] - MSDN documentation for FxCop
* Forum - [http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=98&SiteID=1 Visual Studio Code Analysis and Code Metrics] - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis features
* Wikipedia - [http://en.wikipedia.org/wiki/Fxcop FxCop article]
* Blog - [http://blogs.msdn.com/fxcop/ Microsoft Code Analysis Team blog] - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
* Blog - [http://davesbox.com/ Dave's Box] - personal blog written by a member of Microsoft's Code Analysis team
* Article - [http://blogs.microsoft.co.il/blogs/sasha/archive/2007/02/10/Run-FxCop-from-Code.aspx Run FxCop from Code]
* Article - [http://weblogs.asp.net/rosherove/archive/2007/02/24/writing-real-unit-tests-for-your-custom-fxcop-rules.aspx Writing Real Unit Tests for your Custom FxCop Rules]
* Article - [http://www.binarycoder.net/fxcop/ FxCop and Code Analysis: Writing Your Own Custom Rules] - the definitive tutorial by Jason Kresowaty

=== Custom Rules and other third-party Enhancements ===
* [http://www.codeplex.com/JSLFxCop JSL FxCop (CodePlex)] - open-source utility to help build custom FxCop rules, as well as many custom rules.
* [http://www.codeplex.com/CSAR Community Static Analysis Rules (CodePlex)] - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
* [http://sourceforge.net/projects/tngfxcoprules/ TeachNaGeamhradh FxCop Rules (SourceForge)] - "A growing collection of rules and experimentation with FxCop to provide a comprehensive list of rules that are useful against the .Net assemblies."
* [http://www.codeplex.com/LephoneFxCopRules Lephone FxCop Rules (CodePlex)] - a small set of custom rules
* [http://code.msdn.microsoft.com/InfoXchange CustomFxCop (CodePlex)] - implements "...new rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
* [http://code.google.com/p/findbugs-fxcop/ findbugs-FxCop (Google Code)] - "This project will produce custom rules for FxCop, that will look for coding mistakes similar to those found by FindBugs, such as infinite recursive loops and ignored return values."
* [http://web.archive.org/web/20040724165715/http://tatochip.com/archive/2004/07/19/2678.aspx Custom FxCop rule : checking for IDataReader in method parameters (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20060313113313/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=14DEFFCB-9C2B-4C38-BEEC-AB860084E372 Custom FxCop rule: demonstrates extracting literal arguments from method call (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20070826010853/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=B397F7AD-4811-45DE-9A6A-33F818994CB1 Custom FxCop rules: No Numerals in Variable Names, Naming Constants (Archive.org)] - two FxCop rules in source code form
* [http://web.archive.org/web/20060427042023/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=01D9F014-5F73-4D66-8E74-C658944180DD Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113430/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=0BE37E51-6A0E-4E8E-A61F-84A388000859 Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113604/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop 1.32 rules (Archive.org)] - some FxCop 1.32 rules in source code form

* [http://web.archive.org/web/20060313113604/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop rules "My FxCop rules" (Archive.org)] - some FxCop rules [''broken link'']
* [http://web.archive.org/web/20060313113924/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=18919BD2-6502-43B3-BF3D-35C5E57DA06D TechEd 2004 presentation & samples by Michael Murray (Archive.org)] - "Code Correctness with FxCop 1.30" [''broken link'']

* [http://sourceforge.net/projects/fxdeputy/ FxDeputy (SourceForge)] - "This project is of use to anyone writing rules for the FxCop checker for .NET. This provides a framework that will allow you to tag tests with attributes that will provide you with control of what tests are run against your rules."
* [http://weblogs.asp.net/rosherove/archive/2007/02/24/introducing-fxcopunit-a-framework-for-integrated-fxcop-rule-testing.aspx FxCopUnit (ASP.NET blogs)] - "A framework for integrated FxCop rule testing"
* [http://www.codeplex.com/fxcopdelta FxCop Delta (CodePlex)] - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
* [http://www.codeplex.com/FinRadFxCopStats FinRad Statistics Collector for FxCop (CodePlex)] - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
* [http://web.archive.org/web/20070825153755/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BCFB8E54-989A-4464-BDB0-3C3B9B3F1346 FxCopReportAll.xsl (Archive.org)] - GotDotNet sample "style sheet for report that shows all Active and Excluded Messages."
* ''([http://code.msdn.microsoft.com/CustomRulesinFxcop CustomRules in FxCop] - '''DEAD CodePlex project''')''

=== Similar Tools for .NET code analysis ===
* [http://code.google.com/p/agentsmithplugin/ Agent Smith Plugin] - "Agent Smith is C# code style validation plugin for ReSharper (Visual Studio plugin)."
* [http://code.google.com/p/agentjohnsonplugin/ Agent Johnson Plugin] - "Plugin for JetBrains ReSharper", performing limited code analysis, refactoring and fixups on C# code.
* [http://code.google.com/p/smokey/ Smokey (Google Code)] - tool similar to FxCop for analysing managed code; has 220 separate rules.
* [http://research.microsoft.com/phoenix/ Phoenix] - an SDK from MS Research labelled as "...the software optimization and analysis framework that is the basis for all future Microsoft® compiler technologies. The Phoenix framework is an extensible system that can be adapted to read and write binaries and Microsoft Intermediate Language assemblies and represent the input files in an Intermediate Representation, which can be analyzed and manipulated by applications by using the Phoenix API."
* [http://www.mono-project.com/Gendarme Gendarme] - "Gendarme is a extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compiler do not typically check or have not historically checked."
* [http://code.google.com/p/md-codeanalysis/ md-codeanalysis] - "MonoDevelop.CodeAnalysis is an addin that integrates both Gendarme and Smokey into MonoDevelop."

FxCop

2008-08-22T18:08:16Z

ParanoidMike:

== What is FxCop? ==
FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet [[FxCop#References | below]]), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.

== Resources ==
=== Tool, Documentation and Community ===
* Download - [http://code.msdn.microsoft.com/codeanalysis FxCop v1.35]
* Download - [http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en FxCop v1.36 (beta)]
* Download - [http://web.archive.org/web/*/http://www.gotdotnet.com/team/fxcop/FxCopInstall1.32.EXE FxCop v1.32 (''via archive.org'')] - only necessary if you wish to perform analysis of code written in Visual Studio 2003 or earlier.
* Download - [http://code.msdn.microsoft.com/codeanalysis/Release/ProjectReleases.aspx?ReleaseId=556 Rules comparison spreadsheet] - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
* Documentation - [http://msdn.microsoft.com/library/bb429476.aspx FxCop] - MSDN documentation for FxCop
* Forum - [http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=98&SiteID=1 Visual Studio Code Analysis and Code Metrics] - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis feature
* Wikipedia - [http://en.wikipedia.org/wiki/Fxcop FxCop article]
* Blog - [http://blogs.msdn.com/fxcop/ Microsoft Code Analysis Team blog] - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
* Blog - [http://davesbox.com/ Dave's Box] - personal blog written by a member of Microsoft's Code Analysis team
* Article - [http://blogs.microsoft.co.il/blogs/sasha/archive/2007/02/10/Run-FxCop-from-Code.aspx Run FxCop from Code]
* Article - [http://weblogs.asp.net/rosherove/archive/2007/02/24/writing-real-unit-tests-for-your-custom-fxcop-rules.aspx Writing Real Unit Tests for your Custom FxCop Rules]
* Article - [http://www.binarycoder.net/fxcop/ FxCop and Code Analysis: Writing Your Own Custom Rules] - the definitive tutorial by Jason Kresowaty

=== Custom Rules and other third-party Enhancements ===
* [http://www.codeplex.com/JSLFxCop JSL FxCop (CodePlex)] - open-source utility to help build custom FxCop rules, as well as many custom rules.
* [http://www.codeplex.com/CSAR Community Static Analysis Rules (CodePlex)] - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
* [http://sourceforge.net/projects/tngfxcoprules/ TeachNaGeamhradh FxCop Rules (SourceForge)] - "A growing collection of rules and experimentation with FxCop to provide a comprehensive list of rules that are useful against the .Net assemblies."
* [http://www.codeplex.com/LephoneFxCopRules Lephone FxCop Rules (CodePlex)] - a small set of custom rules
* [http://code.msdn.microsoft.com/InfoXchange CustomFxCop (CodePlex)] - implements "...new rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
* [http://code.google.com/p/findbugs-fxcop/ findbugs-FxCop (Google Code)] - "This project will produce custom rules for FxCop, that will look for coding mistakes similar to those found by FindBugs, such as infinite recursive loops and ignored return values."
* [http://web.archive.org/web/20040724165715/http://tatochip.com/archive/2004/07/19/2678.aspx Custom FxCop rule : checking for IDataReader in method parameters (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20060313113313/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=14DEFFCB-9C2B-4C38-BEEC-AB860084E372 Custom FxCop rule: demonstrates extracting literal arguments from method call (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20070826010853/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=B397F7AD-4811-45DE-9A6A-33F818994CB1 Custom FxCop rules: No Numerals in Variable Names, Naming Constants (Archive.org)] - two FxCop rules in source code form
* [http://web.archive.org/web/20060427042023/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=01D9F014-5F73-4D66-8E74-C658944180DD Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113430/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=0BE37E51-6A0E-4E8E-A61F-84A388000859 Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113604/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop 1.32 rules (Archive.org)] - some FxCop 1.32 rules in source code form

* [http://web.archive.org/web/20060313113604/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop rules "My FxCop rules" (Archive.org)] - some FxCop rules [''broken link'']
* [http://web.archive.org/web/20060313113924/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=18919BD2-6502-43B3-BF3D-35C5E57DA06D TechEd 2004 presentation & samples by Michael Murray (Archive.org)] - "Code Correctness with FxCop 1.30" [''broken link'']

* [http://sourceforge.net/projects/fxdeputy/ FxDeputy (SourceForge)] - "This project is of use to anyone writing rules for the FxCop checker for .NET. This provides a framework that will allow you to tag tests with attributes that will provide you with control of what tests are run against your rules."
* [http://weblogs.asp.net/rosherove/archive/2007/02/24/introducing-fxcopunit-a-framework-for-integrated-fxcop-rule-testing.aspx FxCopUnit (ASP.NET blogs)] - "A framework for integrated FxCop rule testing"
* [http://www.codeplex.com/fxcopdelta FxCop Delta (CodePlex)] - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
* [http://www.codeplex.com/FinRadFxCopStats FinRad Statistics Collector for FxCop (CodePlex)] - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
* [http://web.archive.org/web/20070825153755/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BCFB8E54-989A-4464-BDB0-3C3B9B3F1346 FxCopReportAll.xsl (Archive.org)] - GotDotNet sample "style sheet for report that shows all Active and Excluded Messages."
* ''([http://code.msdn.microsoft.com/CustomRulesinFxcop CustomRules in FxCop] - '''DEAD CodePlex project''')''

=== Similar Tools for .NET code analysis ===
* [http://code.google.com/p/agentsmithplugin/ Agent Smith Plugin] - "Agent Smith is C# code style validation plugin for ReSharper (Visual Studio plugin)."
* [http://code.google.com/p/agentjohnsonplugin/ Agent Johnson Plugin] - "Plugin for JetBrains ReSharper", performing limited code analysis, refactoring and fixups on C# code.
* [http://code.google.com/p/smokey/ Smokey (Google Code)] - tool similar to FxCop for analysing managed code; has 220 separate rules.
* [http://research.microsoft.com/phoenix/ Phoenix] - an SDK from MS Research labelled as "...the software optimization and analysis framework that is the basis for all future Microsoft® compiler technologies. The Phoenix framework is an extensible system that can be adapted to read and write binaries and Microsoft Intermediate Language assemblies and represent the input files in an Intermediate Representation, which can be analyzed and manipulated by applications by using the Phoenix API."
* [http://www.mono-project.com/Gendarme Gendarme] - "Gendarme is a extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compiler do not typically check or have not historically checked."
* [http://code.google.com/p/md-codeanalysis/ md-codeanalysis] - "MonoDevelop.CodeAnalysis is an addin that integrates both Gendarme and Smokey into MonoDevelop."

Unvalidated Input

2008-08-20T01:08:09Z

ParanoidMike: Updated the links in "Examples and References" & "Description"

==Description==

Web applications use input from HTTP requests (and occasionally files) to determine how to respond. Attackers can tamper with any part of an HTTP request, including the url, querystring, headers, cookies, form fields, and hidden fields, to try to bypass the site’s security mechanisms. Common names for common input tampering attacks include: forced browsing, command insertion, cross site scripting, buffer overflows, format string attacks, SQL injection, cookie poisoning, and hidden field manipulation. Each of these attack types is described in more detail later in this paper.

* [[Cross-site scripting|Cross Site Scripting Flaws]] discusses input that contains scripts to be executed on other user ’s browsers
* [[Buffer Overflow|Buffer Overflows]] discusses input that has been designed to overwrite program execution space
* [[Injection Flaws]] discusses input that is modified to contain executable commands

Some sites attempt to protect themselves by filtering out malicious input. The problem is that there are so many different ways of encoding information. These encoding formats are not like encryption, since they are trivial to decode. Still, developers often forget to decode all parameters to their simplest form before using them. Parameters must be converted to the simplest form before they are validated, otherwise, malicious input can be masked and it can slip past filters. The process of simplifying these encodings is called “canonicalization.” Since almost all HTTP input can be represented in multiple formats, this technique can be used to obfuscate any attack targeting the vulnerabilities described in this document. This makes filtering very difficult.

A surprising number of web applications use only client-side mechanisms to validate input. Client side validation mechanisms are easily bypassed, leaving the web application without any protection against malicious parameters. Attackers can generate their own HTTP requests using tools as simple as telnet. They do not have to pay attention to anything that the developer intended to happen on the client side. Note that client side validation is a fine idea for performance and usability, but it has no security benefit whatsoever. Server side checks are required to defend against parameter manipulation attacks. Once these are in place, client side checking can also be included to enhance the user experience for legitimate users and/or reduce the amount of invalid traffic to the server.

These attacks are becoming increasingly likely as the number of tools that support parameter “fuzzing”, corruption, and brute forcing grows. The impact of using unvalidated input should not be underestimated. A huge number of attacks would become difficult or impossible if developers would simply validate input before using it. Unless a web application has a strong, centralized mechanism for validating all input from HTTP requests (and any other sources), vulnerabilities based on malicious input are very likely to exist.

==Environments Affected==

All web servers, application servers, and web application environments are susceptible to parameter tampering.

==Examples and References==

* [[:Category:OWASP_Guide_Project|OWASP Guide to Building Secure Web Applications and Web Services]], Chapter 8: Data Validation
* [http://www.modsecurity.org modsecurity project] (Apache module for HTTP validation)
* [[How to Build an HTTP Request Validation Engine for Your J2EE Application]] (J2EE validation with Stinger)
* [[Have Your Cake and Eat It Too]] (.NET validation)

==How to Determine If You Are Vulnerable==

Any part of an HTTP request that is used by a web application without being carefully validated is known as a “tainted” parameter. The simplest way to find tainted parameter use is to have a detailed code review, searching for all the calls where information is extracted from an HTTP request. For example, in a J2EE application, these are the methods in the HttpServletRequest class. Then you can follow the code to see where that variable gets used. If the variable is not checked before it is used, there is very likely a problem. In Perl, you should consider using the “taint” (-T) option.

It is also possible to find tainted parameter use by using tools like OWASP’s WebScarab. By submitting unexpected values in HTTP requests and viewing the web application’s responses, you can identify places where tainted parameters are used.

==How to Protect Yourself==

The best way to prevent parameter tampering is to ensure that all parameters are validated before they are used. A centralized component or library is likely to be the most effective, as the code performing the checking should all be in one place. Each parameter should be checked against a strict format that specifies exactly what input will be allowed. “Negative” approaches that involve filtering out certain bad input or approaches that rely on signatures are not likely to be effective and may be difficult to maintain.

Parameters should be validated against a “positive” specification that defines:

* Data type (string, integer, real, etc…)
* Allowed character set
* Minimum and maximum length
* Whether null is allowed
* Whether the parameter is required or not
* Whether duplicates are allowed
* Numeric range
* Specific legal values (enumeration)
* Specific patterns (regular expressions)

A new class of security devices known as web application firewalls can provide some parameter validation services. However, in order for them to be effective, the device must be configured with a strict definition of what is valid for each parameter for your site. This includes properly protecting all types of input from the HTTP request, including URLs, forms, cookies, querystrings, hidden fields, and parameters.

The OWASP Filters project is producing reusable components in several languages to help prevent many forms of parameter tampering. The Stinger HTTP request validation engine (http://sourceforge.net/projects/stinger) was also developed by OWASP for J2EE environments.

[[Category:OWASP Top Ten Project]]

__NOEDITSECTION__

FxCop

2008-08-19T20:58:06Z

ParanoidMike: added link to OWASP.NET security rules

== What is FxCop? ==
FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet [[FxCop#References | below]]), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.

== Resources ==
=== Tool, Documentation and Community ===
* Download - [http://code.msdn.microsoft.com/codeanalysis FxCop v1.35]
* Download - [http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en FxCop v1.36 (beta)]
* Download - [http://web.archive.org/web/*/http://www.gotdotnet.com/team/fxcop/FxCopInstall1.32.EXE FxCop v1.32 (''via archive.org'')] - only necessary if you wish to perform analysis of code written in Visual Studio 2003 or earlier.
* Download - [http://code.msdn.microsoft.com/codeanalysis/Release/ProjectReleases.aspx?ReleaseId=556 Rules comparison spreadsheet] - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
* Documentation - [http://msdn.microsoft.com/library/bb429476.aspx FxCop] - MSDN documentation for FxCop
* Forum - [http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=98&SiteID=1 Visual Studio Code Analysis and Code Metrics] - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis feature
* Wikipedia - [http://en.wikipedia.org/wiki/Fxcop FxCop article]
* Blog - [http://blogs.msdn.com/fxcop/ Microsoft Code Analysis Team blog] - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
* Blog - [http://davesbox.com/ Dave's Box] - personal blog written by a member of Microsoft's Code Analysis team
* Article - [http://blogs.microsoft.co.il/blogs/sasha/archive/2007/02/10/Run-FxCop-from-Code.aspx Run FxCop from Code]
* Article - [http://weblogs.asp.net/rosherove/archive/2007/02/24/writing-real-unit-tests-for-your-custom-fxcop-rules.aspx Writing Real Unit Tests for your Custom FxCop Rules]
* Article - [http://www.binarycoder.net/fxcop/ FxCop and Code Analysis: Writing Your Own Custom Rules] - the definitive tutorial by Jason Kresowaty

=== Custom Rules and other third-party Enhancements ===
* [http://www.codeplex.com/JSLFxCop JSL FxCop (CodePlex)] - open-source utility to help build custom FxCop rules, as well as many custom rules.
* [http://www.codeplex.com/CSAR Community Static Analysis Rules (CodePlex)] - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
* [http://sourceforge.net/projects/tngfxcoprules/ TeachNaGeamhradh FxCop Rules (SourceForge)] - "A growing collection of rules and experimentation with FxCop to provide a comprehensive list of rules that are useful against the .Net assemblies."
* [http://www.codeplex.com/LephoneFxCopRules Lephone FxCop Rules (CodePlex)] - a small set of custom rules
* [http://code.msdn.microsoft.com/InfoXchange CustomFxCop (CodePlex)] - implements "...new rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
* [http://code.google.com/p/findbugs-fxcop/ findbugs-FxCop (Google Code)] - "This project will produce custom rules for FxCop, that will look for coding mistakes similar to those found by FindBugs, such as infinite recursive loops and ignored return values."
* [http://trac2.assembla.com/owaspdotnet/ticket/6 OWASP FxCop rules (OWASP.Net)] - a basic set of rules devised by one of the members of the OWASP.NET project
* [http://web.archive.org/web/20040724165715/http://tatochip.com/archive/2004/07/19/2678.aspx Custom FxCop rule : checking for IDataReader in method parameters (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20060313113313/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=14DEFFCB-9C2B-4C38-BEEC-AB860084E372 Custom FxCop rule: demonstrates extracting literal arguments from method call (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20070826010853/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=B397F7AD-4811-45DE-9A6A-33F818994CB1 Custom FxCop rules: No Numerals in Variable Names, Naming Constants (Archive.org)] - two FxCop rules in source code form
* [http://web.archive.org/web/20060427042023/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=01D9F014-5F73-4D66-8E74-C658944180DD Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113430/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=0BE37E51-6A0E-4E8E-A61F-84A388000859 Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113604/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop 1.32 rules (Archive.org)] - some FxCop 1.32 rules in source code form

* [http://web.archive.org/web/20060313113604/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop rules "My FxCop rules" (Archive.org)] - some FxCop rules [''broken link'']
* [http://web.archive.org/web/20060313113924/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=18919BD2-6502-43B3-BF3D-35C5E57DA06D TechEd 2004 presentation & samples by Michael Murray (Archive.org)] - "Code Correctness with FxCop 1.30" [''broken link'']

* [http://sourceforge.net/projects/fxdeputy/ FxDeputy (SourceForge)] - "This project is of use to anyone writing rules for the FxCop checker for .NET. This provides a framework that will allow you to tag tests with attributes that will provide you with control of what tests are run against your rules."
* [http://weblogs.asp.net/rosherove/archive/2007/02/24/introducing-fxcopunit-a-framework-for-integrated-fxcop-rule-testing.aspx FxCopUnit (ASP.NET blogs)] - "A framework for integrated FxCop rule testing"
* [http://www.codeplex.com/fxcopdelta FxCop Delta (CodePlex)] - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
* [http://www.codeplex.com/FinRadFxCopStats FinRad Statistics Collector for FxCop (CodePlex)] - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
* [http://web.archive.org/web/20070825153755/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BCFB8E54-989A-4464-BDB0-3C3B9B3F1346 FxCopReportAll.xsl (Archive.org)] - GotDotNet sample "style sheet for report that shows all Active and Excluded Messages."
* ''([http://code.msdn.microsoft.com/CustomRulesinFxcop CustomRules in FxCop] - '''DEAD CodePlex project''')''

=== Similar Tools for .NET code analysis ===
* [http://code.google.com/p/agentsmithplugin/ Agent Smith Plugin] - "Agent Smith is C# code style validation plugin for ReSharper (Visual Studio plugin)."
* [http://code.google.com/p/agentjohnsonplugin/ Agent Johnson Plugin] - "Plugin for JetBrains ReSharper", performing limited code analysis, refactoring and fixups on C# code.
* [http://code.google.com/p/smokey/ Smokey (Google Code)] - tool similar to FxCop for analysing managed code; has 220 separate rules.
* [http://research.microsoft.com/phoenix/ Phoenix] - an SDK from MS Research labelled as "...the software optimization and analysis framework that is the basis for all future Microsoft® compiler technologies. The Phoenix framework is an extensible system that can be adapted to read and write binaries and Microsoft Intermediate Language assemblies and represent the input files in an Intermediate Representation, which can be analyzed and manipulated by applications by using the Phoenix API."
* [http://www.mono-project.com/Gendarme Gendarme] - "Gendarme is a extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compiler do not typically check or have not historically checked."
* [http://code.google.com/p/md-codeanalysis/ md-codeanalysis] - "MonoDevelop.CodeAnalysis is an addin that integrates both Gendarme and Smokey into MonoDevelop."

.Net Assembly Analyzer

2008-08-14T22:47:28Z

ParanoidMike: /* Development notes */ spelling

.Net Assembly Analyzer is a tool that uses reflection to analyze .Net (i.e. MSIL) code.

== Development notes ==

* The base functionality is now created (first analysis of assemblies, storing of data in object, XML serialization, and storage of all calls made from each method (using MSIL analysis)
* What needs to happen next is for each call discovered, store its reference (as a callback) in the target method (this is a bit complicated because we must make sure that the signatures match)
* Once that is done, the next step will be do create quick spiders that will use the populated objects to map the possible paths

__NOTOC__

== Download ==

You can download the current version from here [[Media:AssemblyAnalyzer_v0.2.zip.ppt|AssemblyAnalyzer v0.2.zip.ppt]] (remove the .ppt to unzip)

== Info ==

The current version takes an assembly and creates an XML file containg the following information

namespace Owasp.AssemblyAnalyzer
{
[Serializable]
public class AssemblyRawData
{
public List<aAssembly> aAssemblies = new List<aAssembly>();
}
[Serializable]
public class aAssembly
{
[XmlAttribute()] public string Name = "";
public List<String> strAttributes = new List<String>();
public List<mModule> mModules = new List<mModule>();
}
[Serializable]
public class mModule
{
[XmlAttribute()] public string Name;
public string FullyQualifiedName;
public List<tType> tTypes = new List<tType>();
}
[Serializable]
public class tType
{
[XmlAttribute()] public string FullName;
[XmlAttribute()] public string Name;
[XmlAttribute()] public string Namespace;
[XmlAttribute()] public bool bIsAbstract;
[XmlAttribute()] public bool bIsAnsiClass;
[XmlAttribute()] public bool bIsArray;
[XmlAttribute()] public bool bIsAutoClass;
[XmlAttribute()] public bool bIsAutoLayout;
[XmlAttribute()] public bool bIsByRef;
[XmlAttribute()] public bool bIsClass;
[XmlAttribute()] public bool bIsCOMObject;
[XmlAttribute()] public bool bIsContextful;
[XmlAttribute()] public bool bIsEnum;
[XmlAttribute()] public bool bIsExplicitLayout;
[XmlAttribute()] public bool bIsGenericParameter;
[XmlAttribute()] public bool bIsGenericType;
[XmlAttribute()] public bool bIsGenericTypeDefinition;
[XmlAttribute()] public bool bIsImport;
[XmlAttribute()] public bool bIsInterface;
[XmlAttribute()] public bool bIsLayoutSequential;
[XmlAttribute()] public bool bIsMarshalByRef;
[XmlAttribute()] public bool bIsNested;
[XmlAttribute()] public bool bIsNestedAssembly;
[XmlAttribute()] public bool bIsNestedFamily;
[XmlAttribute()] public bool bIsNestedPrivate;
[XmlAttribute()] public bool bIsNestedPublic;
[XmlAttribute()] public bool bIsNotPublic;
[XmlAttribute()] public bool bIsPointer;
[XmlAttribute()] public bool bIsPrimitive;
[XmlAttribute()] public bool bIsPublic;
[XmlAttribute()] public bool bIsSealed;
[XmlAttribute()] public bool bIsSerializable;
[XmlAttribute()] public bool bIsSpecialName;
[XmlAttribute()] public bool bIsUnicodeClass;
[XmlAttribute()] public bool bIsValueType;
[XmlAttribute()] public bool bIsVisible;
public string strTypeAttributes;
public List<String> strAttributes = new List<String>();
public List<mMethod> mMethods = new List<mMethod>();
public List<fField> fFields = new List<fField>();
public List<pProperty> pProperties = new List<pProperty>();
}
[Serializable]
public class mMethod
{
[XmlAttribute()] public string Name;
[XmlAttribute()] public bool bIsAbstract;
[XmlAttribute()] public bool bIsAssembly;
[XmlAttribute()] public bool bIsConstructor;
[XmlAttribute()] public bool bIsFamily;
[XmlAttribute()] public bool bIsFinal;
[XmlAttribute()] public bool bIsGenericMethod;
[XmlAttribute()] public bool bIsGenericMethodDefinition;
[XmlAttribute()] public bool bIsHideBySig;
[XmlAttribute()] public bool bIsPrivate;
[XmlAttribute()] public bool bIsPublic;
[XmlAttribute()] public bool bIsSpecialName;
[XmlAttribute()] public bool bIsStatic;
[XmlAttribute()] public bool bIsVirtual;
public List<string> strCalls = new List<string>();
public List<string> strUsedBy = new List<string>();
}
[Serializable]
public class fField
{
[XmlAttribute()] public string Name;
}
[Serializable]
public class pProperty
{
[XmlAttribute()] public string Name;
}
}

== Output Sample==

The output is a serialized version of the populated AssemblyRawData object

<?xml version="1.0"?>
<AssemblyRawData xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<aAssemblies>
<aAssembly Name="AssemblyAnalyzer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null">
<strAttributes>
<string>System.Reflection.AssemblyConfigurationAttribute</string>
<string>System.Reflection.AssemblyTitleAttribute</string>
<string>System.Reflection.AssemblyCompanyAttribute</string>
<string>System.Reflection.AssemblyFileVersionAttribute</string>
<string>System.Reflection.AssemblyProductAttribute</string>
<string>System.Diagnostics.DebuggableAttribute</string>
<string>System.Runtime.CompilerServices.CompilationRelaxationsAttribute</string>
<string>System.Runtime.CompilerServices.RuntimeCompatibilityAttribute</string>
<string>System.Reflection.AssemblyDescriptionAttribute</string>
<string>System.Runtime.InteropServices.GuidAttribute</string>
<string>System.Runtime.InteropServices.ComVisibleAttribute</string>
<string>System.Reflection.AssemblyTrademarkAttribute</string>
<string>System.Reflection.AssemblyCopyrightAttribute</string>
</strAttributes>
<mModules>
<mModule Name="AssemblyAnalyzer.exe">
<FullyQualifiedName>F:\_Research\_MS session in Seattle\AssemblyAnalyzer\bin\AssemblyAnalyzer.exe</FullyQualifiedName>
<tTypes>
<tType FullName="Owasp.AssemblyAnalyzer.Properties.Resources" Name="Resources" Namespace="Owasp.AssemblyAnalyzer.Properties" bIsAbstract="false" bIsAnsiClass="true" bIsArray="false" bIsAutoClass="false" bIsAutoLayout="true" bIsByRef="false" bIsClass="true" bIsCOMObject="false" bIsContextful="false" bIsEnum="false" bIsExplicitLayout="false" bIsGenericParameter="false" bIsGenericType="false" bIsGenericTypeDefinition="false" bIsImport="false" bIsInterface="false" bIsLayoutSequential="false" bIsMarshalByRef="false" bIsNested="false" bIsNestedAssembly="false" bIsNestedFamily="false" bIsNestedPrivate="false" bIsNestedPublic="false" bIsNotPublic="true" bIsPointer="false" bIsPrimitive="false" bIsPublic="false" bIsSealed="false" bIsSerializable="false" bIsSpecialName="false" bIsUnicodeClass="false" bIsValueType="false" bIsVisible="false">
<strTypeAttributes>AutoLayout, AnsiClass, Class, BeforeFieldInit</strTypeAttributes>
<strAttributes>
<string>System.Diagnostics.DebuggerNonUserCodeAttribute</string>
<string>System.Runtime.CompilerServices.CompilerGeneratedAttribute</string>
<string>System.CodeDom.Compiler.GeneratedCodeAttribute</string>
</strAttributes>
<mMethods>
<mMethod Name="GetType" bIsAbstract="false" bIsAssembly="false" bIsConstructor="false" bIsFamily="false" bIsFinal="false" bIsGenericMethod="false" bIsGenericMethodDefinition="false" bIsHideBySig="true" bIsPrivate="false" bIsPublic="true" bIsSpecialName="false" bIsStatic="false" bIsVirtual="false">
<strCalls />
<strUsedBy />
</mMethod>
<mMethod Name="ToString" bIsAbstract="false" bIsAssembly="false" bIsConstructor="false" bIsFamily="false" bIsFinal="false" bIsGenericMethod="false" bIsGenericMethodDefinition="false" bIsHideBySig="true" bIsPrivate="false" bIsPublic="true" bIsSpecialName="false" bIsStatic="false" bIsVirtual="true">
<strCalls />
<strUsedBy />
</mMethod>
<mMethod Name="Equals" bIsAbstract="false" bIsAssembly="false" bIsConstructor="false" bIsFamily="false" bIsFinal="false" bIsGenericMethod="false" bIsGenericMethodDefinition="false" bIsHideBySig="true" bIsPrivate="false" bIsPublic="true" bIsSpecialName="false" bIsStatic="false" bIsVirtual="true">
<strCalls />
<strUsedBy />
</mMethod>
<mMethod Name="GetHashCode" bIsAbstract="false" bIsAssembly="false" bIsConstructor="false" bIsFamily="false" bIsFinal="false" bIsGenericMethod="false" bIsGenericMethodDefinition="false" bIsHideBySig="true" bIsPrivate="false" bIsPublic="true" bIsSpecialName="false" bIsStatic="false" bIsVirtual="true">
<strCalls />
<strUsedBy />
</mMethod>
</mMethods>
<fFields />
<pProperties />
</tType>
<tType FullName="Owasp.AssemblyAnalyzer.utils.serialization" Name="serialization" Namespace="Owasp.AssemblyAnalyzer.utils" bIsAbstract="false" bIsAnsiClass="true" bIsArray="false" bIsAutoClass="false" bIsAutoLayout="true" bIsByRef="false" bIsClass="true" bIsCOMObject="false" bIsContextful="false" bIsEnum="false" bIsExplicitLayout="false" bIsGenericParameter="false" bIsGenericType="false" bIsGenericTypeDefinition="false" bIsImport="false" bIsInterface="false" bIsLayoutSequential="false" bIsMarshalByRef="false" bIsNested="false" bIsNestedAssembly="false" bIsNestedFamily="false" bIsNestedPrivate="false" bIsNestedPublic="false" bIsNotPublic="true" bIsPointer="false" bIsPrimitive="false" bIsPublic="false" bIsSealed="false" bIsSerializable="false" bIsSpecialName="false" bIsUnicodeClass="false" bIsValueType="false" bIsVisible="false">
<strTypeAttributes>AutoLayout, AnsiClass, Class, BeforeFieldInit</strTypeAttributes>
<strAttributes />
<mMethods>
<mMethod Name="returnStringOfSerializedObject" bIsAbstract="false" bIsAssembly="false" bIsConstructor="false" bIsFamily="false" bIsFinal="false" bIsGenericMethod="false" bIsGenericMethodDefinition="false" bIsHideBySig="true" bIsPrivate="false" bIsPublic="true" bIsSpecialName="false" bIsStatic="true" bIsVirtual="false">
<strCalls>
<string>System.Object.GetType</string>
<string>System.Xml.Serialization.XmlSerializer..ctor</string>
<string>System.Object.GetType</string>
<string>System.Xml.Serialization.XmlSerializer..ctor</string>
<string>System.IO.MemoryStream..ctor</string>
<string>System.Xml.Serialization.XmlSerializer.Serialize</string>
<string>System.IO.Stream.Flush</string>
<string>System.IO.Stream.set_Position</string>
<string>System.IO.Stream.get_Length</string>
<string>System.IO.Stream.get_Length</string>
<string>System.IO.Stream.Read</string>
<string>System.Text.Encoding.get_UTF8</string>
<string>System.Text.Encoding.GetString</string>
</strCalls>
<strUsedBy />
</mMethod>
<mMethod Name="returnDeSerializedObjectOfSerializedString" bIsAbstract="false" bIsAssembly="false" bIsConstructor="false" bIsFamily="false" bIsFinal="false" bIsGenericMethod="false" bIsGenericMethodDefinition="false" bIsHideBySig="true" bIsPrivate="false" bIsPublic="true" bIsSpecialName="false" bIsStatic="true" bIsVirtual="false">
<strCalls>
<string>System.Xml.Serialization.XmlSerializer..ctor</string>
<string>System.Text.Encoding.get_UTF8</string>
<string>System.Text.Encoding.GetBytes</string>
<string>System.IO.MemoryStream..ctor</string>
<string>System.Xml.Serialization.XmlSerializer.Deserialize</string>
</strCalls>
<strUsedBy />
</mMethod>

[[Category:OWASP .NET Project]]

Threat Risk Modeling

2008-08-11T20:36:14Z

ParanoidMike: added list of risk management tools (all open source)

__TOC__
When you start a web application design, it is essential to apply threat risk modeling; otherwise you will squander resources, time and money on useless controls that fail to focus on the real risks.

The method used to assess risk is not nearly as important as actually performing a structured threat risk modeling. Microsoft notes that the single most important factor in their security improvement program was the corporate adoption of threat risk modeling.

OWASP recommends Microsoft’s threat modeling process because it works well for addressing the unique challenges facing web application security and is simple to learn and adopt by designers, developers, code reviewers, and the quality assurance team.

The following sections provide some overview information (or see Section 6.9, Further Reading, for additional resources).

== Threat Risk Modeling ==
Threat risk modeling is an essential process for secure web application development. It allows organizations to determine the correct controls and to produce effective countermeasures within budget. For example, there is little point in spending $100,000 for fraud control for a system that has negligible fraud risk.

== Performing threat risk modeling using the Microsoft Threat Modeling Process ==
The threat risk modeling process has five steps, enumerated below and shown graphically in Figure 1. They are:
# Identify Security Objectives
# Survey the Application
# Decompose it
# Identify Threats
# Identify Vulnerabilities

[[Image:Threat_Model_Flow.gif|Figure 1: Threat Model Flow]]

Let’s consider the steps in more detail.

=== Identify Security Objectives ===
The business (or project management) leadership, in concert with the software development and quality assurance teams, all need to understand the security objectives. To facilitate this, start by breaking down the application’s security objectives into the following categories:

* '''Identity:''' Does the application protect user identity from abuse? Are there adequate controls in place to ensure evidence of identity (as required for many banking applications?)
* '''Financial:''' Assess the level of risk the organization is prepared to absorb in remediation, as a potential financial loss. For example, forum software may have a lower estimated financial risk than an Internet banking application.
* '''Reputation:''' Quantify or estimate of the loss of reputation derived from the application being misused or successfully attacked.
* '''Privacy and Regulatory:''' To what extent will the application have to protect user data? Forum software by its nature is public, but a tax preparation application is subject to tax regulations and privacy legislation requirements in most countries.
* '''Availability Guarantees:''' Is the application required to be available per a '''''Service Level Agreement (SLA)''''' or similar guarantee? Is it a nationally protected infrastructure? To what level will the application have to be available? High availability techniques are significantly more expensive, so applying the correct controls up front will save a great deal of time, resources, and money.

This is by no means an exhaustive list, but it gives an idea of some of the business risk decisions leading into selecting and building security controls.

Other sources of risk guidance come from:
* Laws (such as privacy or finance laws)
* Regulations (such as banking or e-commerce regulations)
* Standards (such as ISO 17799)
* Legal Agreements (such as payment card industry standards or merchant agreements)
* Corporate Information Security Policy

=== Application Overview ===
Once the security objectives have been defined, analyze the application design to identify the '''''components''''', '''''data flows''''', and '''''trust boundaries'''''.

Do this by surveying the application’s architecture and design documentation. In particular, look for UML component diagrams. Such high level component diagrams are generally sufficient to understand how and why data flows to various places. For example, data movement across a trust boundary (such as from the Internet to the web tier, or from the business logic to the database server), needs to be carefully analyzed, whereas data that flows within the same trust level does not need as much scrutiny.

=== Decompose Application ===
Once the application architecture is understood then decompose it further, to identify the features and modules with a security impact that need to be evaluated. For example, when investigating the authentication module, it is necessary to understand how data enters the module, how the module validates and processes the data, where the data flows, how the data is stored, and what fundamental decisions and assumptions are made by the module.

=== Identify Threats ===
It is impossible to write down unknown threats, but it is likewise unlikely that new malware will be created to exploit new vulnerabilities within custom systems. Therefore, concentrate on known risks, which can be easily demonstrated using tools or techniques from Bugtraq.

Microsoft suggests two different approaches for writing up threats. One is a threat graph, as shown in Figure 2, and the other is a structured list, as shown in Figure 3.

[[Image:Threat_Graph.gif|Figure 2: Threat Graph]]

Typically, a threat graph imparts more information quickly but it takes longer to construct, while a structured list is easier to create but it will take longer for the threat impacts to become obvious.

# Attacker may be able to read other user’s messages
# User may not have logged off on a shared PC
# Data validation may allow SQL injection
# Implement data validation
# Authorization may fail, allowing unauthorized access
# Implement authorization checks
# Browser cache may contain contents of message
# Implement anti-caching directive in HTTP headers
# If eavesdropping risk is high, use SSL

Note that it takes a motivated attacker to exploit a threat; they generally want something from your application or to obviate controls. To understand the relevant threats, use the following categories to understand who might attack the application:

* '''Accidental Discovery:''' An ordinary user stumbles across a functional mistake in your application, just using a web browser, and gains access to privileged information or functionality.
* '''Automated Malware:''' Programs or scripts, which are searching for known vulnerabilities, and then report them back to a central collection site.
* '''The Curious Attacker:''' a security researcher or ordinary user, who notices something wrong with the application, and decides to pursue further.
* '''Script Kiddies:''' Common renegades, seeking to compromise or deface applications for collateral gain, notoriety, or a political agenda, perhaps using the attack categories described in the ''OWASP Web Application Penetration Checklist.''
* '''The Motivated Attacker:''' Potentially, a disgruntled staff member with inside knowledge or a paid professional attacker.
* '''Organized Crime:''' Criminals seeking high stake payouts, such as cracking e-commerce or corporate banking applications, for financial gain.

It is vital to understand the level of attacker you are defending against. For example, a motivated attacker, who understands your internal processes is often more dangerous than script kiddies.

=== STRIDE ===
STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker). The STRIDE acronym is formed from the first letter of each of the following categories.

'''''Spoofing Identity'''''
“Identity spoofing” is a key risk for applications that have many users but provide a single execution context at the application and database level. In particular, users should not be able to become any other user or assume the attributes of another user.

'''''Tampering with Data'''''
Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth. The application should not send data to the user, such as interest rates or periods, which are obtainable only from within the application itself. The application should also carefully check data received from the user and validate that it is sane and applicable before storing or using it.

'''''Repudiation'''''
Users may dispute transactions if there is insufficient auditing or recordkeeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss.

Therefore, consider if the application requires non-repudiation controls, such as web access logs, audit trails at each tier, or the same user context from top to bottom. Preferably, the application should run with the user’s privileges, not more, but this may not be possible with many off-the-shelf application frameworks.

'''''Information Disclosure'''''
Users are rightfully wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data at large, whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

Also, consider if the user’s web browser may leak information. Some web browsers may ignore the no caching directives in HTTP headers or handle them incorrectly. In a corresponding fashion, every secure application has a responsibility to minimize the amount of information stored by the web browser, just in case it leaks or leaves information behind, which can be used by an attacker to learn details about the application, the user, or to potentially become that user.

Finally, in implementing persistent values, keep in mind that the use of hidden fields is insecure by nature. Such storage should not be relied on to secure sensitive information or to provide adequate personal privacy safeguards.

'''''Denial of Service'''''
Application designers should be aware that their applications may be subject to a denial of service attack. Therefore, the use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users, and not available to anonymous users.

For applications that do not have this luxury, every facet of the application should be engineered to perform as little work as possible, to use fast and few database queries, to avoid exposing large files or unique links per user, in order to prevent simple denial of service attacks.

'''''Elevation of Privilege'''''
If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one. In particular, simply not displaying privileged role links is insufficient. Instead, all actions should be gated through an authorization matrix, to ensure that only the permitted roles can access privileged functionality.

=== DREAD ===
DREAD is a classification scheme for quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. The DREAD acronym is formed from the first letter of each category below.

DREAD modeling influences the thinking behind setting the risk rating, and is also used directly to sort the risks. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.

'''Risk_DREAD''' = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

The calculation always produces a number between 0 and 10; the higher the number, the more serious the risk.

Here are some examples of how to quantify the DREAD categories.

'''''Damage Potential'''''
* If a threat exploit occurs, how much damage will be caused?
**0 = Nothing
**5 = Individual user data is compromised or affected.
**10 = Complete system or data destruction

'''''Reproducibility'''''
* How easy is it to reproduce the threat exploit?
**0 = Very hard or impossible, even for administrators of the application.
**5 = One or two steps required, may need to be an authorized user.
**10 = Just a web browser and the address bar is sufficient, without authentication.

'''''Exploitability'''''
* What is needed to exploit this threat?
**0 = Advanced programming and networking knowledge, with custom or advanced attack tools.
**5 = Malware exists on the Internet, or an exploit is easily performed, using available attack tools.
**10 = Just a web browser

'''''Affected Users'''''
* How many users will be affected?
**0 = None
**5 = Some users, but not all
**10 = All users

'''''Discoverability'''''
* How easy is it to discover this threat?
**0 = Very hard to impossible; requires source code or administrative access.
**5 = Can figure it out by guessing or by monitoring network traces.
**9 = Details of faults like this are already in the public domain and can be easily discovered using a search engine.
**10 = The information is visible in the web browser address bar or in a form.

'''Note:''' When performing a security review of an existing application, “Discoverability” will often be set to 10 by convention, as it is assumed the threat issues will be discovered.

'''Note:''' Using DREAD can be difficult at first. It may be helpful to think of Damage Potential and Affected Users in terms of Impact, while thinking of Reproducibility, Exploitability, and Discoverability in terms of Probability. Using the Impact vs Probability approach (which follows best practices such as defined in NIST-800-30), I would alter the formula to make the Impact score equal to the Probability score. Otherwise the probability scores have more weight in the total.

== Alternative Threat Modeling Systems ==
OWASP recognizes that the adoption of the Microsoft modeling process may not fit all organizations. If STRIDE and DREAD are unacceptable for some reason, we recommend that your organization “dry run” the other threat risk models discussed against an existing application or design. This will allow you to determine which approach works best for you, and to adopt the most appropriate threat modeling tools for your organization.

'''In summary, performing threat modeling provides a far greater return than most any other control in this Guide. Therefore, make threat risk modeling an early priority in your application design process.'''

=== Trike ===
Trike is a threat modeling framework with similarities to the Microsoft threat modeling processes. However, Trike differs because it uses a risk based approach with distinct implementation, threat, and risk models, instead of using the STRIDE/DREAD aggregated threat model (attacks, threats, and weaknesses).
From the Trike paper, Trike’s goals are:
* With assistance from the system stakeholders, to ensure that the risk this system entails to each asset is acceptable to all stakeholders.
* Be able to tell whether we have done this.
* Communicate what we’ve done and its effects to the stakeholders.
* Empower stakeholders to understand and reduce the risks to them and other stakeholders implied by their actions within their domains.

For more information on Trike, please see Section 6.9, reference 8.

=== AS/NZS 4360:2004 Risk Management ===
The Australian/New Zealand Standard AS/NZS 4360, first issued in 1999, and revised in 2004, is the world’s first formal standard for documenting and managing risk and is still one of the few formal standards for managing it.
The standard’s approach is simple (it’s only 28 pages long), flexible, and iterative. Furthermore, it does not lock organizations into a particular risk management methodology, provided the methodology fulfils the AS/NZS 4360 five steps. It also provides several sets of risk tables as examples, and allows organizations to freely develop and adopt their own.

'''The five steps of the AS/NZS 4360 process are:'''
* '''Establish Context:''' Establish the risk domain, i.e., which assets/systems are important?
* '''Identify the Risks:''' Within the risk domain, what specific risks are apparent?
* '''Analyze the Risks:''' Look at the risks and determine if there are any supporting controls in place.
* '''Evaluate the Risks:''' Determine the residual risk.
* '''Treat the Risks:''' Describe the method to treat the risks so that risks selected by the business will be mitigated.
AS/NZS 4360 assumes that risk will be managed by an '''''operational risk group''''', and that the organization has adequate skills and risk management resources in house to identify, analyze, and treat the risks.

'''The advantages of AS/NZS 4360:'''
* AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.
* AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as just using likelihood and consequence to determine an overall risk.
* AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS/NZS 4360 compatible approach.
* You are an Australian organization, and may be required to use it if you are audited on a regular basis, or to justify why you aren’t using it. Luckily, the STRIDE/DREAD model discussed earlier is AS/NZS 4360 compatible.

'''The limitations of AS/NZS 4360:'''
* The AS/NZS 4360 approach works best for business or systemic risks than for technical risks.
* AS/NZS 4360 does not define the methodology to perform a structured threat risk modeling exercise.
* As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.
Although AS/NZS 4360 may be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methodologies described earlier.

=== CVSS ===
The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco Systems, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the group’s outputs is the Common '''''Vulnerability Scoring System (CVSS).'''''

'''The advantages of CVSS:'''
* You have just received notification from a security researcher or other source that your product has vulnerability, and you wish to ensure that it has an accurate and normalized severity rating, so as to alert your customers to the appropriate level of action required when you release the patch.
* You are a security researcher, and have found several threat exploits within an application. You would like to use the CVSS ranking system to produce reliable risk rankings, to ensure that the ISV will take the exploits seriously as indicated by their rating.
* CVSS has been recommended by the working group for use by US Government departments. However, it is unclear if it will become policy or be widely adopted at the time of this writing.

'''The limitations of CVSS:'''
* CVSS does not find or reduce the attack surface area (i.e. design flaws), or help enumerate risks within any arbitrary piece of code, as it is just a scoring system, not a modeling methodology.
* CVSS is more complex than STRIDE/DREAD, as it aims to calculate the risk of announced vulnerabilities as applied to deployed software and environmental factors.
* The CVSS risk ranking is complex – a spreadsheet is required to calculate the risk components as the assumption behind CVSS is that a specific vulnerability has been identified and announced, or a worm or Trojan has been released targeting a small number of attack vectors.
* The overhead of calculating the CVSS risk ranking is quite high if applied to a thorough code review, which may have 250 or more threats to rank.

=== OCTAVE ===
OCTAVE is a heavyweight risk methodology approach originating from Carnegie Mellon University’s Software Engineering Institute (SEI) in collaboration with CERT. OCTAVE focuses on organizational risk, not technical risk.
OCTAVE comes in two versions: Full OCTAVE, for large organizations, and OCTAVE-S for small organizations, both of which have specific catalogs of practices, profiles, and worksheets to document the modeling outcomes.

'''OCTAVE is popular with many sites and is useful when:'''
* Implementing an organizational culture of risk management and controls becomes necessary.
* Documenting and measuring business risk becomes timely.
* Documenting and measuring the overall IT security risk, particularly as it relates to the corporate IT risk management, becomes necessary.
* When documenting risks surrounding complete systems becomes necessary.
* To accommodate a fundamental reorganization, such as when an organization does not have a working risk methodology in place, and requires a robust risk management framework to be put in place.

'''The limitations of OCTAVE are:'''
* OCTAVE is incompatible with AS/NZS 4360, as it mandates Likelihood = 1 (i.e., It assumes a threat will always occur) and this is inappropriate for many organizations. OCTAVE-S makes the inclusion of this probability optional, but this is not part of the more comprehensive OCTAVE standard.
* Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement.
* It does not provide a list of “out of the box” practices for assessing and mitigating web application security risks.

Because of these issues, OWASP does not anticipate that OCTAVE will be used at large by application designers or developers, because it fails to take threat risk modeling into consideration, which is useful during all stages of development, by all participants, to reduce the overall risk of an application becoming vulnerable to attack.

== Conclusion ==
In this chapter, we have touched on the basic principles of threat risk modeling, risk management, and web application security. Applications that leverage the underlying intent of these principles will be more secure than their counterparts, which will only be minimally compliant just by including specific controls.

== Further Reading ==
* [http://www.microsoft.com/downloads/details.aspx?familyid=334AD466-8B53-4440-8FF0-6AC8142D9198&displaylang=en Threat Analysis & Modeling v2.0], © Microsoft Corporation, 2006.
* [http://msdn.microsoft.com/library/ms978516.aspx Threat Modeling Web Applications], J.D. Meier, Alex Mackman, Blaine Wastell, © Microsoft Corporation, May 2005.
* [http://msdn.microsoft.com/library/ms994921.aspx Improving Web Application Security: Threats and Countermeasures], J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan, © Microsoft Corporation, June 2003.
* [http://www.microsoft.com/downloads/details.aspx?FamilyID=62830f95-0e61-4f87-88a6-e7c663444ac1&displaylang=en Threat Modeling], Frank Swiderski and Window Snyder, Microsoft Press, June 2004, ISBN 0-7356-1991-3.
* Writing Secure Code, 2nd Edition, Howard and LeBlanc, (pp. 69 – 124), Microsoft Press, 2003, ISBN 0-7356-1722-8.
* [http://msdn.microsoft.com/library/ms954176.aspx The STRIDE Threat Model], © Microsoft Corporation, 2005.
* [http://blogs.msdn.com/david_leblanc/archive/2007/08/13/dreadful.aspx DREADful] - the DREAD system, © Microsoft Corporation, 2005.
* [http://dymaxion.org/trike/Trike_v1_Methodology_Document-draft.pdf A Conceptual Model for Threat Modeling Applications], Saitta, Larcom, and Michael Eddington, July 2005, http://dymaxion.org/trike/.
* [http://www.standards.co.nz/web-shop/?action=viewSearchProduct&mod=catalog&pid=4360:2004(AS|NZS) AS/NZS 4360:2004 Risk Management], Standards Australia and Standards New Zealand.
* [http://www.dhs.gov/interweb/assetlibrary/NIAC_CyberVulnerabilitiesPaper_Feb05.pdf CVSS], U.S. Department of Homeland Security library, February 2005.
* [http://www.cert.org/octave/ OCTAVE], CERT library.

== Appendix: Alternative open-source Risk Management tools ==
* [http://sourceforge.net/projects/osmr/ OSMR]
* [http://sourceforge.net/projects/marco/ MARCO]
* [http://sourceforge.net/projects/coras/ CORAS Risk Assessment Platform]
* [http://sourceforge.net/projects/ratiso17799/ ISO 17799 Risk Assessment Toolkit]
* [http://sourceforge.net/projects/easy-tra/ Easy Threat Risk Assessment]
* [http://sourceforge.net/projects/arms-17799/ ARMS]
* [http://sourceforge.net/projects/minaccia/ Minaccia]
* [http://sourceforge.net/projects/threatmind/ ThreatMind]
* [http://sourceforge.net/projects/osrmt/ Open Source Requirements Management Tool]

== Reference ==
[[Guide Table of Contents]]

[[Category:OWASP_Guide_Project]]
[[Category:Activity]]

Threat Risk Modeling

2008-08-11T20:24:56Z

ParanoidMike: /* Further Reading */ reformatting external links

__TOC__
When you start a web application design, it is essential to apply threat risk modeling; otherwise you will squander resources, time and money on useless controls that fail to focus on the real risks.

The method used to assess risk is not nearly as important as actually performing a structured threat risk modeling. Microsoft notes that the single most important factor in their security improvement program was the corporate adoption of threat risk modeling.

OWASP recommends Microsoft’s threat modeling process because it works well for addressing the unique challenges facing web application security and is simple to learn and adopt by designers, developers, code reviewers, and the quality assurance team.

The following sections provide some overview information (or see Section 6.9, Further Reading, for additional resources).

== Threat Risk Modeling ==
Threat risk modeling is an essential process for secure web application development. It allows organizations to determine the correct controls and to produce effective countermeasures within budget. For example, there is little point in spending $100,000 for fraud control for a system that has negligible fraud risk.

== Performing threat risk modeling using the Microsoft Threat Modeling Process ==
The threat risk modeling process has five steps, enumerated below and shown graphically in Figure 1. They are:
# Identify Security Objectives
# Survey the Application
# Decompose it
# Identify Threats
# Identify Vulnerabilities

[[Image:Threat_Model_Flow.gif|Figure 1: Threat Model Flow]]

Let’s consider the steps in more detail.

=== Identify Security Objectives ===
The business (or project management) leadership, in concert with the software development and quality assurance teams, all need to understand the security objectives. To facilitate this, start by breaking down the application’s security objectives into the following categories:

* '''Identity:''' Does the application protect user identity from abuse? Are there adequate controls in place to ensure evidence of identity (as required for many banking applications?)
* '''Financial:''' Assess the level of risk the organization is prepared to absorb in remediation, as a potential financial loss. For example, forum software may have a lower estimated financial risk than an Internet banking application.
* '''Reputation:''' Quantify or estimate of the loss of reputation derived from the application being misused or successfully attacked.
* '''Privacy and Regulatory:''' To what extent will the application have to protect user data? Forum software by its nature is public, but a tax preparation application is subject to tax regulations and privacy legislation requirements in most countries.
* '''Availability Guarantees:''' Is the application required to be available per a '''''Service Level Agreement (SLA)''''' or similar guarantee? Is it a nationally protected infrastructure? To what level will the application have to be available? High availability techniques are significantly more expensive, so applying the correct controls up front will save a great deal of time, resources, and money.

This is by no means an exhaustive list, but it gives an idea of some of the business risk decisions leading into selecting and building security controls.

Other sources of risk guidance come from:
* Laws (such as privacy or finance laws)
* Regulations (such as banking or e-commerce regulations)
* Standards (such as ISO 17799)
* Legal Agreements (such as payment card industry standards or merchant agreements)
* Corporate Information Security Policy

=== Application Overview ===
Once the security objectives have been defined, analyze the application design to identify the '''''components''''', '''''data flows''''', and '''''trust boundaries'''''.

Do this by surveying the application’s architecture and design documentation. In particular, look for UML component diagrams. Such high level component diagrams are generally sufficient to understand how and why data flows to various places. For example, data movement across a trust boundary (such as from the Internet to the web tier, or from the business logic to the database server), needs to be carefully analyzed, whereas data that flows within the same trust level does not need as much scrutiny.

=== Decompose Application ===
Once the application architecture is understood then decompose it further, to identify the features and modules with a security impact that need to be evaluated. For example, when investigating the authentication module, it is necessary to understand how data enters the module, how the module validates and processes the data, where the data flows, how the data is stored, and what fundamental decisions and assumptions are made by the module.

=== Identify Threats ===
It is impossible to write down unknown threats, but it is likewise unlikely that new malware will be created to exploit new vulnerabilities within custom systems. Therefore, concentrate on known risks, which can be easily demonstrated using tools or techniques from Bugtraq.

Microsoft suggests two different approaches for writing up threats. One is a threat graph, as shown in Figure 2, and the other is a structured list, as shown in Figure 3.

[[Image:Threat_Graph.gif|Figure 2: Threat Graph]]

Typically, a threat graph imparts more information quickly but it takes longer to construct, while a structured list is easier to create but it will take longer for the threat impacts to become obvious.

# Attacker may be able to read other user’s messages
# User may not have logged off on a shared PC
# Data validation may allow SQL injection
# Implement data validation
# Authorization may fail, allowing unauthorized access
# Implement authorization checks
# Browser cache may contain contents of message
# Implement anti-caching directive in HTTP headers
# If eavesdropping risk is high, use SSL

Note that it takes a motivated attacker to exploit a threat; they generally want something from your application or to obviate controls. To understand the relevant threats, use the following categories to understand who might attack the application:

* '''Accidental Discovery:''' An ordinary user stumbles across a functional mistake in your application, just using a web browser, and gains access to privileged information or functionality.
* '''Automated Malware:''' Programs or scripts, which are searching for known vulnerabilities, and then report them back to a central collection site.
* '''The Curious Attacker:''' a security researcher or ordinary user, who notices something wrong with the application, and decides to pursue further.
* '''Script Kiddies:''' Common renegades, seeking to compromise or deface applications for collateral gain, notoriety, or a political agenda, perhaps using the attack categories described in the ''OWASP Web Application Penetration Checklist.''
* '''The Motivated Attacker:''' Potentially, a disgruntled staff member with inside knowledge or a paid professional attacker.
* '''Organized Crime:''' Criminals seeking high stake payouts, such as cracking e-commerce or corporate banking applications, for financial gain.

It is vital to understand the level of attacker you are defending against. For example, a motivated attacker, who understands your internal processes is often more dangerous than script kiddies.

=== STRIDE ===
STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker). The STRIDE acronym is formed from the first letter of each of the following categories.

'''''Spoofing Identity'''''
“Identity spoofing” is a key risk for applications that have many users but provide a single execution context at the application and database level. In particular, users should not be able to become any other user or assume the attributes of another user.

'''''Tampering with Data'''''
Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth. The application should not send data to the user, such as interest rates or periods, which are obtainable only from within the application itself. The application should also carefully check data received from the user and validate that it is sane and applicable before storing or using it.

'''''Repudiation'''''
Users may dispute transactions if there is insufficient auditing or recordkeeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss.

Therefore, consider if the application requires non-repudiation controls, such as web access logs, audit trails at each tier, or the same user context from top to bottom. Preferably, the application should run with the user’s privileges, not more, but this may not be possible with many off-the-shelf application frameworks.

'''''Information Disclosure'''''
Users are rightfully wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data at large, whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

Also, consider if the user’s web browser may leak information. Some web browsers may ignore the no caching directives in HTTP headers or handle them incorrectly. In a corresponding fashion, every secure application has a responsibility to minimize the amount of information stored by the web browser, just in case it leaks or leaves information behind, which can be used by an attacker to learn details about the application, the user, or to potentially become that user.

Finally, in implementing persistent values, keep in mind that the use of hidden fields is insecure by nature. Such storage should not be relied on to secure sensitive information or to provide adequate personal privacy safeguards.

'''''Denial of Service'''''
Application designers should be aware that their applications may be subject to a denial of service attack. Therefore, the use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users, and not available to anonymous users.

For applications that do not have this luxury, every facet of the application should be engineered to perform as little work as possible, to use fast and few database queries, to avoid exposing large files or unique links per user, in order to prevent simple denial of service attacks.

'''''Elevation of Privilege'''''
If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one. In particular, simply not displaying privileged role links is insufficient. Instead, all actions should be gated through an authorization matrix, to ensure that only the permitted roles can access privileged functionality.

=== DREAD ===
DREAD is a classification scheme for quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. The DREAD acronym is formed from the first letter of each category below.

DREAD modeling influences the thinking behind setting the risk rating, and is also used directly to sort the risks. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.

'''Risk_DREAD''' = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

The calculation always produces a number between 0 and 10; the higher the number, the more serious the risk.

Here are some examples of how to quantify the DREAD categories.

'''''Damage Potential'''''
* If a threat exploit occurs, how much damage will be caused?
**0 = Nothing
**5 = Individual user data is compromised or affected.
**10 = Complete system or data destruction

'''''Reproducibility'''''
* How easy is it to reproduce the threat exploit?
**0 = Very hard or impossible, even for administrators of the application.
**5 = One or two steps required, may need to be an authorized user.
**10 = Just a web browser and the address bar is sufficient, without authentication.

'''''Exploitability'''''
* What is needed to exploit this threat?
**0 = Advanced programming and networking knowledge, with custom or advanced attack tools.
**5 = Malware exists on the Internet, or an exploit is easily performed, using available attack tools.
**10 = Just a web browser

'''''Affected Users'''''
* How many users will be affected?
**0 = None
**5 = Some users, but not all
**10 = All users

'''''Discoverability'''''
* How easy is it to discover this threat?
**0 = Very hard to impossible; requires source code or administrative access.
**5 = Can figure it out by guessing or by monitoring network traces.
**9 = Details of faults like this are already in the public domain and can be easily discovered using a search engine.
**10 = The information is visible in the web browser address bar or in a form.

'''Note:''' When performing a security review of an existing application, “Discoverability” will often be set to 10 by convention, as it is assumed the threat issues will be discovered.

'''Note:''' Using DREAD can be difficult at first. It may be helpful to think of Damage Potential and Affected Users in terms of Impact, while thinking of Reproducibility, Exploitability, and Discoverability in terms of Probability. Using the Impact vs Probability approach (which follows best practices such as defined in NIST-800-30), I would alter the formula to make the Impact score equal to the Probability score. Otherwise the probability scores have more weight in the total.

== Alternative Threat Modeling Systems ==
OWASP recognizes that the adoption of the Microsoft modeling process may not fit all organizations. If STRIDE and DREAD are unacceptable for some reason, we recommend that your organization “dry run” the other threat risk models discussed against an existing application or design. This will allow you to determine which approach works best for you, and to adopt the most appropriate threat modeling tools for your organization.

'''In summary, performing threat modeling provides a far greater return than most any other control in this Guide. Therefore, make threat risk modeling an early priority in your application design process.'''

=== Trike ===
Trike is a threat modeling framework with similarities to the Microsoft threat modeling processes. However, Trike differs because it uses a risk based approach with distinct implementation, threat, and risk models, instead of using the STRIDE/DREAD aggregated threat model (attacks, threats, and weaknesses).
From the Trike paper, Trike’s goals are:
* With assistance from the system stakeholders, to ensure that the risk this system entails to each asset is acceptable to all stakeholders.
* Be able to tell whether we have done this.
* Communicate what we’ve done and its effects to the stakeholders.
* Empower stakeholders to understand and reduce the risks to them and other stakeholders implied by their actions within their domains.

For more information on Trike, please see Section 6.9, reference 8.

=== AS/NZS 4360:2004 Risk Management ===
The Australian/New Zealand Standard AS/NZS 4360, first issued in 1999, and revised in 2004, is the world’s first formal standard for documenting and managing risk and is still one of the few formal standards for managing it.
The standard’s approach is simple (it’s only 28 pages long), flexible, and iterative. Furthermore, it does not lock organizations into a particular risk management methodology, provided the methodology fulfils the AS/NZS 4360 five steps. It also provides several sets of risk tables as examples, and allows organizations to freely develop and adopt their own.

'''The five steps of the AS/NZS 4360 process are:'''
* '''Establish Context:''' Establish the risk domain, i.e., which assets/systems are important?
* '''Identify the Risks:''' Within the risk domain, what specific risks are apparent?
* '''Analyze the Risks:''' Look at the risks and determine if there are any supporting controls in place.
* '''Evaluate the Risks:''' Determine the residual risk.
* '''Treat the Risks:''' Describe the method to treat the risks so that risks selected by the business will be mitigated.
AS/NZS 4360 assumes that risk will be managed by an '''''operational risk group''''', and that the organization has adequate skills and risk management resources in house to identify, analyze, and treat the risks.

'''The advantages of AS/NZS 4360:'''
* AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.
* AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as just using likelihood and consequence to determine an overall risk.
* AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS/NZS 4360 compatible approach.
* You are an Australian organization, and may be required to use it if you are audited on a regular basis, or to justify why you aren’t using it. Luckily, the STRIDE/DREAD model discussed earlier is AS/NZS 4360 compatible.

'''The limitations of AS/NZS 4360:'''
* The AS/NZS 4360 approach works best for business or systemic risks than for technical risks.
* AS/NZS 4360 does not define the methodology to perform a structured threat risk modeling exercise.
* As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.
Although AS/NZS 4360 may be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methodologies described earlier.

=== CVSS ===
The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco Systems, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the group’s outputs is the Common '''''Vulnerability Scoring System (CVSS).'''''

'''The advantages of CVSS:'''
* You have just received notification from a security researcher or other source that your product has vulnerability, and you wish to ensure that it has an accurate and normalized severity rating, so as to alert your customers to the appropriate level of action required when you release the patch.
* You are a security researcher, and have found several threat exploits within an application. You would like to use the CVSS ranking system to produce reliable risk rankings, to ensure that the ISV will take the exploits seriously as indicated by their rating.
* CVSS has been recommended by the working group for use by US Government departments. However, it is unclear if it will become policy or be widely adopted at the time of this writing.

'''The limitations of CVSS:'''
* CVSS does not find or reduce the attack surface area (i.e. design flaws), or help enumerate risks within any arbitrary piece of code, as it is just a scoring system, not a modeling methodology.
* CVSS is more complex than STRIDE/DREAD, as it aims to calculate the risk of announced vulnerabilities as applied to deployed software and environmental factors.
* The CVSS risk ranking is complex – a spreadsheet is required to calculate the risk components as the assumption behind CVSS is that a specific vulnerability has been identified and announced, or a worm or Trojan has been released targeting a small number of attack vectors.
* The overhead of calculating the CVSS risk ranking is quite high if applied to a thorough code review, which may have 250 or more threats to rank.

=== OCTAVE ===
OCTAVE is a heavyweight risk methodology approach originating from Carnegie Mellon University’s Software Engineering Institute (SEI) in collaboration with CERT. OCTAVE focuses on organizational risk, not technical risk.
OCTAVE comes in two versions: Full OCTAVE, for large organizations, and OCTAVE-S for small organizations, both of which have specific catalogs of practices, profiles, and worksheets to document the modeling outcomes.

'''OCTAVE is popular with many sites and is useful when:'''
* Implementing an organizational culture of risk management and controls becomes necessary.
* Documenting and measuring business risk becomes timely.
* Documenting and measuring the overall IT security risk, particularly as it relates to the corporate IT risk management, becomes necessary.
* When documenting risks surrounding complete systems becomes necessary.
* To accommodate a fundamental reorganization, such as when an organization does not have a working risk methodology in place, and requires a robust risk management framework to be put in place.

'''The limitations of OCTAVE are:'''
* OCTAVE is incompatible with AS/NZS 4360, as it mandates Likelihood = 1 (i.e., It assumes a threat will always occur) and this is inappropriate for many organizations. OCTAVE-S makes the inclusion of this probability optional, but this is not part of the more comprehensive OCTAVE standard.
* Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement.
* It does not provide a list of “out of the box” practices for assessing and mitigating web application security risks.

Because of these issues, OWASP does not anticipate that OCTAVE will be used at large by application designers or developers, because it fails to take threat risk modeling into consideration, which is useful during all stages of development, by all participants, to reduce the overall risk of an application becoming vulnerable to attack.

== Conclusion ==
In this chapter, we have touched on the basic principles of threat risk modeling, risk management, and web application security. Applications that leverage the underlying intent of these principles will be more secure than their counterparts, which will only be minimally compliant just by including specific controls.

== Further Reading ==
* [http://www.microsoft.com/downloads/details.aspx?familyid=334AD466-8B53-4440-8FF0-6AC8142D9198&displaylang=en Threat Analysis & Modeling v2.0], © Microsoft Corporation, 2006.
* [http://msdn.microsoft.com/library/ms978516.aspx Threat Modeling Web Applications], J.D. Meier, Alex Mackman, Blaine Wastell, © Microsoft Corporation, May 2005.
* [http://msdn.microsoft.com/library/ms994921.aspx Improving Web Application Security: Threats and Countermeasures], J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan, © Microsoft Corporation, June 2003.
* [http://www.microsoft.com/downloads/details.aspx?FamilyID=62830f95-0e61-4f87-88a6-e7c663444ac1&displaylang=en Threat Modeling], Frank Swiderski and Window Snyder, Microsoft Press, June 2004, ISBN 0-7356-1991-3.
* Writing Secure Code, 2nd Edition, Howard and LeBlanc, (pp. 69 – 124), Microsoft Press, 2003, ISBN 0-7356-1722-8.
* [http://msdn.microsoft.com/library/ms954176.aspx The STRIDE Threat Model], © Microsoft Corporation, 2005.
* [http://blogs.msdn.com/david_leblanc/archive/2007/08/13/dreadful.aspx DREADful] - the DREAD system, © Microsoft Corporation, 2005.
* [http://dymaxion.org/trike/Trike_v1_Methodology_Document-draft.pdf A Conceptual Model for Threat Modeling Applications], Saitta, Larcom, and Michael Eddington, July 2005, http://dymaxion.org/trike/.
* [http://www.standards.co.nz/web-shop/?action=viewSearchProduct&mod=catalog&pid=4360:2004(AS|NZS) AS/NZS 4360:2004 Risk Management], Standards Australia and Standards New Zealand.
* [http://www.dhs.gov/interweb/assetlibrary/NIAC_CyberVulnerabilitiesPaper_Feb05.pdf CVSS], U.S. Department of Homeland Security library, February 2005.
* [http://www.cert.org/octave/ OCTAVE], CERT library.

== Reference ==
[[Guide Table of Contents]]

[[Category:OWASP_Guide_Project]]
[[Category:Activity]]

Threat Risk Modeling

2008-08-11T20:17:06Z

ParanoidMike: further formatting cleanup

__TOC__
When you start a web application design, it is essential to apply threat risk modeling; otherwise you will squander resources, time and money on useless controls that fail to focus on the real risks.

The method used to assess risk is not nearly as important as actually performing a structured threat risk modeling. Microsoft notes that the single most important factor in their security improvement program was the corporate adoption of threat risk modeling.

OWASP recommends Microsoft’s threat modeling process because it works well for addressing the unique challenges facing web application security and is simple to learn and adopt by designers, developers, code reviewers, and the quality assurance team.

The following sections provide some overview information (or see Section 6.9, Further Reading, for additional resources).

== Threat Risk Modeling ==
Threat risk modeling is an essential process for secure web application development. It allows organizations to determine the correct controls and to produce effective countermeasures within budget. For example, there is little point in spending $100,000 for fraud control for a system that has negligible fraud risk.

== Performing threat risk modeling using the Microsoft Threat Modeling Process ==
The threat risk modeling process has five steps, enumerated below and shown graphically in Figure 1. They are:
# Identify Security Objectives
# Survey the Application
# Decompose it
# Identify Threats
# Identify Vulnerabilities

[[Image:Threat_Model_Flow.gif|Figure 1: Threat Model Flow]]

Let’s consider the steps in more detail.

=== Identify Security Objectives ===
The business (or project management) leadership, in concert with the software development and quality assurance teams, all need to understand the security objectives. To facilitate this, start by breaking down the application’s security objectives into the following categories:

* '''Identity:''' Does the application protect user identity from abuse? Are there adequate controls in place to ensure evidence of identity (as required for many banking applications?)
* '''Financial:''' Assess the level of risk the organization is prepared to absorb in remediation, as a potential financial loss. For example, forum software may have a lower estimated financial risk than an Internet banking application.
* '''Reputation:''' Quantify or estimate of the loss of reputation derived from the application being misused or successfully attacked.
* '''Privacy and Regulatory:''' To what extent will the application have to protect user data? Forum software by its nature is public, but a tax preparation application is subject to tax regulations and privacy legislation requirements in most countries.
* '''Availability Guarantees:''' Is the application required to be available per a '''''Service Level Agreement (SLA)''''' or similar guarantee? Is it a nationally protected infrastructure? To what level will the application have to be available? High availability techniques are significantly more expensive, so applying the correct controls up front will save a great deal of time, resources, and money.

This is by no means an exhaustive list, but it gives an idea of some of the business risk decisions leading into selecting and building security controls.

Other sources of risk guidance come from:
* Laws (such as privacy or finance laws)
* Regulations (such as banking or e-commerce regulations)
* Standards (such as ISO 17799)
* Legal Agreements (such as payment card industry standards or merchant agreements)
* Corporate Information Security Policy

=== Application Overview ===
Once the security objectives have been defined, analyze the application design to identify the '''''components''''', '''''data flows''''', and '''''trust boundaries'''''.

Do this by surveying the application’s architecture and design documentation. In particular, look for UML component diagrams. Such high level component diagrams are generally sufficient to understand how and why data flows to various places. For example, data movement across a trust boundary (such as from the Internet to the web tier, or from the business logic to the database server), needs to be carefully analyzed, whereas data that flows within the same trust level does not need as much scrutiny.

=== Decompose Application ===
Once the application architecture is understood then decompose it further, to identify the features and modules with a security impact that need to be evaluated. For example, when investigating the authentication module, it is necessary to understand how data enters the module, how the module validates and processes the data, where the data flows, how the data is stored, and what fundamental decisions and assumptions are made by the module.

=== Identify Threats ===
It is impossible to write down unknown threats, but it is likewise unlikely that new malware will be created to exploit new vulnerabilities within custom systems. Therefore, concentrate on known risks, which can be easily demonstrated using tools or techniques from Bugtraq.

Microsoft suggests two different approaches for writing up threats. One is a threat graph, as shown in Figure 2, and the other is a structured list, as shown in Figure 3.

[[Image:Threat_Graph.gif|Figure 2: Threat Graph]]

Typically, a threat graph imparts more information quickly but it takes longer to construct, while a structured list is easier to create but it will take longer for the threat impacts to become obvious.

# Attacker may be able to read other user’s messages
# User may not have logged off on a shared PC
# Data validation may allow SQL injection
# Implement data validation
# Authorization may fail, allowing unauthorized access
# Implement authorization checks
# Browser cache may contain contents of message
# Implement anti-caching directive in HTTP headers
# If eavesdropping risk is high, use SSL

Note that it takes a motivated attacker to exploit a threat; they generally want something from your application or to obviate controls. To understand the relevant threats, use the following categories to understand who might attack the application:

* '''Accidental Discovery:''' An ordinary user stumbles across a functional mistake in your application, just using a web browser, and gains access to privileged information or functionality.
* '''Automated Malware:''' Programs or scripts, which are searching for known vulnerabilities, and then report them back to a central collection site.
* '''The Curious Attacker:''' a security researcher or ordinary user, who notices something wrong with the application, and decides to pursue further.
* '''Script Kiddies:''' Common renegades, seeking to compromise or deface applications for collateral gain, notoriety, or a political agenda, perhaps using the attack categories described in the ''OWASP Web Application Penetration Checklist.''
* '''The Motivated Attacker:''' Potentially, a disgruntled staff member with inside knowledge or a paid professional attacker.
* '''Organized Crime:''' Criminals seeking high stake payouts, such as cracking e-commerce or corporate banking applications, for financial gain.

It is vital to understand the level of attacker you are defending against. For example, a motivated attacker, who understands your internal processes is often more dangerous than script kiddies.

=== STRIDE ===
STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker). The STRIDE acronym is formed from the first letter of each of the following categories.

'''''Spoofing Identity'''''
“Identity spoofing” is a key risk for applications that have many users but provide a single execution context at the application and database level. In particular, users should not be able to become any other user or assume the attributes of another user.

'''''Tampering with Data'''''
Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth. The application should not send data to the user, such as interest rates or periods, which are obtainable only from within the application itself. The application should also carefully check data received from the user and validate that it is sane and applicable before storing or using it.

'''''Repudiation'''''
Users may dispute transactions if there is insufficient auditing or recordkeeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss.

Therefore, consider if the application requires non-repudiation controls, such as web access logs, audit trails at each tier, or the same user context from top to bottom. Preferably, the application should run with the user’s privileges, not more, but this may not be possible with many off-the-shelf application frameworks.

'''''Information Disclosure'''''
Users are rightfully wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data at large, whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

Also, consider if the user’s web browser may leak information. Some web browsers may ignore the no caching directives in HTTP headers or handle them incorrectly. In a corresponding fashion, every secure application has a responsibility to minimize the amount of information stored by the web browser, just in case it leaks or leaves information behind, which can be used by an attacker to learn details about the application, the user, or to potentially become that user.

Finally, in implementing persistent values, keep in mind that the use of hidden fields is insecure by nature. Such storage should not be relied on to secure sensitive information or to provide adequate personal privacy safeguards.

'''''Denial of Service'''''
Application designers should be aware that their applications may be subject to a denial of service attack. Therefore, the use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users, and not available to anonymous users.

For applications that do not have this luxury, every facet of the application should be engineered to perform as little work as possible, to use fast and few database queries, to avoid exposing large files or unique links per user, in order to prevent simple denial of service attacks.

'''''Elevation of Privilege'''''
If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one. In particular, simply not displaying privileged role links is insufficient. Instead, all actions should be gated through an authorization matrix, to ensure that only the permitted roles can access privileged functionality.

=== DREAD ===
DREAD is a classification scheme for quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. The DREAD acronym is formed from the first letter of each category below.

DREAD modeling influences the thinking behind setting the risk rating, and is also used directly to sort the risks. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.

'''Risk_DREAD''' = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

The calculation always produces a number between 0 and 10; the higher the number, the more serious the risk.

Here are some examples of how to quantify the DREAD categories.

'''''Damage Potential'''''
* If a threat exploit occurs, how much damage will be caused?
**0 = Nothing
**5 = Individual user data is compromised or affected.
**10 = Complete system or data destruction

'''''Reproducibility'''''
* How easy is it to reproduce the threat exploit?
**0 = Very hard or impossible, even for administrators of the application.
**5 = One or two steps required, may need to be an authorized user.
**10 = Just a web browser and the address bar is sufficient, without authentication.

'''''Exploitability'''''
* What is needed to exploit this threat?
**0 = Advanced programming and networking knowledge, with custom or advanced attack tools.
**5 = Malware exists on the Internet, or an exploit is easily performed, using available attack tools.
**10 = Just a web browser

'''''Affected Users'''''
* How many users will be affected?
**0 = None
**5 = Some users, but not all
**10 = All users

'''''Discoverability'''''
* How easy is it to discover this threat?
**0 = Very hard to impossible; requires source code or administrative access.
**5 = Can figure it out by guessing or by monitoring network traces.
**9 = Details of faults like this are already in the public domain and can be easily discovered using a search engine.
**10 = The information is visible in the web browser address bar or in a form.

'''Note:''' When performing a security review of an existing application, “Discoverability” will often be set to 10 by convention, as it is assumed the threat issues will be discovered.

'''Note:''' Using DREAD can be difficult at first. It may be helpful to think of Damage Potential and Affected Users in terms of Impact, while thinking of Reproducibility, Exploitability, and Discoverability in terms of Probability. Using the Impact vs Probability approach (which follows best practices such as defined in NIST-800-30), I would alter the formula to make the Impact score equal to the Probability score. Otherwise the probability scores have more weight in the total.

== Alternative Threat Modeling Systems ==
OWASP recognizes that the adoption of the Microsoft modeling process may not fit all organizations. If STRIDE and DREAD are unacceptable for some reason, we recommend that your organization “dry run” the other threat risk models discussed against an existing application or design. This will allow you to determine which approach works best for you, and to adopt the most appropriate threat modeling tools for your organization.

'''In summary, performing threat modeling provides a far greater return than most any other control in this Guide. Therefore, make threat risk modeling an early priority in your application design process.'''

=== Trike ===
Trike is a threat modeling framework with similarities to the Microsoft threat modeling processes. However, Trike differs because it uses a risk based approach with distinct implementation, threat, and risk models, instead of using the STRIDE/DREAD aggregated threat model (attacks, threats, and weaknesses).
From the Trike paper, Trike’s goals are:
* With assistance from the system stakeholders, to ensure that the risk this system entails to each asset is acceptable to all stakeholders.
* Be able to tell whether we have done this.
* Communicate what we’ve done and its effects to the stakeholders.
* Empower stakeholders to understand and reduce the risks to them and other stakeholders implied by their actions within their domains.

For more information on Trike, please see Section 6.9, reference 8.

=== AS/NZS 4360:2004 Risk Management ===
The Australian/New Zealand Standard AS/NZS 4360, first issued in 1999, and revised in 2004, is the world’s first formal standard for documenting and managing risk and is still one of the few formal standards for managing it.
The standard’s approach is simple (it’s only 28 pages long), flexible, and iterative. Furthermore, it does not lock organizations into a particular risk management methodology, provided the methodology fulfils the AS/NZS 4360 five steps. It also provides several sets of risk tables as examples, and allows organizations to freely develop and adopt their own.

'''The five steps of the AS/NZS 4360 process are:'''
* '''Establish Context:''' Establish the risk domain, i.e., which assets/systems are important?
* '''Identify the Risks:''' Within the risk domain, what specific risks are apparent?
* '''Analyze the Risks:''' Look at the risks and determine if there are any supporting controls in place.
* '''Evaluate the Risks:''' Determine the residual risk.
* '''Treat the Risks:''' Describe the method to treat the risks so that risks selected by the business will be mitigated.
AS/NZS 4360 assumes that risk will be managed by an '''''operational risk group''''', and that the organization has adequate skills and risk management resources in house to identify, analyze, and treat the risks.

'''The advantages of AS/NZS 4360:'''
* AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.
* AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as just using likelihood and consequence to determine an overall risk.
* AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS/NZS 4360 compatible approach.
* You are an Australian organization, and may be required to use it if you are audited on a regular basis, or to justify why you aren’t using it. Luckily, the STRIDE/DREAD model discussed earlier is AS/NZS 4360 compatible.

'''The limitations of AS/NZS 4360:'''
* The AS/NZS 4360 approach works best for business or systemic risks than for technical risks.
* AS/NZS 4360 does not define the methodology to perform a structured threat risk modeling exercise.
* As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.
Although AS/NZS 4360 may be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methodologies described earlier.

=== CVSS ===
The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco Systems, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the group’s outputs is the Common '''''Vulnerability Scoring System (CVSS).'''''

'''The advantages of CVSS:'''
* You have just received notification from a security researcher or other source that your product has vulnerability, and you wish to ensure that it has an accurate and normalized severity rating, so as to alert your customers to the appropriate level of action required when you release the patch.
* You are a security researcher, and have found several threat exploits within an application. You would like to use the CVSS ranking system to produce reliable risk rankings, to ensure that the ISV will take the exploits seriously as indicated by their rating.
* CVSS has been recommended by the working group for use by US Government departments. However, it is unclear if it will become policy or be widely adopted at the time of this writing.

'''The limitations of CVSS:'''
* CVSS does not find or reduce the attack surface area (i.e. design flaws), or help enumerate risks within any arbitrary piece of code, as it is just a scoring system, not a modeling methodology.
* CVSS is more complex than STRIDE/DREAD, as it aims to calculate the risk of announced vulnerabilities as applied to deployed software and environmental factors.
* The CVSS risk ranking is complex – a spreadsheet is required to calculate the risk components as the assumption behind CVSS is that a specific vulnerability has been identified and announced, or a worm or Trojan has been released targeting a small number of attack vectors.
* The overhead of calculating the CVSS risk ranking is quite high if applied to a thorough code review, which may have 250 or more threats to rank.

=== OCTAVE ===
OCTAVE is a heavyweight risk methodology approach originating from Carnegie Mellon University’s Software Engineering Institute (SEI) in collaboration with CERT. OCTAVE focuses on organizational risk, not technical risk.
OCTAVE comes in two versions: Full OCTAVE, for large organizations, and OCTAVE-S for small organizations, both of which have specific catalogs of practices, profiles, and worksheets to document the modeling outcomes.

'''OCTAVE is popular with many sites and is useful when:'''
* Implementing an organizational culture of risk management and controls becomes necessary.
* Documenting and measuring business risk becomes timely.
* Documenting and measuring the overall IT security risk, particularly as it relates to the corporate IT risk management, becomes necessary.
* When documenting risks surrounding complete systems becomes necessary.
* To accommodate a fundamental reorganization, such as when an organization does not have a working risk methodology in place, and requires a robust risk management framework to be put in place.

'''The limitations of OCTAVE are:'''
* OCTAVE is incompatible with AS/NZS 4360, as it mandates Likelihood = 1 (i.e., It assumes a threat will always occur) and this is inappropriate for many organizations. OCTAVE-S makes the inclusion of this probability optional, but this is not part of the more comprehensive OCTAVE standard.
* Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement.
* It does not provide a list of “out of the box” practices for assessing and mitigating web application security risks.

Because of these issues, OWASP does not anticipate that OCTAVE will be used at large by application designers or developers, because it fails to take threat risk modeling into consideration, which is useful during all stages of development, by all participants, to reduce the overall risk of an application becoming vulnerable to attack.

== Conclusion ==
In this chapter, we have touched on the basic principles of threat risk modeling, risk management, and web application security. Applications that leverage the underlying intent of these principles will be more secure than their counterparts, which will only be minimally compliant just by including specific controls.

== Further Reading ==
* Threat Analysis & Modeling v2.0, © Microsoft Corporation, 2006,
http://www.microsoft.com/downloads/details.aspx?familyid=334AD466-8B53-4440-8FF0-6AC8142D9198&displaylang=en
* Threat Modeling Web Applications, J.D. Meier, Alex Mackman, Blaine Wastell, © Microsoft Corporation, May 2005,
http://msdn.microsoft.com/en-us/library/ms978516.aspx
* Improving Web Application Security: Threats and Countermeasures, J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan, © Microsoft Corporation, June 2003, http://msdn.microsoft.com/en-us/library/ms994921.aspx
* Threat Modeling, Frank Swiderski and Window Snyder, Microsoft Press, June 2004, ISBM 0-7356-1991-3 or http://www.microsoft.com/downloads/details.aspx?FamilyID=62830f95-0e61-4f87-88a6-e7c663444ac1&displaylang=en.
* Writing Secure Code, 2nd Edition, Howard and LeBlanc, pp 69 – 124, Microsoft Press, 2003, ISBN 0-7356-1722-8.
* Improving Web Application Security: Threats and Countermeasures, Meier et al, Microsoft Press, 2003.
* The STRIDE Threat Model, © Microsoft Corporation, 2005, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securecode_zlsj.asp
* The DREAD Threat Model, © Microsoft Corporation, 2005.
* A Conceptual Model for Threat Modeling Applications, Saitta, Larcom, and Michael Eddington, July 2005, http://dymaxion.org/trike/ or http://dymaxion.org/trike/Trike_v1_Methodology_Document-draft.pdf.
* AS/NZS 4360:2004 Risk Management, Standards Australia and Standards New Zealand, http://www.standards.co.nz/web-shop/?action=viewSearchProduct&mod=catalog&pid=4360:2004(AS|NZS).
* CVSS, U.S. Department of Homeland Security library, February 2005, http://www.dhs.gov/interweb/assetlibrary/NIAC_CyberVulnerabilitiesPaper_Feb05.pdf.
* OCTAVE, CERT library, http://www.cert.org/octave/.

== Reference ==
[[Guide Table of Contents]]

[[Category:OWASP_Guide_Project]]
[[Category:Activity]]

Threat Risk Modeling

2008-08-11T20:11:19Z

ParanoidMike: Formatting improvements

[[Guide Table of Contents]]
__TOC__
When you start a web application design, it is essential to apply threat risk modeling; otherwise you will squander resources, time and money on useless controls that fail to focus on the real risks.

The method used to assess risk is not nearly as important as actually performing a structured threat risk modeling. Microsoft notes that the single most important factor in their security improvement program was the corporate adoption of threat risk modeling.

OWASP recommends Microsoft’s threat modeling process because it works well for addressing the unique challenges facing web application security and is simple to learn and adopt by designers, developers, code reviewers, and the quality assurance team.

The following sections provide some overview information (or see Section 6.9, Further Reading, for additional resources).

==Threat Risk Modeling ==
Threat risk modeling is an essential process for secure web application development. It allows organizations to determine the correct controls and to produce effective countermeasures within budget. For example, there is little point in spending $100,000 for fraud control for a system that has negligible fraud risk.

==Performing threat risk modeling using the Microsoft Threat Modeling Process ==
The threat risk modeling process has five steps , enumerated below and shown graphically in Figure 1. They are:

# Identify Security Objectives
# Survey the Application
# Decompose it
# Identify Threats
# Identify Vulnerabilities

[[Image:Threat_Model_Flow.gif|Figure 1: Threat Model Flow]]

Let’s consider the steps in more detail.

===Identify Security Objectives ===
The business (or project management) leadership, in concert with the software development and quality assurance teams, all need to understand the security objectives. To facilitate this, start by breaking down the application’s security objectives into the following categories:

* '''Identity:''' Does the application protect user identity from abuse? Are there adequate controls in place to ensure evidence of identity (as required for many banking applications?)

* '''Financial:''' Assess the level of risk the organization is prepared to absorb in remediation, as a potential financial loss. For example, forum software may have a lower estimated financial risk than an Internet banking application.

* '''Reputation:''' Quantify or estimate of the loss of reputation derived from the application being misused or successfully attacked.

* '''Privacy and Regulatory:''' To what extent will the application have to protect user data? Forum software by its nature is public, but a tax preparation application is subject to tax regulations and privacy legislation requirements in most countries.

* '''Availability Guarantees:''' Is the application required to be available per a '''''Service Level Agreement (SLA)''''' or similar guarantee? Is it a nationally protected infrastructure? To what level will the application have to be available? High availability techniques are significantly more expensive, so applying the correct controls up front will save a great deal of time, resources, and money.

This is by no means an exhaustive list, but it gives an idea of some of the business risk decisions leading into selecting and building security controls.

Other sources of risk guidance come from:

* Laws (such as privacy or finance laws)
* Regulations (such as banking or e-commerce regulations)
* Standards (such as ISO 17799)
* Legal Agreements (such as payment card industry standards or merchant agreements)
* Corporate Information Security Policy

===Application Overview ===
Once the security objectives have been defined, analyze the application design to identify the '''''components''''', '''''data flows''''', and '''''trust boundaries'''''.

Do this by surveying the application’s architecture and design documentation. In particular, look for UML component diagrams. Such high level component diagrams are generally sufficient to understand how and why data flows to various places. For example, data movement across a trust boundary (such as from the Internet to the web tier, or from the business logic to the database server), needs to be carefully analyzed, whereas data that flows within the same trust level does not need as much scrutiny.

===Decompose Application ===
Once the application architecture is understood then decompose it further, to identify the features and modules with a security impact that need to be evaluated. For example, when investigating the authentication module, it is necessary to understand how data enters the module, how the module validates and processes the data, where the data flows, how the data is stored, and what fundamental decisions and assumptions are made by the module.

===Identify Threats ===
It is impossible to write down unknown threats, but it is likewise unlikely that new malware will be created to exploit new vulnerabilities within custom systems. Therefore, concentrate on known risks, which can be easily demonstrated using tools or techniques from Bugtraq .

Microsoft suggests two different approaches for writing up threats. One is a threat graph, as shown in Figure 2, and the other is a structured list, as shown in Figure 3.

[[Image:Threat_Graph.gif|Figure 2: Threat Graph]]

Typically, a threat graph imparts more information quickly but it takes longer to construct, while a structured list is easier to create but it will take longer for the threat impacts to become obvious.

# Attacker may be able to read other user’s messages
# User may not have logged off on a shared PC
# Data validation may allow SQL injection
# Implement data validation
# Authorization may fail, allowing unauthorized access
# Implement authorization checks
# Browser cache may contain contents of message
# Implement anti-caching directive in HTTP headers
# If eavesdropping risk is high, use SSL

Note that it takes a motivated attacker to exploit a threat; they generally want something from your application or to obviate controls. To understand the relevant threats, use the following categories to understand who might attack the application:

* '''Accidental Discovery:''' An ordinary user stumbles across a functional mistake in your application, just using a web browser, and gains access to privileged information or functionality.
* '''Automated Malware:''' Programs or scripts, which are searching for known vulnerabilities, and then report them back to a central collection site.
* '''The Curious Attacker:''' a security researcher or ordinary user, who notices something wrong with the application, and decides to pursue further.
* '''Script Kiddies:''' Common renegades, seeking to compromise or deface applications for collateral gain, notoriety, or a political agenda, perhaps using the attack categories described in the ''OWASP Web Application Penetration Checklist.''
* '''The Motivated Attacker:''' Potentially, a disgruntled staff member with inside knowledge or a paid professional attacker.
* '''Organized Crime:''' Criminals seeking high stake payouts, such as cracking e-commerce or corporate banking applications, for financial gain.

It is vital to understand the level of attacker you are defending against. For example, a motivated attacker, who understands your internal processes is often more dangerous than script kiddies.

===STRIDE ===
STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker). The STRIDE acronym is formed from the first letter of each of the following categories.

'''''Spoofing Identity'''''

“Identity spoofing” is a key risk for applications that have many users but provide a single execution context at the application and database level. In particular, users should not be able to become any other user or assume the attributes of another user.

'''''Tampering with Data'''''

Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth. The application should not send data to the user, such as interest rates or periods, which are obtainable only from within the application itself. The application should also carefully check data received from the user and validate that it is sane and applicable before storing or using it.

'''''Repudiation'''''

Users may dispute transactions if there is insufficient auditing or recordkeeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss.

Therefore, consider if the application requires non-repudiation controls, such as web access logs, audit trails at each tier, or the same user context from top to bottom. Preferably, the application should run with the user’s privileges, not more, but this may not be possible with many off-the-shelf application frameworks.

'''''Information Disclosure'''''

Users are rightfully wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data at large, whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

Also, consider if the user’s web browser may leak information. Some web browsers may ignore the no caching directives in HTTP headers or handle them incorrectly. In a corresponding fashion, every secure application has a responsibility to minimize the amount of information stored by the web browser, just in case it leaks or leaves information behind, which can be used by an attacker to learn details about the application, the user, or to potentially become that user.

Finally, in implementing persistent values, keep in mind that the use of hidden fields is insecure by nature. Such storage should not be relied on to secure sensitive information or to provide adequate personal privacy safeguards.

'''''Denial of Service'''''

Application designers should be aware that their applications may be subject to a denial of service attack. Therefore, the use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users, and not available to anonymous users.

For applications that do not have this luxury, every facet of the application should be engineered to perform as little work as possible, to use fast and few database queries, to avoid exposing large files or unique links per user, in order to prevent simple denial of service attacks.

'''''Elevation of Privilege'''''

If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one. In particular, simply not displaying privileged role links is insufficient. Instead, all actions should be gated through an authorization matrix, to ensure that only the permitted roles can access privileged functionality.

===DREAD ===
DREAD is a classification scheme for quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. The DREAD acronym is formed from the first letter of each category below.

DREAD modeling influences the thinking behind setting the risk rating, and is also used directly to sort the risks. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.

'''Risk_DREAD''' = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

The calculation always produces a number between 0 and 10; the higher the number, the more serious the risk.

Here are some examples of how to quantify the DREAD categories.

'''''Damage Potential'''''

* If a threat exploit occurs, how much damage will be caused?
**0 = Nothing
**5 = Individual user data is compromised or affected.
**10 = Complete system or data destruction

'''''Reproducibility'''''

* How easy is it to reproduce the threat exploit?
**0 = Very hard or impossible, even for administrators of the application.
**5 = One or two steps required, may need to be an authorized user.
**10 = Just a web browser and the address bar is sufficient, without authentication.

'''''Exploitability'''''

* What is needed to exploit this threat?
**0 = Advanced programming and networking knowledge, with custom or advanced attack tools.
**5 = Malware exists on the Internet, or an exploit is easily performed, using available attack tools.
**10 = Just a web browser

'''''Affected Users'''''

* How many users will be affected?
**0 = None
**5 = Some users, but not all
**10 = All users

'''''Discoverability'''''

* How easy is it to discover this threat?
**0 = Very hard to impossible; requires source code or administrative access.
**5 = Can figure it out by guessing or by monitoring network traces.
**9 = Details of faults like this are already in the public domain and can be easily discovered using a search engine.
**10 = The information is visible in the web browser address bar or in a form.

'''Note:''' When performing a security review of an existing application, “Discoverability” will often be set to 10 by convention, as it is assumed the threat issues will be discovered.

'''Note:''' Using DREAD can be difficult at first. It may be helpful to think of Damage Potential and Affected Users in terms of Impact, while thinking of Reproducibility, Exploitability, and Discoverability in terms of Probability. Using the Impact vs Probability approach (which follows best practices such as defined in NIST-800-30), I would alter the formula to make the Impact score equal to the Probability score. Otherwise the probability scores have more weight in the total.

== Alternative Threat Modeling Systems ==
OWASP recognizes that the adoption of the Microsoft modeling process may not fit all organizations. If STRIDE and DREAD are unacceptable for some reason, we recommend that your organization “dry run” the other threat risk models discussed against an existing application or design. This will allow you to determine which approach works best for you, and to adopt the most appropriate threat modeling tools for your organization.

'''In summary, performing threat modeling provides a far greater return than most any other control in this Guide. Therefore, make threat risk modeling an early priority in your application design process.'''

=== Trike ===
Trike is a threat modeling framework with similarities to the Microsoft threat modeling processes. However, Trike differs because it uses a risk based approach with distinct implementation, threat, and risk models, instead of using the STRIDE/DREAD aggregated threat model (attacks, threats, and weaknesses).
From the Trike paper, Trike’s goals are:
* With assistance from the system stakeholders, to ensure that the risk this system entails to each asset is acceptable to all stakeholders.
* Be able to tell whether we have done this.
* Communicate what we’ve done and its effects to the stakeholders.
* Empower stakeholders to understand and reduce the risks to them and other stakeholders implied by their actions within their domains.
For more information on Trike, please see Section 6.9, reference 8.

=== AS/NZS 4360:2004 Risk Management ===
The Australian/New Zealand Standard AS/NZS 4360, first issued in 1999, and revised in 2004, is the world’s first formal standard for documenting and managing risk and is still one of the few formal standards for managing it.
The standard’s approach is simple (it’s only 28 pages long), flexible, and iterative. Furthermore, it does not lock organizations into a particular risk management methodology, provided the methodology fulfils the AS/NZS 4360 five steps. It also provides several sets of risk tables as examples, and allows organizations to freely develop and adopt their own.

'''The five steps of the AS/NZS 4360 process are:'''
* '''Establish Context:''' Establish the risk domain, i.e., which assets/systems are important?
* '''Identify the Risks:''' Within the risk domain, what specific risks are apparent?
* '''Analyze the Risks:''' Look at the risks and determine if there are any supporting controls in place.
* '''Evaluate the Risks:''' Determine the residual risk.
* '''Treat the Risks:''' Describe the method to treat the risks so that risks selected by the business will be mitigated.
AS/NZS 4360 assumes that risk will be managed by an '''''operational risk group''''', and that the organization has adequate skills and risk management resources in house to identify, analyze, and treat the risks.

'''The advantages of AS/NZS 4360:'''
* AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.
* AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as just using likelihood and consequence to determine an overall risk.
* AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS/NZS 4360 compatible approach.
* You are an Australian organization, and may be required to use it if you are audited on a regular basis, or to justify why you aren’t using it. Luckily, the STRIDE/DREAD model discussed earlier is AS/NZS 4360 compatible.

'''The limitations of AS/NZS 4360:'''
* The AS/NZS 4360 approach works best for business or systemic risks than for technical risks.
* AS/NZS 4360 does not define the methodology to perform a structured threat risk modeling exercise.
* As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.
Although AS/NZS 4360 may be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methodologies described earlier.

=== CVSS ===
The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco Systems, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the group’s outputs is the Common '''''Vulnerability Scoring System (CVSS).'''''

'''The advantages of CVSS:'''
* You have just received notification from a security researcher or other source that your product has vulnerability, and you wish to ensure that it has an accurate and normalized severity rating, so as to alert your customers to the appropriate level of action required when you release the patch.
* You are a security researcher, and have found several threat exploits within an application. You would like to use the CVSS ranking system to produce reliable risk rankings, to ensure that the ISV will take the exploits seriously as indicated by their rating.
* CVSS has been recommended by the working group for use by US Government departments. However, it is unclear if it will become policy or be widely adopted at the time of this writing.

'''The limitations of CVSS:'''
* CVSS does not find or reduce the attack surface area (i.e. design flaws), or help enumerate risks within any arbitrary piece of code, as it is just a scoring system, not a modeling methodology.
* CVSS is more complex than STRIDE/DREAD, as it aims to calculate the risk of announced vulnerabilities as applied to deployed software and environmental factors.
* The CVSS risk ranking is complex – a spreadsheet is required to calculate the risk components as the assumption behind CVSS is that a specific vulnerability has been identified and announced, or a worm or Trojan has been released targeting a small number of attack vectors.
* The overhead of calculating the CVSS risk ranking is quite high if applied to a thorough code review, which may have 250 or more threats to rank.

=== OCTAVE ===
OCTAVE is a heavyweight risk methodology approach originating from Carnegie Mellon University’s Software Engineering Institute (SEI) in collaboration with CERT. OCTAVE focuses on organizational risk, not technical risk.
OCTAVE comes in two versions: Full OCTAVE, for large organizations, and OCTAVE-S for small organizations, both of which have specific catalogs of practices, profiles, and worksheets to document the modeling outcomes.

'''OCTAVE is popular with many sites and is useful when:'''
* Implementing an organizational culture of risk management and controls becomes necessary.
* Documenting and measuring business risk becomes timely.
* Documenting and measuring the overall IT security risk, particularly as it relates to the corporate IT risk management, becomes necessary.
* When documenting risks surrounding complete systems becomes necessary.
* To accommodate a fundamental reorganization, such as when an organization does not have a working risk methodology in place, and requires a robust risk management framework to be put in place.

'''The limitations of OCTAVE are:'''
* OCTAVE is incompatible with AS/NZS 4360, as it mandates Likelihood = 1 (i.e., It assumes a threat will always occur) and this is inappropriate for many organizations. OCTAVE-S makes the inclusion of this probability optional, but this is not part of the more comprehensive OCTAVE standard.
* Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement.
* It does not provide a list of “out of the box” practices for assessing and mitigating web application security risks.
Because of these issues, OWASP does not anticipate that OCTAVE will be used at large by application designers or developers, because it fails to take threat risk modeling into consideration, which is useful during all stages of development, by all participants, to reduce the overall risk of an application becoming vulnerable to attack.

==Conclusion==
In this chapter, we have touched on the basic principles of threat risk modeling, risk management, and web application security. Applications that leverage the underlying intent of these principles will be more secure than their counterparts, which will only be minimally compliant just by including specific controls.

==Further Reading==
* Threat Analysis & Modeling v2.0, © Microsoft Corporation, 2006,
http://www.microsoft.com/downloads/details.aspx?familyid=334AD466-8B53-4440-8FF0-6AC8142D9198&displaylang=en
* Threat Modeling Web Applications, J.D. Meier, Alex Mackman, Blaine Wastell, © Microsoft Corporation, May 2005,
http://msdn.microsoft.com/en-us/library/ms978516.aspx
* Improving Web Application Security: Threats and Countermeasures, J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan, © Microsoft Corporation, June 2003, http://msdn.microsoft.com/en-us/library/ms994921.aspx
* Threat Modeling, Frank Swiderski and Window Snyder, Microsoft Press, June 2004, ISBM 0-7356-1991-3 or http://www.microsoft.com/downloads/details.aspx?FamilyID=62830f95-0e61-4f87-88a6-e7c663444ac1&displaylang=en.
* Writing Secure Code, 2nd Edition, Howard and LeBlanc, pp 69 – 124, Microsoft Press, 2003, ISBN 0-7356-1722-8.
* Improving Web Application Security: Threats and Countermeasures, Meier et al, Microsoft Press, 2003.
* The STRIDE Threat Model, © Microsoft Corporation, 2005, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securecode_zlsj.asp
* The DREAD Threat Model, © Microsoft Corporation, 2005.
* A Conceptual Model for Threat Modeling Applications, Saitta, Larcom, and Michael Eddington, July 2005, http://dymaxion.org/trike/ or http://dymaxion.org/trike/Trike_v1_Methodology_Document-draft.pdf.
* AS/NZS 4360:2004 Risk Management, Standards Australia and Standards New Zealand, http://www.standards.co.nz/web-shop/?action=viewSearchProduct&mod=catalog&pid=4360:2004(AS|NZS).
* CVSS, U.S. Department of Homeland Security library, February 2005, http://www.dhs.gov/interweb/assetlibrary/NIAC_CyberVulnerabilitiesPaper_Feb05.pdf.
* OCTAVE, CERT library, http://www.cert.org/octave/.

==Reference==
[[Guide Table of Contents]]

[[Category:OWASP_Guide_Project]]
[[Category:Activity]]

FxCop

2008-07-29T17:34:40Z

ParanoidMike: /* Custom Rules and other third-party Enhancements */ added a couple of links to custom rules

== What is FxCop? ==
FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet [[FxCop#References | below]]), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.

== Resources ==
=== Tool, Documentation and Community ===
* Download - [http://code.msdn.microsoft.com/codeanalysis FxCop v1.35]
* Download - [http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en FxCop v1.36 (beta)]
* Download - [http://web.archive.org/web/*/http://www.gotdotnet.com/team/fxcop/FxCopInstall1.32.EXE FxCop v1.32 (''via archive.org'')] - only necessary if you wish to perform analysis of code written in Visual Studio 2003 or earlier.
* Download - [http://code.msdn.microsoft.com/codeanalysis/Release/ProjectReleases.aspx?ReleaseId=556 Rules comparison spreadsheet] - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
* Documentation - [http://msdn.microsoft.com/library/bb429476.aspx FxCop] - MSDN documentation for FxCop
* Forum - [http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=98&SiteID=1 Visual Studio Code Analysis and Code Metrics] - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis feature
* Wikipedia - [http://en.wikipedia.org/wiki/Fxcop FxCop article]
* Blog - [http://blogs.msdn.com/fxcop/ Microsoft Code Analysis Team blog] - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
* Blog - [http://davesbox.com/ Dave's Box] - personal blog written by a member of Microsoft's Code Analysis team
* Article - [http://blogs.microsoft.co.il/blogs/sasha/archive/2007/02/10/Run-FxCop-from-Code.aspx Run FxCop from Code]
* Article - [http://weblogs.asp.net/rosherove/archive/2007/02/24/writing-real-unit-tests-for-your-custom-fxcop-rules.aspx Writing Real Unit Tests for your Custom FxCop Rules]
* Article - [http://www.binarycoder.net/fxcop/ FxCop and Code Analysis: Writing Your Own Custom Rules] - the definitive tutorial by Jason Kresowaty

=== Custom Rules and other third-party Enhancements ===
* [http://www.codeplex.com/JSLFxCop JSL FxCop (CodePlex)] - open-source utility to help build custom FxCop rules, as well as many custom rules.
* [http://www.codeplex.com/CSAR Community Static Analysis Rules (CodePlex)] - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
* [http://sourceforge.net/projects/tngfxcoprules/ TeachNaGeamhradh FxCop Rules (SourceForge)] - "A growing collection of rules and experimentation with FxCop to provide a comprehensive list of rules that are useful against the .Net assemblies."
* [http://www.codeplex.com/LephoneFxCopRules Lephone FxCop Rules (CodePlex)] - a small set of custom rules
* [http://code.msdn.microsoft.com/InfoXchange CustomFxCop (CodePlex)] - implements "...new rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
* [http://code.google.com/p/findbugs-fxcop/ findbugs-FxCop (Google Code)] - "This project will produce custom rules for FxCop, that will look for coding mistakes similar to those found by FindBugs, such as infinite recursive loops and ignored return values."
* [http://web.archive.org/web/20040724165715/http://tatochip.com/archive/2004/07/19/2678.aspx Custom FxCop rule : checking for IDataReader in method parameters (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20060313113313/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=14DEFFCB-9C2B-4C38-BEEC-AB860084E372 Custom FxCop rule: demonstrates extracting literal arguments from method call (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20070826010853/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=B397F7AD-4811-45DE-9A6A-33F818994CB1 Custom FxCop rules: No Numerals in Variable Names, Naming Constants (Archive.org)] - two FxCop rules in source code form
* [http://web.archive.org/web/20060427042023/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=01D9F014-5F73-4D66-8E74-C658944180DD Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113430/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=0BE37E51-6A0E-4E8E-A61F-84A388000859 Custom FxCop 1.32 rule: detects calls to specific API (Archive.org)] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113604/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop 1.32 rules (Archive.org)] - some FxCop 1.32 rules in source code form

* [http://web.archive.org/web/20060313113604/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop rules "My FxCop rules" (Archive.org)] - some FxCop rules [''broken link'']
* [http://web.archive.org/web/20060313113924/http://www.gotdotnet.com/Community/UserSamples/Download.aspx?SampleGuid=18919BD2-6502-43B3-BF3D-35C5E57DA06D TechEd 2004 presentation & samples by Michael Murray (Archive.org)] - "Code Correctness with FxCop 1.30" [''broken link'']

* [http://sourceforge.net/projects/fxdeputy/ FxDeputy (SourceForge)] - "This project is of use to anyone writing rules for the FxCop checker for .NET. This provides a framework that will allow you to tag tests with attributes that will provide you with control of what tests are run against your rules."
* [http://weblogs.asp.net/rosherove/archive/2007/02/24/introducing-fxcopunit-a-framework-for-integrated-fxcop-rule-testing.aspx FxCopUnit (ASP.NET blogs)] - "A framework for integrated FxCop rule testing"
* [http://www.codeplex.com/fxcopdelta FxCop Delta (CodePlex)] - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
* [http://www.codeplex.com/FinRadFxCopStats FinRad Statistics Collector for FxCop (CodePlex)] - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
* [http://web.archive.org/web/20070825153755/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BCFB8E54-989A-4464-BDB0-3C3B9B3F1346 FxCopReportAll.xsl (Archive.org)] - GotDotNet sample "style sheet for report that shows all Active and Excluded Messages."
* ''([http://code.msdn.microsoft.com/CustomRulesinFxcop CustomRules in FxCop] - '''DEAD CodePlex project''')''

=== Similar Tools for .NET code analysis ===
* [http://code.google.com/p/agentsmithplugin/ Agent Smith Plugin] - "Agent Smith is C# code style validation plugin for ReSharper (Visual Studio plugin)."
* [http://code.google.com/p/agentjohnsonplugin/ Agent Johnson Plugin] - "Plugin for JetBrains ReSharper", performing limited code analysis, refactoring and fixups on C# code.
* [http://code.google.com/p/smokey/ Smokey (Google Code)] - tool similar to FxCop for analysing managed code; has 220 separate rules.
* [http://research.microsoft.com/phoenix/ Phoenix] - an SDK from MS Research labelled as "...the software optimization and analysis framework that is the basis for all future Microsoft® compiler technologies. The Phoenix framework is an extensible system that can be adapted to read and write binaries and Microsoft Intermediate Language assemblies and represent the input files in an Intermediate Representation, which can be analyzed and manipulated by applications by using the Phoenix API."
* [http://www.mono-project.com/Gendarme Gendarme] - "Gendarme is a extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compiler do not typically check or have not historically checked."
* [http://code.google.com/p/md-codeanalysis/ md-codeanalysis] - "MonoDevelop.CodeAnalysis is an addin that integrates both Gendarme and Smokey into MonoDevelop."

Source Code Analysis Tools

2008-07-24T01:02:36Z

ParanoidMike: /* Open Source or Free Tools Of This Type */ removed reference to PreFix - only available to the MS Windows developer team

Source Code Analysis tools are designed to analyze source code and/or compiled version of code in order to help find security flaws. Ideally, such tools would automatically find security flaws with a high degree of confidence that what is found is indeed a flaw. However, this is beyond the state of the art for many types of application security flaws. Thus, such tools frequently serve as aids for an analyst to help them zero in on security relevant portions of code so they can find flaws more efficiently, rather than a tool that simply finds flaws automatically.

Some tools are starting to move into the IDE. For the types of problems that can be detected during the software development phase itself, this is a powerful phase within the development lifecycle to employ such tools, as it provides immediate feedback to the developer on issues they might be introducing into the code during code development itself. This immediate feedback is very useful as compared to finding vulnerabilities much later in the development cycle.

==Strengths and Weaknesses==

Strengths:
* Scales Well (Can be run on lots of software, and can be repeatedly (like in nightly builds))
* For things that such tools can automatically find with high confidence, such as buffer overflows, SQL Injection Flaws, etc. they are great.

Weaknesses:
* Many types of security vulnerabilities are very difficult to find automatically, such as authentication problems, access control issues, insecure use of cryptography, etc. The current state of the art only allows such tools to automatically find a relatively small percentage of application security flaws. Tools of this type are getting better, however.
* High numbers of false positives.
* Frequently can't find configuration issues, since they are not represented in the code.
* Difficult to 'prove' that an identified security issue is an actual vulnerability.
* Many of these tools have difficulty analyzing code that can't be compiled. Analysts frequently can't compile code because they don't have the right libraries, all the compilation instructions, all the code, etc.

==Important Selection Criteria==

* Requirement: Must support your language, but not usually a key factor once it does.

* Types of Vulnerabilities it can detect (Out of the OWASP Top Ten?) (plus more?)
* Does it require a fully buildable set of source?
* Can it run against binaries instead of source?
* Can it be integrated into the developer's IDE?

==OWASP Tools Of This Type==

* [http://www.owasp.org/index.php/Category:OWASP_LAPSE_Project OWASP_LAPSE_Project]

==Open Source or Free Tools Of This Type==

* Microsoft - [[FxCop]]
* Microsoft - PreFast
* [http://www.securitycompass.com/swaat.html SWAAT - Simplistic Beta Tool - Languages: Java, JSP, ASP .Net, and PHP]
* [http://www.securesoftware.com/resources/download_rats.html Secure Software - RATS - Scans C, C++, Perl, PHP and Python source code for security problems like buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions]

==Commercial Tools from OWASP Members Of This Type==

These vendors have decided to support OWASP by becoming [[Membership|members]]. OWASP appreciates the support from these organizations, but cannnot endorse any commercial products or services.

* [http://www.armorize.com/corpweb/en/products/codesecure Armorize Technologies - Static Source Code Analysis with CodeSecure™]
* [http://www.fortifysoftware.com/products/sca.jsp Fortify - Source Code Analysis]
* [http://www.ouncelabs.com/ Ounce Labs - Ounce]

==Other Well Known Commercial Tools Of This Type==

* [http://www.coverity.com/products/prevent.html Coverity - Prevent]
* [http://www.klocwork.com/products/klocworkk7.asp KlocWork - K7]

==More Info==

* add comments from: http://lists.owasp.org/pipermail/owasp-dotnet/2006-August/000002.html
* http://www.owasp.org/index.php/Appendix_A:_Testing_Tools
* NIST's list of Source Code Security Analysis Tools - http://samate.nist.gov/index.php/Source_Code_Security_Analyzers

[[Category:OWASP .NET Project]]

[[Category:OWASP Tools Project]]

__NOTOC__

FxCop

2008-07-21T08:32:40Z

ParanoidMike: /* Custom Rules and other third-party Enhancements */ added links to GotDotNet samples pulled from Archive.org

== What is FxCop? ==
FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet [[FxCop#References | below]]), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.

== Resources ==
=== Tool, Documentation and Community ===
* Download - [http://code.msdn.microsoft.com/codeanalysis FxCop v1.35]
* Download - [http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en FxCop v1.36 (beta)]
* Download - [http://web.archive.org/web/*/http://www.gotdotnet.com/team/fxcop/FxCopInstall1.32.EXE FxCop v1.32 (''via archive.org'')] - only necessary if you wish to perform analysis of code written in Visual Studio 2003 or earlier.
* Download - [http://code.msdn.microsoft.com/codeanalysis/Release/ProjectReleases.aspx?ReleaseId=556 Rules comparison spreadsheet] - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
* Documentation - [http://msdn.microsoft.com/library/bb429476.aspx FxCop] - MSDN documentation for FxCop
* Forum - [http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=98&SiteID=1 Visual Studio Code Analysis and Code Metrics] - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis feature
* Wikipedia - [http://en.wikipedia.org/wiki/Fxcop FxCop article]
* Blog - [http://blogs.msdn.com/fxcop/ Microsoft Code Analysis Team blog] - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
* Blog - [http://davesbox.com/ Dave's Box] - personal blog written by a member of Microsoft's Code Analysis team
* Article - [http://blogs.microsoft.co.il/blogs/sasha/archive/2007/02/10/Run-FxCop-from-Code.aspx Run FxCop from Code]
* Article - [http://weblogs.asp.net/rosherove/archive/2007/02/24/writing-real-unit-tests-for-your-custom-fxcop-rules.aspx Writing Real Unit Tests for your Custom FxCop Rules]
* Article - [http://www.binarycoder.net/fxcop/ FxCop and Code Analysis: Writing Your Own Custom Rules] - the definitive tutorial by Jason Kresowaty

=== Custom Rules and other third-party Enhancements ===
* [http://www.codeplex.com/JSLFxCop JSL FxCop (CodePlex)] - open-source utility to help build custom FxCop rules, as well as many custom rules.
* [http://www.codeplex.com/CSAR Community Static Analysis Rules (CodePlex)] - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
* [http://sourceforge.net/projects/tngfxcoprules/ TeachNaGeamhradh FxCop Rules (SourceForge)] - "A growing collection of rules and experimentation with FxCop to provide a comprehensive list of rules that are useful against the .Net assemblies."
* [http://www.codeplex.com/LephoneFxCopRules Lephone FxCop Rules (CodePlex)] - a small set of custom rules
* [http://code.msdn.microsoft.com/InfoXchange CustomFxCop (CodePlex)] - implements "...new rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
* [http://code.google.com/p/findbugs-fxcop/ findbugs-FxCop (Google Code)] - "This project will produce custom rules for FxCop, that will look for coding mistakes similar to those found by FindBugs, such as infinite recursive loops and ignored return values."
* [http://web.archive.org/web/20040724165715/http://tatochip.com/archive/2004/07/19/2678.aspx Custom FxCop rule : checking for IDataReader in method parameters (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20060313113313/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=14DEFFCB-9C2B-4C38-BEEC-AB860084E372 Custom FxCop rule: demonstrates extracting literal arguments from method call (Archive.org)] - a single FxCop rule in source code form
* [http://web.archive.org/web/20070826010853/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=B397F7AD-4811-45DE-9A6A-33F818994CB1 Custom FxCop rules: No Numerals in Variable Names, Naming Constants (Archive.org)] - two FxCop rules in source code form
* [http://web.archive.org/web/20060427042023/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=01D9F014-5F73-4D66-8E74-C658944180DD Custom FxCop 1.32 rule: detects calls to specific API] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113430/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=0BE37E51-6A0E-4E8E-A61F-84A388000859 Custom FxCop 1.32 rule: detects calls to specific API] - a single FxCop 1.32 rule in source code form
* [http://web.archive.org/web/20060313113604/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BFBB8D82-678A-4E58-A305-5B00FDE900DB Custom FxCop 1.32 rules] - some FxCop 1.32 rules in source code form
* [http://sourceforge.net/projects/fxdeputy/ FxDeputy (SourceForge)] - "This project is of use to anyone writing rules for the FxCop checker for .NET. This provides a framework that will allow you to tag tests with attributes that will provide you with control of what tests are run against your rules."
* [http://weblogs.asp.net/rosherove/archive/2007/02/24/introducing-fxcopunit-a-framework-for-integrated-fxcop-rule-testing.aspx FxCopUnit (ASP.NET blogs)] - "A framework for integrated FxCop rule testing"
* [http://www.codeplex.com/fxcopdelta FxCop Delta (CodePlex)] - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
* [http://www.codeplex.com/FinRadFxCopStats FinRad Statistics Collector for FxCop (CodePlex)] - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
* [http://web.archive.org/web/20070825153755/www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=BCFB8E54-989A-4464-BDB0-3C3B9B3F1346 FxCopReportAll.xsl (Archive.org)] - GotDotNet sample "style sheet for report that shows all Active and Excluded Messages."
* ''([http://code.msdn.microsoft.com/CustomRulesinFxcop CustomRules in FxCop] - '''DEAD CodePlex project''')''

=== Similar Tools for .NET code analysis ===
* [http://code.google.com/p/agentsmithplugin/ Agent Smith Plugin] - "Agent Smith is C# code style validation plugin for ReSharper (Visual Studio plugin)."
* [http://code.google.com/p/agentjohnsonplugin/ Agent Johnson Plugin] - "Plugin for JetBrains ReSharper", performing limited code analysis, refactoring and fixups on C# code.
* [http://code.google.com/p/smokey/ Smokey (Google Code)] - tool similar to FxCop for analysing managed code; has 220 separate rules.
* [http://research.microsoft.com/phoenix/ Phoenix] - an SDK from MS Research labelled as "...the software optimization and analysis framework that is the basis for all future Microsoft® compiler technologies. The Phoenix framework is an extensible system that can be adapted to read and write binaries and Microsoft Intermediate Language assemblies and represent the input files in an Intermediate Representation, which can be analyzed and manipulated by applications by using the Phoenix API."
* [http://www.mono-project.com/Gendarme Gendarme] - "Gendarme is a extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compiler do not typically check or have not historically checked."
* [http://code.google.com/p/md-codeanalysis/ md-codeanalysis] - "MonoDevelop.CodeAnalysis is an addin that integrates both Gendarme and Smokey into MonoDevelop."

FxCop

2008-07-20T23:27:58Z

ParanoidMike: /* Similar Tools for .NET code analysis */ added link to Phoenix, Gendarme, MD-codeanalysis

== What is FxCop? ==
FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet [[FxCop#References | below]]), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.

== Resources ==
=== Tool, Documentation and Community ===
* Download - [http://code.msdn.microsoft.com/codeanalysis FxCop v1.35]
* Download - [http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en FxCop v1.36 (beta)]
* Download - [http://web.archive.org/web/*/http://www.gotdotnet.com/team/fxcop/FxCopInstall1.32.EXE FxCop v1.32 (''via archive.org'')] - only necessary if you wish to perform analysis of code written in Visual Studio 2003 or earlier.
* Download - [http://code.msdn.microsoft.com/codeanalysis/Release/ProjectReleases.aspx?ReleaseId=556 Rules comparison spreadsheet] - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
* Documentation - [http://msdn.microsoft.com/library/bb429476.aspx FxCop] - MSDN documentation for FxCop
* Forum - [http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=98&SiteID=1 Visual Studio Code Analysis and Code Metrics] - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis feature
* Wikipedia - [http://en.wikipedia.org/wiki/Fxcop FxCop article]
* Blog - [http://blogs.msdn.com/fxcop/ Microsoft Code Analysis Team blog] - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
* Blog - [http://davesbox.com/ Dave's Box] - personal blog written by a member of Microsoft's Code Analysis team
* Article - [http://blogs.microsoft.co.il/blogs/sasha/archive/2007/02/10/Run-FxCop-from-Code.aspx Run FxCop from Code]
* Article - [http://weblogs.asp.net/rosherove/archive/2007/02/24/writing-real-unit-tests-for-your-custom-fxcop-rules.aspx Writing Real Unit Tests for your Custom FxCop Rules]
* Article - [http://www.binarycoder.net/fxcop/ FxCop and Code Analysis: Writing Your Own Custom Rules] - the definitive tutorial by Jason Kresowaty

=== Custom Rules and other third-party Enhancements ===
* [http://www.codeplex.com/JSLFxCop JSL FxCop (CodePlex)] - open-source utility to help build custom FxCop rules, as well as many custom rules.
* [http://www.codeplex.com/CSAR Community Static Analysis Rules (CodePlex)] - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
* [http://sourceforge.net/projects/tngfxcoprules/ TeachNaGeamhradh FxCop Rules (SourceForge)] - "A growing collection of rules and experimentation with FxCop to provide a comprehensive list of rules that are useful against the .Net assemblies."
* [http://www.codeplex.com/LephoneFxCopRules Lephone FxCop Rules (CodePlex)] - a small set of custom rules
* [http://code.msdn.microsoft.com/InfoXchange CustomFxCop (CodePlex)] - implements "...new rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
* [http://code.google.com/p/findbugs-fxcop/ findbugs-FxCop] - "This project will produce custom rules for FxCop, that will look for coding mistakes similar to those found by FindBugs, such as infinite recursive loops and ignored return values."
* [http://web.archive.org/web/20040724165715/http://tatochip.com/archive/2004/07/19/2678.aspx fxcop rule : checking for IDataReader in method parameters] - a single FxCop rule in source code form
* [http://sourceforge.net/projects/fxdeputy/ FxDeputy] - "This project is of use to anyone writing rules for the FxCop checker for .NET. This provides a framework that will allow you to tag tests with attributes that will provide you with control of what tests are run against your rules."
* [http://weblogs.asp.net/rosherove/archive/2007/02/24/introducing-fxcopunit-a-framework-for-integrated-fxcop-rule-testing.aspx FxCopUnit] - "A framework for integrated FxCop rule testing"
* [http://www.codeplex.com/fxcopdelta FxCop Delta (CodePlex)] - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
* [http://www.codeplex.com/FinRadFxCopStats FinRad Statistics Collector for FxCop (CodePlex)] - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
* ''([http://code.msdn.microsoft.com/CustomRulesinFxcop CustomRules in FxCop] - '''DEAD CodePlex project''')''

=== Similar Tools for .NET code analysis ===
* [http://code.google.com/p/agentsmithplugin/ Agent Smith Plugin] - "Agent Smith is C# code style validation plugin for ReSharper (Visual Studio plugin)."
* [http://code.google.com/p/agentjohnsonplugin/ Agent Johnson Plugin] - "Plugin for JetBrains ReSharper", performing limited code analysis, refactoring and fixups on C# code.
* [http://code.google.com/p/smokey/ Smokey (Google Code)] - tool similar to FxCop for analysing managed code; has 220 separate rules.
* [http://research.microsoft.com/phoenix/ Phoenix] - an SDK from MS Research labelled as "...the software optimization and analysis framework that is the basis for all future Microsoft® compiler technologies. The Phoenix framework is an extensible system that can be adapted to read and write binaries and Microsoft Intermediate Language assemblies and represent the input files in an Intermediate Representation, which can be analyzed and manipulated by applications by using the Phoenix API."
* [http://www.mono-project.com/Gendarme Gendarme] - "Gendarme is a extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compiler do not typically check or have not historically checked."
* [http://code.google.com/p/md-codeanalysis/ md-codeanalysis] - "MonoDevelop.CodeAnalysis is an addin that integrates both Gendarme and Smokey into MonoDevelop."

FxCop

2008-07-20T22:56:07Z

ParanoidMike: /* Tool, Documentation and Community */ links to FxCop v1.32 via Archive.org

FxCop

2008-07-20T22:48:46Z

ParanoidMike: /* Tool, Documentation and Community */ added link to Custom Rules tutorial

FxCop

2008-07-20T22:34:55Z

ParanoidMike: /* Custom Rules and other third-party Enhancements */ yet more links

FxCop

2008-07-20T21:55:44Z

ParanoidMike: /* References */ re-organized references, added additional links

FxCop

2008-07-20T18:39:33Z

ParanoidMike: /* References */ added link to more CodePlex custom rules projects, and to Wikipedia article

Phoenix/Tools

2008-07-20T08:32:37Z

ParanoidMike: /* Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET */ updated obsolete links, formatted for readability

__NOTOC__
Please send comments or questions to the [https://lists.owasp.org/mailman/listinfo/owasp-phoenix Phoenix-OWASP mailing-list].

==LiveCDs==
Monday, January 29, 2007 4:02 PM 828569600 AOC_Labrat-ALPHA-0010.iso - http://www.packetfocus.com/hackos/ 
DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/ 

==Test sites / testing grounds==
SPI Dynamics (live) - http://zero.webappsecurity.com/ 
Cenzic (live) - http://crackme.cenzic.com/ 
Watchfire (live) - http://demo.testfire.net/ 
Acunetix (live) - http://testphp.acunetix.com/ http://testasp.acunetix.com http://testaspnet.acunetix.com 
WebMaven / Buggy Bank (includes live testsite) - http://www.mavensecurity.com/webmaven 
Foundstone SASS tools - http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/s3i_tools.htm 
OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project 
OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator 
Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/ 
SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/ 

==HTTP proxying / editing==
WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project 
Burp - http://www.portswigger.net/ 
Paros - http://www.parosproxy.org/ 
Fiddler - http://www.fiddlertool.com/ 
Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/ 
Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project 
Suru - http://www.sensepost.com/research/suru/ 
httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/ 
Charles - http://www.xk72.com/charles/ 
Odysseus - http://www.bindshell.net/tools/odysseus 
Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/ 
Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/ 
JS Commander - http://jscmd.rubyforge.org/ 

==RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools==
Wfuzz - http://www.edge-security.com/wfuzz.php 
ProxMon - http://www.isecpartners.com/proxmon.html 
Wapiti - http://wapiti.sourceforge.net/ 
Grabber - http://rgaucher.info/beta/grabber/ 
XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py 
CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project 
HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm 
JBroFuzz - http://sourceforge.net/projects/jbrofuzz 
XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/ 
WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/ 
Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/ 
[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz 
RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter 
screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html 
SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml 
RFuzz - http://rfuzz.rubyforge.org/ 
WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999 
TestMaker - http://www.pushtotest.com/Docs/downloads/features.html 
ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/ 
WSTool - http://wstool.sourceforge.net/ 
Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/ 
Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/ 
HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/ 
Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/ 
PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743 

==HTTP general testing / fingerprinting==
Wbox: HTTP testing tool - http://hping.org/wbox/ 
ht://Check - http://htcheck.sourceforge.net/ 
Mumsie - http://www.lurhq.com/tools/mumsie.html 
WebInject - http://www.webinject.org/ 
Torture.pl Home Page - http://stein.cshl.org/~lstein/torture/ 
JoeDog's Seige - http://www.joedog.org/JoeDog/Siege/ 
OPEN-LABS: metoscan (http method testing) - http://www.open-labs.org/ 
Load-balancing detector - http://ge.mine.nu/lbd.html 
HMAP - http://ujeni.murkyroc.com/hmap/ 
Net-Square: httprint - http://net-square.com/httprint/ 
Wpoison: http stress testing - http://wpoison.sourceforge.net/ 
Net-square: MSNPawn - http://net-square.com/msnpawn/index.shtml 
hcraft: HTTP Vuln Request Crafter - http://druid.caughq.org/projects/hcraft/ 
rfp.labs: LibWhisker - http://www.wiretrip.net/rfp/lw.asp 
Nikto - http://www.cirt.net/code/nikto.shtml 
twill - http://twill.idyll.org/ 
DirBuster - http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project 
[ZIP] DFF Scanner - http://security-net.biz/files/dff/DFF.zip 
[ZIP] The Elza project - http://packetstormsecurity.org/web/elza-1.4.7-beta.zip http://www.stoev.org/elza.html 
HackerFox(http://yehg.co.nr) : Portable Firefox with web hacking addons bundled - http://sf.net/projects/hackfox

==Browser-based HTTP tampering / editing / replaying==
TamperIE - http://www.bayden.com/Other/ 
isr-form - http://www.infobyte.com.ar/developments.html 
Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/ 
Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/ 
UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/ 
TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/ 
DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/ 
LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/ 

==Cookie editing / poisoning==
[TGZ] stompy: session id tool - http://lcamtuf.coredump.cx/stompy.tgz 
Add'N Edit Cookies (AnEC, Firefox Add-on) - http://addneditcookies.mozdev.org/ 
CookieCuller (Firefox Add-on) - http://cookieculler.mozdev.org/ 
CookiePie (Firefox Add-on) - http://www.nektra.com/oss/firefox/extensions/cookiepie/ 
CookieSpy - http://www.codeproject.com/shell/cookiespy.asp 
Cookies Explorer - http://www.dutchduck.com/Features/Cookies.aspx 

==Ajax and XHR scanning==
Sahi - http://sahi.co.in/ 
scRUBYt - http://scrubyt.org/ 
jQuery - http://jquery.com/ 
jquery-include - http://www.gnucitizen.org/projects/jquery-include 
Sprajax - http://www.denimgroup.com/sprajax.html 
Watir - http://wtr.rubyforge.org/ 
Watij - http://watij.com/ 
Watin - http://watin.sourceforge.net/ 
RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/ 
SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin 
Javascript Inline Debugger (jasildbg) - http://jasildbg.googlepages.com/ 
Firebug Lite - http://www.getfirebug.com/lite.html 
firewaitr - http://code.google.com/p/firewatir/ 

==RSS extensions and caching==
LiveLines (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/324/ 
rss-cache - http://www.dubfire.net/chris/projects/rss-cache/ 

==SQL injection scanning==
0x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php 
SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project 
sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/ 
JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html 
BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html 
sqlmap - http://sqlmap.sourceforge.net/ 
Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/ 
FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas 
PRIAMOS - http://www.priamos-project.com/ 

==Web application security malware, backdoors, and evil code==
W3AF: Web Application Attack and Audit Framework - http://w3af.sourceforge.net/ 
Jikto - http://busin3ss.name/jikto-in-the-wild/ 
XSS Shell - http://ferruh.mavituna.com/article/?1338 
XSS-Proxy - http://xss-proxy.sourceforge.net 
AttackAPI - http://www.gnucitizen.org/projects/attackapi/ 
FFsniFF - http://azurit.elbiahosting.sk/ffsniff/ 
HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/ 
BeEF - http://www.bindshell.net/tools/beef/ 
Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/ 
What is my IP address? - http://reglos.de/myaddress/ 
xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm 
SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/ 
Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval 
Technika - http://www.gnucitizen.org/projects/technika/ 
Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet 
MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/ 

==Web application services that aid in web application security assessment==
Netcraft - http://www.netcraft.net 
AboutURL - http://www.abouturl.com/ 
The Scrutinizer - http://www.scrutinizethis.com/ 
net.toolkit - http://clez.net/ 
ServerSniff - http://www.serversniff.net/ 
Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/ 
Webmaster-Toolkit - http://www.webmaster-toolkit.com/ 
myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address 
PHP charset encoding - http://h4k.in/encoding 
data: URL testcases - http://h4k.in/dataurl 

==Browser-based security fuzzing / checking==
Zalewski's MangleMe - http://lcamtuf.coredump.cx/mangleme/mangle.cgi 
hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/ 
Peach Fuzzer Framework - http://peachfuzz.sourceforge.net/ 
TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html 
PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html 
COMRaider - http://labs.idefense.com 
bcheck - http://bcheck.scanit.be/bcheck/ 
Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects 
LinkScanner - http://linkscanner.explabs.com/linkscanner/default.asp 
BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/ 
Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php 
Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7 
Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html 
Mozilla Activex - http://www.iol.ie/~locka/mozilla/mozilla.htm 
Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/ 
Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/ 
Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324 
About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/ 
Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1 

==PHP static analysis and file inclusion scanning==
PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/ 
Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php 
FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25 
PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit 

==Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources==
APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS 
PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/ 
dotnetids - http://code.google.com/p/dotnetids/ 
Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html 
Remo: whitelist rule editor for mod_security - http://remo.netnea.com/ 
GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules 
The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/ 
mod_security rules generator - http://noeljackson.com/tools/modsecurity/ 
Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3 
[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz 
AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99 
Akismet: blog spam defense - http://akismet.com/ 
Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/ 

==Web services enumeration / scanning / fuzzing==
WebServiceStudio2.0 - http://www.codeplex.com/WebserviceStudio 
Net-square: wsChess - http://net-square.com/wschess/index.shtml 
WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project 
SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm 
iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html 

==Web application non-specific static source-code analysis==
Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/ 
Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1 
Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project 
An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/ 
A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html 
A smaller, but also good list - http://spinroot.com/static/ 

==Static analysis for C/C++ (CGI, ISAPI, etc) in web applications==
RATS - http://www.securesoftware.com/resources/download_rats.html 
ITS4 - http://www.cigital.com/its4/ 
FlawFinder - http://www.dwheeler.com/flawfinder/ 
Splint - http://www.splint.org/ 
Uno - http://spinroot.com/uno/ 
BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net 
Valgrind - http://www.valgrind.org/ 

==Java static analysis, security frameworks, and web application security tools==
HDIV Struts - http://hdiv.org/ 
Orizon - http://sourceforge.net/projects/orizon/ 
FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/ 
PMD - http://pmd.sourceforge.net/ 
CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/ 
EMMA - http://emma.sourceforge.net/ 
JLint - http://jlint.sourceforge.net/ 
Java PathFinder - http://javapathfinder.sourceforge.net/ 
Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/ 
Checkstyle - http://checkstyle.sourceforge.net/ 
Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver 
tinapoc - http://sourceforge.net/projects/tinapoc 
jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html 
Solex - http://solex.sourceforge.net/ 
Java Explorer - http://metal.hurlant.com/jexplore/ 
HTTPClient - http://www.innovation.ch/java/HTTPClient/ 
another HttpClient - http://jakarta.apache.org/commons/httpclient/ 
a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html 

==Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET==
* Visual Studio 2008 Code Analysis, available in:
** VSTS 2008 Development Edition (http://msdn.microsoft.com/vsts2008/products/bb933752.aspx) and
** VSTS 2008 Team Suite (http://msdn.microsoft.com/vsts2008/products/bb933735.aspx)
* Visual Studio 2005 Code Analyzer, available in:
** Visual Studio 2005 Team Edition for Software Developers (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
** Visual Studio 2005 Team Suite (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
* Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx
* FxCop:
** (blog) http://blogs.msdn.com/fxcop/
** (download) http://code.msdn.microsoft.com/codeanalysis
* Microsoft internal tools you can't have yet:
** http://www.microsoft.com/windows/cse/pa_projects.mspx
** http://research.microsoft.com/Pex/
** http://www.owasp.org/images/5/5b/OWASP_IL_7_FuzzGuru.pdf 

==Threat modeling==
Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en 
Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php 
Octotrike - http://www.octotrike.org/ 

==Add-ons for Firefox that help with general web application security==
Web Developer Toolbar - https://addons.mozilla.org/firefox/60/ 
Plain Old Webserver (POW) - https://addons.mozilla.org/firefox/3002/ 
XML Developer Toolbar - https://addons.mozilla.org/firefox/2897/ 
Public Fox - https://addons.mozilla.org/firefox/3911/ 
XForms Buddy - http://beaufour.dk/index.php?sec=misc&pagename=xforms 
MR Tech Local Install - http://www.mrtech.com/extensions/local_install/ 
Nightly Tester Tools - http://users.blueprintit.co.uk/~dave/web/firefox/buildid/index.html 
IE Tab - https://addons.mozilla.org/firefox/1419/ 
User-Agent Switcher - https://addons.mozilla.org/firefox/59/ 
ServerSwitcher - https://addons.mozilla.org/firefox/2409/ 
HeaderMonitor - https://addons.mozilla.org/firefox/575/ 
RefControl - https://addons.mozilla.org/firefox/953/ 
refspoof - https://addons.mozilla.org/firefox/667/ 
No-Referrer - https://addons.mozilla.org/firefox/1999/ 
LocationBar^2 - https://addons.mozilla.org/firefox/4014/ 
SpiderZilla - http://spiderzilla.mozdev.org/ 
Slogger - https://addons.mozilla.org/en-US/firefox/addon/143 
Fire Encrypter - https://addons.mozilla.org/firefox/3208/ 

==Add-ons for Firefox that help with Javascript and Ajax web application security==
Selenium IDE - http://www.openqa.org/selenium-ide/ 
Firebug - http://www.joehewitt.com/software/firebug/ 
Venkman - http://www.mozilla.org/projects/venkman/ 
Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/ 
Greasemonkey - http://www.greasespot.net/ 
Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/ 
User script compiler - http://arantius.com/misc/greasemonkey/script-compiler 
Extension Developer's Extension (Firefox Add-on) - http://ted.mielczarek.org/code/mozilla/extensiondev/ 
Smart Middle Click (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/3885/ 

==Bookmarklets that aid in web application security==
RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html 
BMlets - http://optools.awardspace.com/bmlet.html 
Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/ 
Blummy: consists of small widgets, called blummlets, which make use of Javascript to provide
rich functionality - http://www.blummy.com/ 
Bookmarklets every blogger should have - http://www.micropersuasion.com/2005/10/bookmarklets_ev.html 
Flat Bookmark Editing (Firefox Add-on) - http://n01se.net/chouser/proj/mozhack/ 
OpenBook and Update Bookmark (Firefox Add-ons) - http://www.chuonthis.com/extensions/ 

==SSL certificate checking / scanning==
[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip 
[ZIP] Foundstone SSLDigger - http://www.foundstone.com/us/resources/termsofuse.asp?file=ssldigger.zip 
Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/ 

==Honeyclients, Web Application, and Web Proxy honeypots==
Honeyclient Project: an open-source honeyclient - http://www.honeyclient.org/trac/ 
HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/ 
Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/ 
Google Hack Honeypot - http://ghh.sourceforge.net/ 
PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/ 
SpyBye - http://www.monkey.org/~provos/spybye/ 
Honeytokens - http://www.securityfocus.com/infocus/1713 

==Blackhat SEO and maybe some whitehat SEO==
SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/ 
SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html 
SEOQuake (Firefox Add-on) - http://www.seoquake.com/ 

==Footprinting for web application security==
Evolution - http://www.paterva.com/evolution-e.html 
GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/ 
Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/ 
Edge-Security tools - http://www.edge-security.com/soft.php 
Fierce Domain Scanner - http://ha.ckers.org/fierce/ 
Googlegath - http://www.nothink.org/perl/googlegath/ 
Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/ 
Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/ 
CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/ 
BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/ 
TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/ 
DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819/ 
Digger (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1467/ 

==Database security assessment==
Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/ 

==Browser Defenses==
DieHard - http://www.diehard-software.org/ 
LocalRodeo (Firefox Add-on) - http://databasement.net/labs/localrodeo/ 
NoMoXSS - http://www.seclab.tuwien.ac.at/projects/jstaint/ 
Request Rodeo - http://savannah.nongnu.org/projects/requestrodeo 
FlashBlock (Firefox Add-on) - http://flashblock.mozdev.org/ 
CookieSafe (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2497 
NoScript (Firefox Add-on) - http://www.noscript.net/ 
FormFox (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1579/ 
Adblock (Firefox Add-on) - http://adblock.mozdev.org/ 
httpOnly in Firefox (Firefox Add-on) - http://blog.php-security.org/archives/40-httpOnly-Cookies-in-Firefox-2.0.html 
SafeCache (Firefox Add-on) - http://www.safecache.com/ 
SafeHistory (Firefox Add-on) - http://www.safehistory.com/ 
PrefBar (Firefox Add-on) - http://prefbar.mozdev.org/ 
All-in-One Sidebar (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1027/ 
QArchive.org web file checker (Firefox Add-on) - https://addons.mozilla.org/firefox/4115/ 
Update Notified (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2098/ 
FireKeeper - http://firekeeper.mozdev.org/ 
Greasemonkey: XSS Malware Script Detector (http://yehg.co.nr) - http://userscripts.org/scripts/show/22955

==Browser Privacy==
TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/firefox/3173/ 
Privacy Bird - http://www.privacybird.com/ 

==Application and protocol fuzzing (random instead of targeted)==
Sulley - http://fuzzing.org/ 
taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/ 
zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/ 
autodafé: an act of software torture - http://autodafe.sourceforge.net/ 
EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html

Phoenix/Tools

2008-07-20T07:26:09Z

ParanoidMike: /* Web services enumeration / scanning / fuzzing */ replaced link to GotDotNet with new CodePlex site

__NOTOC__
Please send comments or questions to the [https://lists.owasp.org/mailman/listinfo/owasp-phoenix Phoenix-OWASP mailing-list].

==LiveCDs==
Monday, January 29, 2007 4:02 PM 828569600 AOC_Labrat-ALPHA-0010.iso - http://www.packetfocus.com/hackos/ 
DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/ 

==Test sites / testing grounds==
SPI Dynamics (live) - http://zero.webappsecurity.com/ 
Cenzic (live) - http://crackme.cenzic.com/ 
Watchfire (live) - http://demo.testfire.net/ 
Acunetix (live) - http://testphp.acunetix.com/ http://testasp.acunetix.com http://testaspnet.acunetix.com 
WebMaven / Buggy Bank (includes live testsite) - http://www.mavensecurity.com/webmaven 
Foundstone SASS tools - http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/s3i_tools.htm 
OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project 
OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator 
Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/ 
SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/ 

==HTTP proxying / editing==
WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project 
Burp - http://www.portswigger.net/ 
Paros - http://www.parosproxy.org/ 
Fiddler - http://www.fiddlertool.com/ 
Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/ 
Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project 
Suru - http://www.sensepost.com/research/suru/ 
httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/ 
Charles - http://www.xk72.com/charles/ 
Odysseus - http://www.bindshell.net/tools/odysseus 
Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/ 
Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/ 
JS Commander - http://jscmd.rubyforge.org/ 

==RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools==
Wfuzz - http://www.edge-security.com/wfuzz.php 
ProxMon - http://www.isecpartners.com/proxmon.html 
Wapiti - http://wapiti.sourceforge.net/ 
Grabber - http://rgaucher.info/beta/grabber/ 
XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py 
CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project 
HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm 
JBroFuzz - http://sourceforge.net/projects/jbrofuzz 
XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/ 
WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/ 
Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/ 
[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz 
RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter 
screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html 
SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml 
RFuzz - http://rfuzz.rubyforge.org/ 
WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999 
TestMaker - http://www.pushtotest.com/Docs/downloads/features.html 
ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/ 
WSTool - http://wstool.sourceforge.net/ 
Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/ 
Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/ 
HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/ 
Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/ 
PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743 

==HTTP general testing / fingerprinting==
Wbox: HTTP testing tool - http://hping.org/wbox/ 
ht://Check - http://htcheck.sourceforge.net/ 
Mumsie - http://www.lurhq.com/tools/mumsie.html 
WebInject - http://www.webinject.org/ 
Torture.pl Home Page - http://stein.cshl.org/~lstein/torture/ 
JoeDog's Seige - http://www.joedog.org/JoeDog/Siege/ 
OPEN-LABS: metoscan (http method testing) - http://www.open-labs.org/ 
Load-balancing detector - http://ge.mine.nu/lbd.html 
HMAP - http://ujeni.murkyroc.com/hmap/ 
Net-Square: httprint - http://net-square.com/httprint/ 
Wpoison: http stress testing - http://wpoison.sourceforge.net/ 
Net-square: MSNPawn - http://net-square.com/msnpawn/index.shtml 
hcraft: HTTP Vuln Request Crafter - http://druid.caughq.org/projects/hcraft/ 
rfp.labs: LibWhisker - http://www.wiretrip.net/rfp/lw.asp 
Nikto - http://www.cirt.net/code/nikto.shtml 
twill - http://twill.idyll.org/ 
DirBuster - http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project 
[ZIP] DFF Scanner - http://security-net.biz/files/dff/DFF.zip 
[ZIP] The Elza project - http://packetstormsecurity.org/web/elza-1.4.7-beta.zip http://www.stoev.org/elza.html 
HackerFox(http://yehg.co.nr) : Portable Firefox with web hacking addons bundled - http://sf.net/projects/hackfox

==Browser-based HTTP tampering / editing / replaying==
TamperIE - http://www.bayden.com/Other/ 
isr-form - http://www.infobyte.com.ar/developments.html 
Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/ 
Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/ 
UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/ 
TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/ 
DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/ 
LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/ 

==Cookie editing / poisoning==
[TGZ] stompy: session id tool - http://lcamtuf.coredump.cx/stompy.tgz 
Add'N Edit Cookies (AnEC, Firefox Add-on) - http://addneditcookies.mozdev.org/ 
CookieCuller (Firefox Add-on) - http://cookieculler.mozdev.org/ 
CookiePie (Firefox Add-on) - http://www.nektra.com/oss/firefox/extensions/cookiepie/ 
CookieSpy - http://www.codeproject.com/shell/cookiespy.asp 
Cookies Explorer - http://www.dutchduck.com/Features/Cookies.aspx 

==Ajax and XHR scanning==
Sahi - http://sahi.co.in/ 
scRUBYt - http://scrubyt.org/ 
jQuery - http://jquery.com/ 
jquery-include - http://www.gnucitizen.org/projects/jquery-include 
Sprajax - http://www.denimgroup.com/sprajax.html 
Watir - http://wtr.rubyforge.org/ 
Watij - http://watij.com/ 
Watin - http://watin.sourceforge.net/ 
RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/ 
SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin 
Javascript Inline Debugger (jasildbg) - http://jasildbg.googlepages.com/ 
Firebug Lite - http://www.getfirebug.com/lite.html 
firewaitr - http://code.google.com/p/firewatir/ 

==RSS extensions and caching==
LiveLines (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/324/ 
rss-cache - http://www.dubfire.net/chris/projects/rss-cache/ 

==SQL injection scanning==
0x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php 
SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project 
sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/ 
JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html 
BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html 
sqlmap - http://sqlmap.sourceforge.net/ 
Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/ 
FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas 
PRIAMOS - http://www.priamos-project.com/ 

==Web application security malware, backdoors, and evil code==
W3AF: Web Application Attack and Audit Framework - http://w3af.sourceforge.net/ 
Jikto - http://busin3ss.name/jikto-in-the-wild/ 
XSS Shell - http://ferruh.mavituna.com/article/?1338 
XSS-Proxy - http://xss-proxy.sourceforge.net 
AttackAPI - http://www.gnucitizen.org/projects/attackapi/ 
FFsniFF - http://azurit.elbiahosting.sk/ffsniff/ 
HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/ 
BeEF - http://www.bindshell.net/tools/beef/ 
Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/ 
What is my IP address? - http://reglos.de/myaddress/ 
xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm 
SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/ 
Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval 
Technika - http://www.gnucitizen.org/projects/technika/ 
Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet 
MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/ 

==Web application services that aid in web application security assessment==
Netcraft - http://www.netcraft.net 
AboutURL - http://www.abouturl.com/ 
The Scrutinizer - http://www.scrutinizethis.com/ 
net.toolkit - http://clez.net/ 
ServerSniff - http://www.serversniff.net/ 
Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/ 
Webmaster-Toolkit - http://www.webmaster-toolkit.com/ 
myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address 
PHP charset encoding - http://h4k.in/encoding 
data: URL testcases - http://h4k.in/dataurl 

==Browser-based security fuzzing / checking==
Zalewski's MangleMe - http://lcamtuf.coredump.cx/mangleme/mangle.cgi 
hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/ 
Peach Fuzzer Framework - http://peachfuzz.sourceforge.net/ 
TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html 
PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html 
COMRaider - http://labs.idefense.com 
bcheck - http://bcheck.scanit.be/bcheck/ 
Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects 
LinkScanner - http://linkscanner.explabs.com/linkscanner/default.asp 
BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/ 
Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php 
Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7 
Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html 
Mozilla Activex - http://www.iol.ie/~locka/mozilla/mozilla.htm 
Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/ 
Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/ 
Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324 
About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/ 
Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1 

==PHP static analysis and file inclusion scanning==
PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/ 
Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php 
FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25 
PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit 

==Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources==
APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS 
PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/ 
dotnetids - http://code.google.com/p/dotnetids/ 
Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html 
Remo: whitelist rule editor for mod_security - http://remo.netnea.com/ 
GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules 
The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/ 
mod_security rules generator - http://noeljackson.com/tools/modsecurity/ 
Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3 
[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz 
AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99 
Akismet: blog spam defense - http://akismet.com/ 
Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/ 

==Web services enumeration / scanning / fuzzing==
WebServiceStudio2.0 - http://www.codeplex.com/WebserviceStudio 
Net-square: wsChess - http://net-square.com/wschess/index.shtml 
WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project 
SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm 
iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html 

==Web application non-specific static source-code analysis==
Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/ 
Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1 
Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project 
An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/ 
A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html 
A smaller, but also good list - http://spinroot.com/static/ 

==Static analysis for C/C++ (CGI, ISAPI, etc) in web applications==
RATS - http://www.securesoftware.com/resources/download_rats.html 
ITS4 - http://www.cigital.com/its4/ 
FlawFinder - http://www.dwheeler.com/flawfinder/ 
Splint - http://www.splint.org/ 
Uno - http://spinroot.com/uno/ 
BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net 
Valgrind - http://www.valgrind.org/ 

==Java static analysis, security frameworks, and web application security tools==
HDIV Struts - http://hdiv.org/ 
Orizon - http://sourceforge.net/projects/orizon/ 
FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/ 
PMD - http://pmd.sourceforge.net/ 
CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/ 
EMMA - http://emma.sourceforge.net/ 
JLint - http://jlint.sourceforge.net/ 
Java PathFinder - http://javapathfinder.sourceforge.net/ 
Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/ 
Checkstyle - http://checkstyle.sourceforge.net/ 
Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver 
tinapoc - http://sourceforge.net/projects/tinapoc 
jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html 
Solex - http://solex.sourceforge.net/ 
Java Explorer - http://metal.hurlant.com/jexplore/ 
HTTPClient - http://www.innovation.ch/java/HTTPClient/ 
another HttpClient - http://jakarta.apache.org/commons/httpclient/ 
a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html 

==Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET==
Orcas - http://msdn.microsoft.com/vstudio/express/future/downloads/default.aspx 
Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx 
FxCop - http://blogs.msdn.com/fxcop/ http://www.gotdotnet.com/team/fxcop/ 
Microsoft Application Verifier - http://www.microsoft.com/technet/prodtechnol/windows/appcompatibility/appverifier.mspx 
Microsoft internal tools you can't have yet - http://www.microsoft.com/windows/cse/pa_projects.mspx http://research.microsoft.com/Pex/ http://www.owasp.org/images/5/5b/OWASP_IL_7_FuzzGuru.pdf 

==Threat modeling==
Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en 
Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php 
Octotrike - http://www.octotrike.org/ 

==Add-ons for Firefox that help with general web application security==
Web Developer Toolbar - https://addons.mozilla.org/firefox/60/ 
Plain Old Webserver (POW) - https://addons.mozilla.org/firefox/3002/ 
XML Developer Toolbar - https://addons.mozilla.org/firefox/2897/ 
Public Fox - https://addons.mozilla.org/firefox/3911/ 
XForms Buddy - http://beaufour.dk/index.php?sec=misc&pagename=xforms 
MR Tech Local Install - http://www.mrtech.com/extensions/local_install/ 
Nightly Tester Tools - http://users.blueprintit.co.uk/~dave/web/firefox/buildid/index.html 
IE Tab - https://addons.mozilla.org/firefox/1419/ 
User-Agent Switcher - https://addons.mozilla.org/firefox/59/ 
ServerSwitcher - https://addons.mozilla.org/firefox/2409/ 
HeaderMonitor - https://addons.mozilla.org/firefox/575/ 
RefControl - https://addons.mozilla.org/firefox/953/ 
refspoof - https://addons.mozilla.org/firefox/667/ 
No-Referrer - https://addons.mozilla.org/firefox/1999/ 
LocationBar^2 - https://addons.mozilla.org/firefox/4014/ 
SpiderZilla - http://spiderzilla.mozdev.org/ 
Slogger - https://addons.mozilla.org/en-US/firefox/addon/143 
Fire Encrypter - https://addons.mozilla.org/firefox/3208/ 

==Add-ons for Firefox that help with Javascript and Ajax web application security==
Selenium IDE - http://www.openqa.org/selenium-ide/ 
Firebug - http://www.joehewitt.com/software/firebug/ 
Venkman - http://www.mozilla.org/projects/venkman/ 
Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/ 
Greasemonkey - http://www.greasespot.net/ 
Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/ 
User script compiler - http://arantius.com/misc/greasemonkey/script-compiler 
Extension Developer's Extension (Firefox Add-on) - http://ted.mielczarek.org/code/mozilla/extensiondev/ 
Smart Middle Click (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/3885/ 

==Bookmarklets that aid in web application security==
RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html 
BMlets - http://optools.awardspace.com/bmlet.html 
Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/ 
Blummy: consists of small widgets, called blummlets, which make use of Javascript to provide
rich functionality - http://www.blummy.com/ 
Bookmarklets every blogger should have - http://www.micropersuasion.com/2005/10/bookmarklets_ev.html 
Flat Bookmark Editing (Firefox Add-on) - http://n01se.net/chouser/proj/mozhack/ 
OpenBook and Update Bookmark (Firefox Add-ons) - http://www.chuonthis.com/extensions/ 

==SSL certificate checking / scanning==
[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip 
[ZIP] Foundstone SSLDigger - http://www.foundstone.com/us/resources/termsofuse.asp?file=ssldigger.zip 
Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/ 

==Honeyclients, Web Application, and Web Proxy honeypots==
Honeyclient Project: an open-source honeyclient - http://www.honeyclient.org/trac/ 
HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/ 
Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/ 
Google Hack Honeypot - http://ghh.sourceforge.net/ 
PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/ 
SpyBye - http://www.monkey.org/~provos/spybye/ 
Honeytokens - http://www.securityfocus.com/infocus/1713 

==Blackhat SEO and maybe some whitehat SEO==
SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/ 
SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html 
SEOQuake (Firefox Add-on) - http://www.seoquake.com/ 

==Footprinting for web application security==
Evolution - http://www.paterva.com/evolution-e.html 
GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/ 
Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/ 
Edge-Security tools - http://www.edge-security.com/soft.php 
Fierce Domain Scanner - http://ha.ckers.org/fierce/ 
Googlegath - http://www.nothink.org/perl/googlegath/ 
Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/ 
Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/ 
CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/ 
BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/ 
TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/ 
DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819/ 
Digger (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1467/ 

==Database security assessment==
Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/ 

==Browser Defenses==
DieHard - http://www.diehard-software.org/ 
LocalRodeo (Firefox Add-on) - http://databasement.net/labs/localrodeo/ 
NoMoXSS - http://www.seclab.tuwien.ac.at/projects/jstaint/ 
Request Rodeo - http://savannah.nongnu.org/projects/requestrodeo 
FlashBlock (Firefox Add-on) - http://flashblock.mozdev.org/ 
CookieSafe (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2497 
NoScript (Firefox Add-on) - http://www.noscript.net/ 
FormFox (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1579/ 
Adblock (Firefox Add-on) - http://adblock.mozdev.org/ 
httpOnly in Firefox (Firefox Add-on) - http://blog.php-security.org/archives/40-httpOnly-Cookies-in-Firefox-2.0.html 
SafeCache (Firefox Add-on) - http://www.safecache.com/ 
SafeHistory (Firefox Add-on) - http://www.safehistory.com/ 
PrefBar (Firefox Add-on) - http://prefbar.mozdev.org/ 
All-in-One Sidebar (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1027/ 
QArchive.org web file checker (Firefox Add-on) - https://addons.mozilla.org/firefox/4115/ 
Update Notified (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2098/ 
FireKeeper - http://firekeeper.mozdev.org/ 
Greasemonkey: XSS Malware Script Detector (http://yehg.co.nr) - http://userscripts.org/scripts/show/22955

==Browser Privacy==
TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/firefox/3173/ 
Privacy Bird - http://www.privacybird.com/ 

==Application and protocol fuzzing (random instead of targeted)==
Sulley - http://fuzzing.org/ 
taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/ 
zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/ 
autodafé: an act of software torture - http://autodafe.sourceforge.net/ 
EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html

User:ParanoidMike

2008-07-20T06:05:36Z

ParanoidMike:

Who: Mike Smith-Lonergan

What: Security Consultant in the Security Center of Excellence group at Intel.

Where: Portland, OR

Why: I'm here to make what contributions I can to this site (which to me appears to be one of the strongest online resources dedicated to Threat Modeling and to providing actionable mitigations for software vulnerabilities).

[http://paranoidmike.blogspot.com Sporadic blog]

[http://www.codeplex.com/site/users/view/MikeSL Codeplex open-source software projects]

User:ParanoidMike

2008-07-20T06:05:08Z

ParanoidMike:

Who: Mike Smith-Lonergan

What: Security Consultant in the Security Center of Excellence group at Intel.

Where: Portland, OR

Why: I'm here to make what contributions I can to this site (which to me appears to be one of the strongest online resources dedicated to Threat Modeling and to providing actionable mitigations for software vulnerabilities).

[http://paranoidmike.blogspot.com Sporadic blog]
[http://www.codeplex.com/site/users/view/MikeSL Codeplex open-source software projects]

User:ParanoidMike

2008-07-20T06:03:07Z

ParanoidMike: New page: Who: Mike Smith-Lonergan What: Security Consultant in the Security Center of Excellence group at Intel. Where: Portland, OR Why: I'm here to make what contributions I can to this site (whi...

Who: Mike Smith-Lonergan
What: Security Consultant in the Security Center of Excellence group at Intel.
Where: Portland, OR
Why: I'm here to make what contributions I can to this site (which to me appears to be one of the strongest online resources dedicated to Threat Modeling and to providing actionable mitigations for software vulnerabilities).

FxCop

2008-07-20T05:27:51Z

ParanoidMike: /* References */ added reference to Smokey (tool similar to FxCop)

FxCop

2008-07-20T05:14:21Z

ParanoidMike: /* References */ added Documentation link