OWASP - User contributions [en]

GSoC2019 Ideas

2019-01-10T19:57:38Z

Riiecco: /* OWASP-SKF (draft) */

=OWASP Project Requests=

'''Tips to get you started in no particular order:'''
'''* Read [https://developers.google.com/open-source/gsoc/ Google Summer of Code Program(GSOC)]`'''
'''* Read the [[GSoC SAT]] '''
* Read the [https://www.owasp.org/index.php/GSoC GSOC Student Guidelines]
* Contact us through the mailing list or irc channel.
* Check our [https://github.com/OWASP github organization]

==OWASP-SKF (draft)==
Idea 1:

Build lab examples and write-ups (how to test) for different vulnerabilities over different technology stacks. These challenges are to be delivered in Docker so they can be

easily deployed.

In the current situation the security knowledge framework ultimately presents a list of security controls with correlating knowledge base items that contain a description and

a solution. The new labs are used to give the software developers or application security specialists a more in depth understanding and approach on how to test the

vulnerabilities in their own code.
* For example we have now around 20 lab challenges in Docker container build in Python:
** A Local File Inclusion Docker app example:
*** https://github.com/blabla1337/skf-labs/tree/master/LFI
** A write-up example:
*** https://owasp-skf.gitbook.io/asvs-write-ups/filename-injection
The images that are pushed to the Github repository are already automatically build and pushed to a docker registry where the SKF users can easily pull the images from to get their

labs running. Of course they can download it and build it themselves from source by pulling the original repository.

Idea 2:

We want to extend the Machine learning chatbot functionality in SKF.
* Create a desktop version of the chatbot. Where people can install the setup file on their local machine.
* Extend the bots capability to do the google search(using web scraping) for the things which are not available in the database. So, it will have a wider scope of knowledge.
* Extend the bot capability to reply what security controls should be followed from the ASVS and MASVS or other custom checklists that are present in SKF.
* Extend the bot to different platforms like Facebook, telegram, slack etc.
** Now the working chatbot implementation for example is only for Gitter

== OWASP DefectDojo ==
OWASP DefectDojo is a popular open source vulnerability management tool, used as the backbone for security programs. It is easy to get started with and work on! We welcome volunteers of all experience levels and are happy to provide mentorship.

Option 1: Unit Tests - Difficulty: Easy
* If you're new to programming, unit tests are short scripts designed to test a specific function of an application.
* The project needs additional unit tests to ensure that new code functions properly.
Option 2: Feature Enhancement - Difficulty: Varies
* The functionality of DefectDojo is constantly expanding.
* Feature enhancements offer programming challenges for all levels of experience.
Option 3: Pull Request Review - Difficulty: Moderate - Hard
* Test pull requests and provide feedback on code.

== OHP (OWASP Honeypot) ==

OWASP Honeypot is an open source software in Python language which designed for creating honeypot and honeynet in an easy and secure way! This project is compatible with Python 2.x and 3.x and tested on Windows, Mac OS X and Linux.

=== Getting Start ===

It's best to start from [https://github.com/zdresearch/OWASP-Honeypot/wiki GitHub wiki page], we are looking forward to add more modules and optimize the core.

=== Technologies ===

Currently we are using

* Docker
* Python
* MongoDB
* TShark
* Flask
* ChartJS
* And more linux services

=== Expected Results ===
...

=== Roadmap ===

...

=== Students Requirements ===

* Python
* Packet Analysis
* Docker
* Database

=== Mentors and Leaders ===

* [mailto:ali.razmjoo@owasp.org Ali Razmjoo] (Mentor & Project Leader)
* [mailto:reza.espargham@owasp.org Reza Espargham](Mentor)
* [mailto:abiusx@owasp.org Abbas Naderi] (Mentor)

== OWASP Juice Shop ==

[[OWASP Juice Shop Project]] is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and Angular. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a "guinea pig"-application to check how well their tools cope with Javascript-heavy application frontends and REST APIs.
The best way to get in touch with us is the '''community chat on https://gitter.im/bkimminich/juice-shop<nowiki/>.''' You can also send PMs to the potential mentors (@bkimminich, @wurstbrot and @J12934) there if you like!

To receive early feedback please '''put your proposal on Google Docs and submit it to the OWASP Organization on Google's GSoC page''' in ''Draft Shared'' mode. Please pick '''''juice shop'' as Proposal Tag''' to make them easier to find for us. '''Thank you!'''

=== Challenge Pack 2019 ===

'''Brief Explanation:'''

Ideas for potential new hacking challenges are collected in [https://github.com/bkimminich/juice-shop/issues?q=is%3Aissue+is%3Aopen+label%3Achallenge GitHub issues labeled "challenge"]. This project could implement a whole bunch of challenges one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with additional ideas for challenges would be part of the project scope, as the list of pre-existing ideas might not be sufficient for a GSoC project.

'''Expected Results:'''
* 10 or more new challenges for OWASP Juice Shop (including required functional enhancements to place the challenges)
* Each challenge comes with full functional unit and integration tests
* Each challenge is verified to be exploitable by corresponding end-to-end tests
* Hint and solution sections for each new challenge are added to the "Pwning OWASP Juice Shop" ebook
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) Angular and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [[User:Bjoern_Kimminich|Bjoern Kimminich]] - OWASP Juice Shop Project Leader
* [[User:Timo Pagel|Timo Pagel]] - OWASP Juice Shop Project Collaborator
* Jannik Hollenbach - OWASP Juice Shop Project Collaborator

=== Hacking Instructor ===

'''Brief Explanation:'''

TODO

'''Expected Results:'''

TODO

''' Getting started: '''

TODO

'''Knowledge Prerequisites:'''

TODO

'''Mentors:'''
* [[User:Bjoern_Kimminich|Bjoern Kimminich]] - OWASP Juice Shop Project Leader

=== Your idea ===

'''Brief Explanation:'''

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

''' Getting started '''
* Get in touch with [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich]

'''Expected Results:'''
* A new feature that makes OWASP Juice Shop even better
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) Angular and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [[User:Bjoern_Kimminich|Bjoern Kimminich]] - OWASP Juice Shop Project Leader

GSoC2019 Ideas

2019-01-10T19:57:23Z

Riiecco: /* OWASP-SKF (draft) */

OWASP Security Knowledge Framework

2018-08-27T18:36:29Z

Riiecco: /* Classifications */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Use SKF to gather the right security requirements for your projects
* SKF then gives extensive knowledgebase items that correlates to the security requirements
* Developers can close "tickets" and leave an audit trail to determine possible technical depts or improvements
* Security specialist can follow the "tickets" and audit trail and verify or Fail closed items and provide feedback.

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation

== Project Online Demo ==
'''username: admin password: test-skf'''
* https://demo.securityknowledgeframework.org 

'''Project website:'''
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| rowspan="2" align="center" valign="top" width="50%" | [[File:Midlevel.png]]
| align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Milestones / Roadmap and Getting Involved =

==Next major release features==
* Implement the MASVS Knowledge base items in the OWASP-SKF project

* Implement MASVS process flow under the new project section
* Implement dynamic checklist creation for custom checklists to process flow under the new project section
* Add CWE to Knowledge base items
* Add how to pentest section per Knowledge base item (OWASP-Testing Guide)
* Add internationalist feature to SKF for supporting multiple human languages
* Market and brand the new AI chat-bot implementation
* Add dynamic questionnaire creation that links questions to security requirements

Check out the detailed roadmap here:

'''[https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== CI-Pipeline ==

=== Travis-ci.org: ===
<code>Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes! SKF Build details:</code>
<nowiki>https://travis-ci.org/blabla1337/skf-flask</nowiki>

=== Coveralls.io Python: ===
<code>DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite. SKF Coveralls details:</code>
<nowiki>https://coveralls.io/r/blabla1337/skf-flask</nowiki>

=== codecov.io for Angular: ===
<code>Code coverage done right. Highly integrated with GitHub, Bitbucket and GitLab. SKF codecov details:</code>
<nowiki>https://codecov.io/gh/blabla1337/skf-flask</nowiki>

=== Scrutinizer-ci.com: ===
<code>Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality. SKF Scrutinizer details:</code>
<nowiki>https://scrutinizer-ci.com/g/blabla1337/skf-flask/</nowiki>

=== Bithound.io NPM packages: ===
<code>BitHound provides your Node team with comprehensive and prioritized issues in your code and npm packages. SKF Bithound details:</code>
<nowiki>https://www.bithound.io/github/blabla1337/skf-flask</nowiki>

=== Requires.io pip packages: ===
<code>Stay Up-to-date! Stay secure! Requires.io monitors your Python projects dependencies, and notify you whenever any of your dependency is out-of-date. SKF Requires details:</code>
<nowiki>https://requires.io/github/blabla1337/skf-flask/requirements/</nowiki>

=== Black Duck Security Risk: ===
<code>Announcing Black Duck CoPilot, a new service helping open source project teams catalog and report on their project's dependencies. SKF Requires details:</code>
<nowiki>https://copilot.blackducksoftware.com/github/groups/blabla1337/locations/skf-flask/public/results</nowiki>

=== uptimerobot.com: ===
<code>Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.</code>

=== ssllabs.com & sslbadge.org: ===
<code>ssllabs.org: Bringing you the best SSL/TLS and PKI testing tools and documentation. sslbadge.org: Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.</code>

__NOTOC__ <headertabs></headertabs>

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2017-07-10T20:46:35Z

Riiecco: /* Roadmap */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Use SKF to gather the right security requirements for your projects
* SKF then gives extensive knowledgebase items that correlates to the security requirements
* Developers can close "tickets" and leave an audit trail to determine possible technical depts or improvements
* Security specialist can follow the "tickets" and audit trail and verify or Fail closed items and provide feedback.

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation

== Project Online Demo ==
'''username: admin password: test-skf'''
* https://demo.securityknowledgeframework.org 

'''Project website:'''
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| rowspan="2" align="center" valign="top" width="50%" | [[File:Midlevel.png]]
| align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add generic Selenium test cases for the pre-development and post-development security controls.
- Add current code examples and refer them in the advices of the pre-development and post-development items.
- Add CWE to checklists
- Add Python code examples
- Add Java code examples
- Explain the SDLC more in-depth on our website and OWASP wiki page.
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== CI-Pipeline ==

=== Travis-ci.org: ===
<code>Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes! SKF Build details:</code>
<nowiki>https://travis-ci.org/blabla1337/skf-flask</nowiki>

=== Coveralls.io Python: ===
<code>DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite. SKF Coveralls details:</code>
<nowiki>https://coveralls.io/r/blabla1337/skf-flask</nowiki>

=== codecov.io for Angular: ===
<code>Code coverage done right. Highly integrated with GitHub, Bitbucket and GitLab. SKF codecov details:</code>
<nowiki>https://codecov.io/gh/blabla1337/skf-flask</nowiki>

=== Scrutinizer-ci.com: ===
<code>Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality. SKF Scrutinizer details:</code>
<nowiki>https://scrutinizer-ci.com/g/blabla1337/skf-flask/</nowiki>

=== Bithound.io NPM packages: ===
<code>BitHound provides your Node team with comprehensive and prioritized issues in your code and npm packages. SKF Bithound details:</code>
<nowiki>https://www.bithound.io/github/blabla1337/skf-flask</nowiki>

=== Requires.io pip packages: ===
<code>Stay Up-to-date! Stay secure! Requires.io monitors your Python projects dependencies, and notify you whenever any of your dependency is out-of-date. SKF Requires details:</code>
<nowiki>https://requires.io/github/blabla1337/skf-flask/requirements/</nowiki>

=== Black Duck Security Risk: ===
<code>Announcing Black Duck CoPilot, a new service helping open source project teams catalog and report on their project's dependencies. SKF Requires details:</code>
<nowiki>https://copilot.blackducksoftware.com/github/groups/blabla1337/locations/skf-flask/public/results</nowiki>

=== uptimerobot.com: ===
<code>Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.</code>

=== ssllabs.com & sslbadge.org: ===
<code>ssllabs.org: Bringing you the best SSL/TLS and PKI testing tools and documentation. sslbadge.org: Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.</code>

__NOTOC__ <headertabs></headertabs>

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2017-07-10T20:04:04Z

Riiecco: /* Travis-ci.org: */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Use SKF to gather the right security requirements for your projects
* SKF then gives extensive knowledgebase items that correlates to the security requirements
* Developers can close "tickets" and leave an audit trail to determine possible technical depts or improvements
* Security specialist can follow the "tickets" and audit trail and verify or Fail closed items and provide feedback.

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

Installation guide with Chef:
* https://skf.readme.io/docs/installation#section-automated-installation-with-chef 

Installation guide for AWS:
* https://skf.readme.io/docs/installation#section-aws-installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add generic Selenium test cases for the pre-development and post-development security controls.
- Add current code examples and refer them in the advices of the pre-development and post-development items.
- Add CWE to checklists
- Add Python code examples
- Add Java code examples
- Explain the SDLC more in-depth on our website and OWASP wiki page.
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =

;

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs></headertabs>

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2017-07-10T19:58:56Z

Riiecco: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Use SKF to gather the right security requirements for your projects
* SKF then gives extensive knowledgebase items that correlates to the security requirements
* Developers can close "tickets" and leave an audit trail to determine possible technical depts or improvements
* Security specialist can follow the "tickets" and audit trail and verify or Fail closed items and provide feedback.

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

Installation guide with Chef:
* https://skf.readme.io/docs/installation#section-automated-installation-with-chef 

Installation guide for AWS:
* https://skf.readme.io/docs/installation#section-aws-installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add generic Selenium test cases for the pre-development and post-development security controls.
- Add current code examples and refer them in the advices of the pre-development and post-development items.
- Add CWE to checklists
- Add Python code examples
- Add Java code examples
- Explain the SDLC more in-depth on our website and OWASP wiki page.
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =

;[[user:Foobar|Glenn ten Cate]]
;[[user:Riccardo_ten_Cate|Riccardo ten Cate]]
;Alexander Kaasjager
;John Haley
;Daniel Paulus
;Erik de Kuijper
;Roderick Schaefer
;[[user:Jmanico|Jim Manico]]
;Martijn Gijsberti Hodenpijl
;Bithin Alangot
;[[user:Knoblochmartin|Martin Knobloch]]
;Adam Fisher
;Tom wirschell
;[[user:johestephan|Joerg Stephan]]
;Mihai Roman

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs></headertabs>

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

GSOC2017 Ideas

2017-01-23T23:21:47Z

Riiecco:

=OWASP Project Requests=

'''Tips to get you started in no particular order:'''
* Read the [[GSoC SAT]]
* Check out the suggested projects below
* Contact the mentors and teams of the projects that you are interested in

== OWASP Juice Shop ==

[[OWASP Juice Shop Project]] is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and AngularJS. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a "guinea pig"-application to check how well their tools cope with Javascript-heavy application frontends and REST APIs.

=== Challenge Pack 2017 ===

'''Brief Explanation:'''

Ideas for potential new hacking challenges are collected in [https://github.com/bkimminich/juice-shop/issues?q=is%3Aissue+is%3Aopen+label%3Achallenge GitHub issues labeled "challenge"]. This project could implement a whole bunch of challenges one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with additional ideas for challenges would be part of the project scope, as the list of pre-existing ideas might not be sufficient for a GSoC project.

'''Expected Results:'''
* 10 or more new challenges for OWASP Juice Shop (including required functional enhancements to place the challenges in, e.g. the [https://github.com/bkimminich/juice-shop/issues/244 Order Dashboard] and [https://github.com/bkimminich/juice-shop/issues/243 Pomace Recycling user stories])
* Each challenge comes with full functional unit and integration tests
* Each challenge is verified to be exploitable by corresponding end-to-end tests
* Hint and solution sections for each new challenge are added to the "Pwning OWASP Juice Shop" ebook
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) AngularJS (1.x) and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

=== Tech Stack Update ===

'''Brief Explanation:'''

Development of OWASP Juice Shop started in 2014 and was based on - back then - quite recent Javascript frameworks and modules:

* AngularJS 1.x with Bootstrap in the client
* Express on top of NodeJS on the server with
** SQLite as a database
** Sequelize as an OR-Mapper
*** sequelize-restful as an automatic API-generator on top of the DB entities
* Jasmine 1.x to specify behavioral tests
** Karma as a test runner for the client-side unit tests
** Frisby.js for API tests on a dynamically launched server
** Protractor for end-to-end testing of the challenge exploits
* NPM for running/testing the application
* Grunt for some of the custom build scripts

Several of the above frameworks or modules have moved on to new (runtime incompatible) major releases, namely [https://github.com/bkimminich/juice-shop/issues/165 Angular 2], [https://github.com/bkimminich/juice-shop/issues/167 Sequelize], [https://github.com/bkimminich/juice-shop/issues/164 Frisby and Jasmine]. Other modules are out of maintenance entirely, e.g. [https://github.com/bkimminich/juice-shop/issues/167 sequelize-restful].

Migrating the OWASP Juice Shop to the latest versions of the mentioned frameworks & modules is an important step to keep the application relevant as ''the most modern'' intentionally broken web application. Moving to entirely different frameworks might be taken into considerationas well.

'''Expected Results:'''
* High-level target architecture overview including a migration plan with intermediary milestones
* Execution of migration without breaking functionality or losing tests along the way
* Code follows existing (or new) styleguides and passes all existing (or new) quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, experience with latest Javascript frameworks for frontend, backend, testing and building (e.g. AngularJS 2.x, Jasmine 2.x, ...)

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

=== Your idea ===

'''Brief Explanation:'''

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

''' Getting started '''
* Get in touch with [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich]

'''Expected Results:'''
* A new feature that makes OWASP Juice Shop even better
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) AngularJS (1.x) and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

== OWASP Mobile Hacking Playground ==

The OWASP Mobile Hacking Playground (https://github.com/OWASP/OMTG-Hacking-Playground) is part of the OWASP Mobile universe, which consists at the moment of the following projects:

* Mobile Application Security Verification (MASVS). The MASVS is a list of security requirements for mobile applications that can be used by architects, developers, testers, security professionals, and consumers to define what a secure mobile application is. (https://github.com/OWASP/owasp-masvs)
* Mobile Security Testing Guide (MSTG). The OWASP MSTG is a comprehensive manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for dynamic and static security tests, and to help ensure completeness and consistency of the tests. (https://github.com/OWASP/owasp-mstg)

In order to give also practical guidance to developers, security researches and penetration testers of mobile Apps, a hacking playground was created with the goal to create different mobile App’s that contain different vulnerabilities that map to the MSTG test cases. Every test case described in the MSTG will therefore be implemented in an Android and iOS App. This has two advantages:

* A developer can identify vulnerable code in the provided App’s and can see the implications and risks if such patterns are used and can look for the best practices in the MSTG to mitigate the vulnerabilities.
* Penetration testers / security researchers can identify bad practices, dangerous methods and classes they should look for when assessing a Mobile App and can gain more knowledge through the information provided in the OMTG.

It is also encouraged to use the App(s) for education purpose during trainings and workshops.

=== Creation of Android Code Samples ===

'''Brief Explanation:'''

An Android App that maps to the MSTG test cases is already created. This App contains mostly test cases that are related to data storage on an Android device. In order to close the gap to the MSTG more test cases need to be added that show "bad practices" that lead to vulnerabilites, but also the latest security best practices to demonstrate how vulnerabilites can be mitigated.

For examples of implemented test cases, see the Wiki of the Mobile Hacking Playground: https://github.com/OWASP/OMTG-Hacking-Playground/wiki/Android-App

'''Expected Results:'''

The following categories and their test cases are not fully added to the Android App:

* Cryptography (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x08-V3-Cryptography_Verification_Requirements.md)
* Authentication and Session Management (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x09-V4-Authentication_and_Session_Management%20Requirements.md)
* Network Communication (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x10-V5-Network_communication_requirements.md)
* Environmental Interaction (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x11-V6-Interaction_with_the_environment.md)
* Code Quality (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x12-V7-Code_quality_and_build_setting_requirements.md)

For some of the testcases this also includes creating an endpoint on server side in order to fully understand the test case and possible security concerns.

As not all missing test cases can be implemented during the GSOC a subset of them will be defined with the student together.

''' Getting started: '''
Here are a few suggestion on how to get started.
* Check the Mobile Hacking Playground Android App, browse through the code and Wiki to get an understanding of what a test case look likes.
* Browse through the MASVS and check the different areas and their defined requirements.
* Read about Security vulnerabilites and best practices for Android in areas you are interested in (e.g. Cryptography).

'''Knowledge Prerequisites:'''
General interest in Mobile and Security. Basic knowledge of Android and Java.

'''Mentors:''' [mailto:sven.schleier@owasp.org Sven Schleier] - OWASP Mobile Security Testing Guide and Mobile Hacking Playground Project Leader

== OWASP ZAP ==

[[OWASP Zed Attack Proxy Project]] (ZAP) The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. Previous GSoC students have implemented key parts of the ZAP core functionality and have been offered (and accepted) jobs based on their work on ZAP.

We have just included a few of the ideas we have here, for a more complete list see the issues on the ZAP bug tracker with the [https://github.com/zaproxy/zaproxy/issues?q=is%3Aopen+is%3Aissue+label%3Aproject project] label.

=== Field enumeration ===

This would allow a user to iterate though a set of (user defined) characters in order to identify the ones that are filtered out and/or escaped.

The user should be able to define the character sets to test and will probably need to configure the success and failure conditions, as well as valid values for other fields in the form.

''' Expected Results '''

* User able to specify a specific field to enumerate via the ZAP UI
* A list of all valid characters to be returned from the sets of characters the user specifies
* Ability to configure a wide range of success and failure conditions to cope with as many possible situations as possible
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

''' Knowledge Prerequisite: '''
ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

''' Mentors '''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

=== Scripting Code Completion ===

ZAP provides a very powerful scripting interface. Unfortunately to use it effectively is only really possible with a good knowledge of the ZAP internals. Adding code completion (eg using a project like https://github.com/bobbylight/AutoComplete) would significantly help users.

''' Expected Results '''

* Code completion for all of the parameters for all available functions in the standard scripts
* Implementations for JavaScript, JRuby and Jython
* Helper classes with code completion for commonly required functionality
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

''' Knowledge Prerequisite: '''
ZAP is written in Java, so a good knowledge of this language is recommended. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

=== Your idea ===

'''Brief Explanation:'''

ZAP is a great framework for building new and innovative security testing solutions. If you have an idea that is not on this list then don't worry, you can still submit it, we have accepted original projects in previous years and have even paid a student to work on their idea when we did not get enough GSoC slots to accept all of the projects we wanted.

''' Getting started '''
* Get in touch with us :)

'''Expected Results:'''
* A new feature that makes ZAP even better
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

'''Knowledge Prerequisites:'''
ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

== BLT / Bugheist ==

'''Brief Explanation:'''

Bugheist lets anyone report issues they find on the internet. Found something out of place on Amazon.com ? Let them know. Companies are held accountable and shows their response time and history. Get points for reporting bugs and help keep the internet bug free.

''' Getting started '''
* Get in touch with us :)

'''Expected Results:'''
* A new feature that makes Bugheist even better

'''Knowledge Prerequisites:'''
BLT is written in Python / Django, so a good knowledge of this language and framework is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Sauriti Sean Auriti] [mailto:sean.auriti@owasp.org @] and the rest of the BLT Core Team

== OWASP Security Knowledge framework ==

'''Brief Explanation:'''

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages
showing how to prevent hackers gaining access and running exploits on your application.

*In a nutshell*

- Training developers in writing secure code

- Security support pre-development (Security by design, early feedback of possible security issues)

- Security support post-development(Double check your code by means of the OWASP ASVS checklists )

- Code examples for secure coding

''' Getting started '''
* Please send an email to riccardo.ten.cate@owasp.org or glenn.ten.cate@owasp.org and we would love to tell you all about it! :-)

'''Expected Results:'''
* Adding features.
* Adding functions
* Adding/updating code examples.
* Adding/updating Knowledgebase items.
* Adding low/medium level verification testing guides for developers to teach how to manually verify the existence of injection/logic flaws. (pen-testing)

'''Knowledge Prerequisites:'''

* For helping in the development of new features and functions Python flask would come in handy since the framework is written in python flask.
* For writing knowledgebase items only technical knowledge of application security is required.
* For writing /updating code examples you need to know a programming language along with secure development.
* For writing the verification guide you need some penetration testing experience.

'''Mentors:'''

Riccardo ten Cate

Glenn ten Cate

GSOC2017 Ideas

2017-01-23T23:21:23Z

Riiecco:

GSOC2017 Ideas

2017-01-23T23:20:19Z

Riiecco:

=OWASP Project Requests=

'''Tips to get you started in no particular order:'''
* Read the [[GSoC SAT]]
* Check out the suggested projects below
* Contact the mentors and teams of the projects that you are interested in

== OWASP Juice Shop ==

[[OWASP Juice Shop Project]] is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and AngularJS. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a "guinea pig"-application to check how well their tools cope with Javascript-heavy application frontends and REST APIs.

=== Challenge Pack 2017 ===

'''Brief Explanation:'''

Ideas for potential new hacking challenges are collected in [https://github.com/bkimminich/juice-shop/issues?q=is%3Aissue+is%3Aopen+label%3Achallenge GitHub issues labeled "challenge"]. This project could implement a whole bunch of challenges one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with additional ideas for challenges would be part of the project scope, as the list of pre-existing ideas might not be sufficient for a GSoC project.

'''Expected Results:'''
* 10 or more new challenges for OWASP Juice Shop (including required functional enhancements to place the challenges in, e.g. the [https://github.com/bkimminich/juice-shop/issues/244 Order Dashboard] and [https://github.com/bkimminich/juice-shop/issues/243 Pomace Recycling user stories])
* Each challenge comes with full functional unit and integration tests
* Each challenge is verified to be exploitable by corresponding end-to-end tests
* Hint and solution sections for each new challenge are added to the "Pwning OWASP Juice Shop" ebook
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) AngularJS (1.x) and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

=== Tech Stack Update ===

'''Brief Explanation:'''

Development of OWASP Juice Shop started in 2014 and was based on - back then - quite recent Javascript frameworks and modules:

* AngularJS 1.x with Bootstrap in the client
* Express on top of NodeJS on the server with
** SQLite as a database
** Sequelize as an OR-Mapper
*** sequelize-restful as an automatic API-generator on top of the DB entities
* Jasmine 1.x to specify behavioral tests
** Karma as a test runner for the client-side unit tests
** Frisby.js for API tests on a dynamically launched server
** Protractor for end-to-end testing of the challenge exploits
* NPM for running/testing the application
* Grunt for some of the custom build scripts

Several of the above frameworks or modules have moved on to new (runtime incompatible) major releases, namely [https://github.com/bkimminich/juice-shop/issues/165 Angular 2], [https://github.com/bkimminich/juice-shop/issues/167 Sequelize], [https://github.com/bkimminich/juice-shop/issues/164 Frisby and Jasmine]. Other modules are out of maintenance entirely, e.g. [https://github.com/bkimminich/juice-shop/issues/167 sequelize-restful].

Migrating the OWASP Juice Shop to the latest versions of the mentioned frameworks & modules is an important step to keep the application relevant as ''the most modern'' intentionally broken web application. Moving to entirely different frameworks might be taken into considerationas well.

'''Expected Results:'''
* High-level target architecture overview including a migration plan with intermediary milestones
* Execution of migration without breaking functionality or losing tests along the way
* Code follows existing (or new) styleguides and passes all existing (or new) quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, experience with latest Javascript frameworks for frontend, backend, testing and building (e.g. AngularJS 2.x, Jasmine 2.x, ...)

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

=== Your idea ===

'''Brief Explanation:'''

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

''' Getting started '''
* Get in touch with [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich]

'''Expected Results:'''
* A new feature that makes OWASP Juice Shop even better
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) AngularJS (1.x) and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

== OWASP Mobile Hacking Playground ==

The OWASP Mobile Hacking Playground (https://github.com/OWASP/OMTG-Hacking-Playground) is part of the OWASP Mobile universe, which consists at the moment of the following projects:

* Mobile Application Security Verification (MASVS). The MASVS is a list of security requirements for mobile applications that can be used by architects, developers, testers, security professionals, and consumers to define what a secure mobile application is. (https://github.com/OWASP/owasp-masvs)
* Mobile Security Testing Guide (MSTG). The OWASP MSTG is a comprehensive manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for dynamic and static security tests, and to help ensure completeness and consistency of the tests. (https://github.com/OWASP/owasp-mstg)

In order to give also practical guidance to developers, security researches and penetration testers of mobile Apps, a hacking playground was created with the goal to create different mobile App’s that contain different vulnerabilities that map to the MSTG test cases. Every test case described in the MSTG will therefore be implemented in an Android and iOS App. This has two advantages:

* A developer can identify vulnerable code in the provided App’s and can see the implications and risks if such patterns are used and can look for the best practices in the MSTG to mitigate the vulnerabilities.
* Penetration testers / security researchers can identify bad practices, dangerous methods and classes they should look for when assessing a Mobile App and can gain more knowledge through the information provided in the OMTG.

It is also encouraged to use the App(s) for education purpose during trainings and workshops.

=== Creation of Android Code Samples ===

'''Brief Explanation:'''

An Android App that maps to the MSTG test cases is already created. This App contains mostly test cases that are related to data storage on an Android device. In order to close the gap to the MSTG more test cases need to be added that show "bad practices" that lead to vulnerabilites, but also the latest security best practices to demonstrate how vulnerabilites can be mitigated.

For examples of implemented test cases, see the Wiki of the Mobile Hacking Playground: https://github.com/OWASP/OMTG-Hacking-Playground/wiki/Android-App

'''Expected Results:'''

The following categories and their test cases are not fully added to the Android App:

* Cryptography (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x08-V3-Cryptography_Verification_Requirements.md)
* Authentication and Session Management (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x09-V4-Authentication_and_Session_Management%20Requirements.md)
* Network Communication (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x10-V5-Network_communication_requirements.md)
* Environmental Interaction (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x11-V6-Interaction_with_the_environment.md)
* Code Quality (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x12-V7-Code_quality_and_build_setting_requirements.md)

For some of the testcases this also includes creating an endpoint on server side in order to fully understand the test case and possible security concerns.

As not all missing test cases can be implemented during the GSOC a subset of them will be defined with the student together.

''' Getting started: '''
Here are a few suggestion on how to get started.
* Check the Mobile Hacking Playground Android App, browse through the code and Wiki to get an understanding of what a test case look likes.
* Browse through the MASVS and check the different areas and their defined requirements.
* Read about Security vulnerabilites and best practices for Android in areas you are interested in (e.g. Cryptography).

'''Knowledge Prerequisites:'''
General interest in Mobile and Security. Basic knowledge of Android and Java.

'''Mentors:''' [mailto:sven.schleier@owasp.org Sven Schleier] - OWASP Mobile Security Testing Guide and Mobile Hacking Playground Project Leader

== OWASP ZAP ==

[[OWASP Zed Attack Proxy Project]] (ZAP) The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. Previous GSoC students have implemented key parts of the ZAP core functionality and have been offered (and accepted) jobs based on their work on ZAP.

We have just included a few of the ideas we have here, for a more complete list see the issues on the ZAP bug tracker with the [https://github.com/zaproxy/zaproxy/issues?q=is%3Aopen+is%3Aissue+label%3Aproject project] label.

=== Field enumeration ===

This would allow a user to iterate though a set of (user defined) characters in order to identify the ones that are filtered out and/or escaped.

The user should be able to define the character sets to test and will probably need to configure the success and failure conditions, as well as valid values for other fields in the form.

''' Expected Results '''

* User able to specify a specific field to enumerate via the ZAP UI
* A list of all valid characters to be returned from the sets of characters the user specifies
* Ability to configure a wide range of success and failure conditions to cope with as many possible situations as possible
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

''' Knowledge Prerequisite: '''
ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

''' Mentors '''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

=== Scripting Code Completion ===

ZAP provides a very powerful scripting interface. Unfortunately to use it effectively is only really possible with a good knowledge of the ZAP internals. Adding code completion (eg using a project like https://github.com/bobbylight/AutoComplete) would significantly help users.

''' Expected Results '''

* Code completion for all of the parameters for all available functions in the standard scripts
* Implementations for JavaScript, JRuby and Jython
* Helper classes with code completion for commonly required functionality
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

''' Knowledge Prerequisite: '''
ZAP is written in Java, so a good knowledge of this language is recommended. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

=== Your idea ===

'''Brief Explanation:'''

ZAP is a great framework for building new and innovative security testing solutions. If you have an idea that is not on this list then don't worry, you can still submit it, we have accepted original projects in previous years and have even paid a student to work on their idea when we did not get enough GSoC slots to accept all of the projects we wanted.

''' Getting started '''
* Get in touch with us :)

'''Expected Results:'''
* A new feature that makes ZAP even better
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

'''Knowledge Prerequisites:'''
ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

== BLT / Bugheist ==

'''Brief Explanation:'''

Bugheist lets anyone report issues they find on the internet. Found something out of place on Amazon.com ? Let them know. Companies are held accountable and shows their response time and history. Get points for reporting bugs and help keep the internet bug free.

''' Getting started '''
* Get in touch with us :)

'''Expected Results:'''
* A new feature that makes Bugheist even better

'''Knowledge Prerequisites:'''
BLT is written in Python / Django, so a good knowledge of this language and framework is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Sauriti Sean Auriti] [mailto:sean.auriti@owasp.org @] and the rest of the BLT Core Team

== OWASP Security Knowledge framework ==

'''Brief Explanation:'''

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages
showing how to prevent hackers gaining access and running exploits on your application.

*In a nutshell*

- Training developers in writing secure code

- Security support pre-development (Security by design, early feedback of possible security issues)

- Security support post-development(Double check your code by means of the OWASP ASVS checklists )

- Code examples for secure coding

''' Getting started '''
* Please send an email to riccardo.ten.cate@owasp.org or glenn.ten.cate@owasp.org and we would love to tell you all about it! :-)

'''Expected Results:'''
* Adding features.
* Adding functions
* Adding/updating code examples.
* Adding/updating Knowledgebase items.
* Adding low/medium level verification testing guides for developers to teach how to manually verify the existence of injection/logic flaws. (pen-testing)

'''Knowledge Prerequisites:'''
1. For helping in the development of new features and functions Python flask would come in handy since the framework is written in python flask.
2. For writing knowledgebase items only technical knowledge of application security is required.
3. For writing /updating code examples you need to know a programming language along with secure development.
4. For writing the verification guide you need some penetration testing experience.

'''Mentors:'''
Riccardo ten Cate
Glenn ten Cate

GSOC2017 Ideas

2017-01-23T23:18:41Z

Riiecco:

=OWASP Project Requests=

'''Tips to get you started in no particular order:'''
* Read the [[GSoC SAT]]
* Check out the suggested projects below
* Contact the mentors and teams of the projects that you are interested in

== OWASP Juice Shop ==

[[OWASP Juice Shop Project]] is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and AngularJS. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a "guinea pig"-application to check how well their tools cope with Javascript-heavy application frontends and REST APIs.

=== Challenge Pack 2017 ===

'''Brief Explanation:'''

Ideas for potential new hacking challenges are collected in [https://github.com/bkimminich/juice-shop/issues?q=is%3Aissue+is%3Aopen+label%3Achallenge GitHub issues labeled "challenge"]. This project could implement a whole bunch of challenges one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with additional ideas for challenges would be part of the project scope, as the list of pre-existing ideas might not be sufficient for a GSoC project.

'''Expected Results:'''
* 10 or more new challenges for OWASP Juice Shop (including required functional enhancements to place the challenges in, e.g. the [https://github.com/bkimminich/juice-shop/issues/244 Order Dashboard] and [https://github.com/bkimminich/juice-shop/issues/243 Pomace Recycling user stories])
* Each challenge comes with full functional unit and integration tests
* Each challenge is verified to be exploitable by corresponding end-to-end tests
* Hint and solution sections for each new challenge are added to the "Pwning OWASP Juice Shop" ebook
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) AngularJS (1.x) and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

=== Tech Stack Update ===

'''Brief Explanation:'''

Development of OWASP Juice Shop started in 2014 and was based on - back then - quite recent Javascript frameworks and modules:

* AngularJS 1.x with Bootstrap in the client
* Express on top of NodeJS on the server with
** SQLite as a database
** Sequelize as an OR-Mapper
*** sequelize-restful as an automatic API-generator on top of the DB entities
* Jasmine 1.x to specify behavioral tests
** Karma as a test runner for the client-side unit tests
** Frisby.js for API tests on a dynamically launched server
** Protractor for end-to-end testing of the challenge exploits
* NPM for running/testing the application
* Grunt for some of the custom build scripts

Several of the above frameworks or modules have moved on to new (runtime incompatible) major releases, namely [https://github.com/bkimminich/juice-shop/issues/165 Angular 2], [https://github.com/bkimminich/juice-shop/issues/167 Sequelize], [https://github.com/bkimminich/juice-shop/issues/164 Frisby and Jasmine]. Other modules are out of maintenance entirely, e.g. [https://github.com/bkimminich/juice-shop/issues/167 sequelize-restful].

Migrating the OWASP Juice Shop to the latest versions of the mentioned frameworks & modules is an important step to keep the application relevant as ''the most modern'' intentionally broken web application. Moving to entirely different frameworks might be taken into considerationas well.

'''Expected Results:'''
* High-level target architecture overview including a migration plan with intermediary milestones
* Execution of migration without breaking functionality or losing tests along the way
* Code follows existing (or new) styleguides and passes all existing (or new) quality gates regarding code smells, test coverage etc.

''' Getting started: '''
* Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
* Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
* Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

'''Knowledge Prerequisites:'''
* Javascript, experience with latest Javascript frameworks for frontend, backend, testing and building (e.g. AngularJS 2.x, Jasmine 2.x, ...)

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

=== Your idea ===

'''Brief Explanation:'''

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

''' Getting started '''
* Get in touch with [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich]

'''Expected Results:'''
* A new feature that makes OWASP Juice Shop even better
* Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

'''Knowledge Prerequisites:'''
* Javascript, Unit/Integration testing, experience with (or willingness to learn) AngularJS (1.x) and NodeJS/Express, some security knowledge would be preferable.

'''Mentors:'''
* [https://www.owasp.org/index.php/User:Bjoern_Kimminich Bjoern Kimminich] - OWASP Juice Shop Project Leader

== OWASP Mobile Hacking Playground ==

The OWASP Mobile Hacking Playground (https://github.com/OWASP/OMTG-Hacking-Playground) is part of the OWASP Mobile universe, which consists at the moment of the following projects:

* Mobile Application Security Verification (MASVS). The MASVS is a list of security requirements for mobile applications that can be used by architects, developers, testers, security professionals, and consumers to define what a secure mobile application is. (https://github.com/OWASP/owasp-masvs)
* Mobile Security Testing Guide (MSTG). The OWASP MSTG is a comprehensive manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for dynamic and static security tests, and to help ensure completeness and consistency of the tests. (https://github.com/OWASP/owasp-mstg)

In order to give also practical guidance to developers, security researches and penetration testers of mobile Apps, a hacking playground was created with the goal to create different mobile App’s that contain different vulnerabilities that map to the MSTG test cases. Every test case described in the MSTG will therefore be implemented in an Android and iOS App. This has two advantages:

* A developer can identify vulnerable code in the provided App’s and can see the implications and risks if such patterns are used and can look for the best practices in the MSTG to mitigate the vulnerabilities.
* Penetration testers / security researchers can identify bad practices, dangerous methods and classes they should look for when assessing a Mobile App and can gain more knowledge through the information provided in the OMTG.

It is also encouraged to use the App(s) for education purpose during trainings and workshops.

=== Creation of Android Code Samples ===

'''Brief Explanation:'''

An Android App that maps to the MSTG test cases is already created. This App contains mostly test cases that are related to data storage on an Android device. In order to close the gap to the MSTG more test cases need to be added that show "bad practices" that lead to vulnerabilites, but also the latest security best practices to demonstrate how vulnerabilites can be mitigated.

For examples of implemented test cases, see the Wiki of the Mobile Hacking Playground: https://github.com/OWASP/OMTG-Hacking-Playground/wiki/Android-App

'''Expected Results:'''

The following categories and their test cases are not fully added to the Android App:

* Cryptography (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x08-V3-Cryptography_Verification_Requirements.md)
* Authentication and Session Management (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x09-V4-Authentication_and_Session_Management%20Requirements.md)
* Network Communication (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x10-V5-Network_communication_requirements.md)
* Environmental Interaction (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x11-V6-Interaction_with_the_environment.md)
* Code Quality (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x12-V7-Code_quality_and_build_setting_requirements.md)

For some of the testcases this also includes creating an endpoint on server side in order to fully understand the test case and possible security concerns.

As not all missing test cases can be implemented during the GSOC a subset of them will be defined with the student together.

''' Getting started: '''
Here are a few suggestion on how to get started.
* Check the Mobile Hacking Playground Android App, browse through the code and Wiki to get an understanding of what a test case look likes.
* Browse through the MASVS and check the different areas and their defined requirements.
* Read about Security vulnerabilites and best practices for Android in areas you are interested in (e.g. Cryptography).

'''Knowledge Prerequisites:'''
General interest in Mobile and Security. Basic knowledge of Android and Java.

'''Mentors:''' [mailto:sven.schleier@owasp.org Sven Schleier] - OWASP Mobile Security Testing Guide and Mobile Hacking Playground Project Leader

== OWASP ZAP ==

[[OWASP Zed Attack Proxy Project]] (ZAP) The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. Previous GSoC students have implemented key parts of the ZAP core functionality and have been offered (and accepted) jobs based on their work on ZAP.

We have just included a few of the ideas we have here, for a more complete list see the issues on the ZAP bug tracker with the [https://github.com/zaproxy/zaproxy/issues?q=is%3Aopen+is%3Aissue+label%3Aproject project] label.

=== Field enumeration ===

This would allow a user to iterate though a set of (user defined) characters in order to identify the ones that are filtered out and/or escaped.

The user should be able to define the character sets to test and will probably need to configure the success and failure conditions, as well as valid values for other fields in the form.

''' Expected Results '''

* User able to specify a specific field to enumerate via the ZAP UI
* A list of all valid characters to be returned from the sets of characters the user specifies
* Ability to configure a wide range of success and failure conditions to cope with as many possible situations as possible
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

''' Knowledge Prerequisite: '''
ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

''' Mentors '''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

=== Scripting Code Completion ===

ZAP provides a very powerful scripting interface. Unfortunately to use it effectively is only really possible with a good knowledge of the ZAP internals. Adding code completion (eg using a project like https://github.com/bobbylight/AutoComplete) would significantly help users.

''' Expected Results '''

* Code completion for all of the parameters for all available functions in the standard scripts
* Implementations for JavaScript, JRuby and Jython
* Helper classes with code completion for commonly required functionality
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

''' Knowledge Prerequisite: '''
ZAP is written in Java, so a good knowledge of this language is recommended. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

=== Your idea ===

'''Brief Explanation:'''

ZAP is a great framework for building new and innovative security testing solutions. If you have an idea that is not on this list then don't worry, you can still submit it, we have accepted original projects in previous years and have even paid a student to work on their idea when we did not get enough GSoC slots to accept all of the projects we wanted.

''' Getting started '''
* Get in touch with us :)

'''Expected Results:'''
* A new feature that makes ZAP even better
* Code that conforms to our [https://github.com/zaproxy/zaproxy/wiki/DevGuidelines Development Rules and Guidelines]

'''Knowledge Prerequisites:'''
ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto:psiinon@gmail.com @] and the rest of the ZAP Core Team

== BLT / Bugheist ==

'''Brief Explanation:'''

Bugheist lets anyone report issues they find on the internet. Found something out of place on Amazon.com ? Let them know. Companies are held accountable and shows their response time and history. Get points for reporting bugs and help keep the internet bug free.

''' Getting started '''
* Get in touch with us :)

'''Expected Results:'''
* A new feature that makes Bugheist even better

'''Knowledge Prerequisites:'''
BLT is written in Python / Django, so a good knowledge of this language and framework is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.

'''Mentors:'''
[https://www.owasp.org/index.php/User:Sauriti Sean Auriti] [mailto:sean.auriti@owasp.org @] and the rest of the BLT Core Team

== OWASP Security Knowledge framework ==

'''Brief Explanation:'''

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages
showing how to prevent hackers gaining access and running exploits on your application.

*In a nutshell
- Training developers in writing secure code
- Security support pre-development (Security by design, early feedback of possible security issues)
- Security support post-development(Double check your code by means of the OWASP ASVS checklists )
- Code examples for secure coding

''' Getting started '''
* Please send an email to riccardo.ten.cate@owasp.org or glenn.ten.cate@owasp.org and we would love to tell you all about it! :-)

'''Expected Results:'''
* Adding features.
* Adding functions
* Adding/updating code examples.
* Adding/updating Knowledgebase items.
* Adding low/medium level verification testing guides for developers to teach how to manually verify the existence of injection/logic flaws. (pen-testing)

'''Knowledge Prerequisites:'''
1. For helping in the development of new features and functions Python flask would come in handy since the framework is written in python flask.
2. For writing knowledgebase items only technical knowledge of application security is required.
3. For writing /updating code examples you need to know a programming language along with secure development.
4. For writing the verification guide you need some penetration testing experience.

'''Mentors:'''
Riccardo ten Cate
Glenn ten Cate

OWASP Security Knowledge Framework

2016-11-29T09:50:34Z

Riiecco: /* Contributors */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Security post-development functionality in SKF for verification with the OWASP ASVS

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

Installation guide with Chef:
* https://skf.readme.io/docs/installation#section-automated-installation-with-chef 

Installation guide for AWS:
* https://skf.readme.io/docs/installation#section-aws-installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add generic Selenium test cases for the pre-development and post-development security controls.
- Add current code examples and refer them in the advices of the pre-development and post-development items.
- Add CWE to checklists
- Add Python code examples
- Add Java code examples
- Explain the SDLC more in-depth on our website and OWASP wiki page.
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =

;[[user:Foobar|Glenn ten Cate]]
;[[user:Riccardo_ten_Cate|Riccardo ten Cate]]
;Alexander Kaasjager
;John Haley
;Daniel Paulus
;Erik de Kuijper
;Roderick Schaefer
;[[user:Jmanico|Jim Manico]]
;Martijn Gijsberti Hodenpijl
;Bithin Alangot
;[[user:Knoblochmartin|Martin Knobloch]]
;Adam Fisher
;Tom wirschell
;[[user:johestephan|Joerg Stephan]]
;Mihai Roman

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

User:Riccardo ten Cate

2016-08-01T20:15:58Z

Riiecco:

As a penetration tester and software developer from the Netherlands Riccardo specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages.

BeNeLux OWASP Day 2016

2016-02-12T06:34:27Z

Riiecco: /* Glenn ten Cate, Riccardo ten Cate -- Security knowledge framework */

<center>[[Image:OWASP BeNeLux 2015.png|center|512px]] </center>

 


= Information =

== OWASP BeNeLux Announcement ==
We are proud to announce the dates of the next edition of BeNeLux OWASP Day!
The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg.
More information on the venue can be found {{#switchtablink:Venue|here}}.
 
{{#switchtablink:Registration| Don't wait and register now!}}



== Confirmed speakers Conference ==
{{#switchtablink:Conferenceday| 
* Julie Gommes
* Stefan Burgmair (OWASP Germany)
* Erik Poll (Radboud University)
* Arne Swinnen (Nviso)
* Glenn & Riccardo Ten Cate
* Christian Schneider & Alvaro Muñoz (HPE)
* Michael Hamm (CIRCL - Computer Incident Response Center Luxembourg)
}}
 

== The OWASP BeNeLux Program Committee ==
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
*Martin Knobloch, OWASP Netherlands
*Jocelyn Aubert, OWASP Luxembourg
 

== Tweet! ==
Event tag is [http://twitter.com/#search?q=%23owaspbnl16 #owaspbnl16]
 
== Donate to OWASP BeNeLux ==
[https://co.clickandpledge.com/?wid=72689 Donate]



= Registration =

== OWASP BeNeLux training day and conference are free, but registration is required! ==

Register today at https://owasp-benelux-day-2016.eventbrite.com . We only have a limited number of seats available for our trainings and conference. First come, first serve!

 
To support the OWASP organisation, consider to become a member, it's only US$50!
 
Check out the [[Membership]] page to find out more.
 



= Venue =

== Venue is ==

'''University of Luxembourg''' 
'''Maison du Savoir''' 
''2, avenue de l'Université 
L-4365 Esch-sur-Alzette''

=== How to reach the venue? ===

==== By car ====
Check the [https://goo.gl/maps/d8lTe Belval Campus map] - available on google maps - for route information.

Outdoor parking areas and underground car parks are available throughout the campus, particularly [http://www.cfl.lu/espaces/voyageurs/en/gares-et-services/auto-moto-v%C3%A9lo/p-r-belval-universit%C3%A9-1-622-places-%C3%A0-votre-disposition P+R Belval Université], or [http://umbelval.lu/wp-content/uploads/2015/08/Tarifs-horaires-2015.pdf Square Mile parking] or [http://umbelval.lu/wp-content/uploads/2015/08/Tarifs-horaires-2015.pdf Belval Plaza].

==== By train ====
Trains departing every 15 minutes from Luxembourg Central Station are direct to "Belval-Université" - line is connection-free via Esch-sur-Alzette. Get information on train schedules on the [http://www.cfl.lu/en CFL’s website].

When on site, access to buildings is easy on foot.

=== Hotel nearby ===
[http://www.accorhotels.com/fr/hotel-7071-ibis-esch-belval/index.shtml Hotel Ibis Esch-Belval] 
12, avenue du Rock'n'Roll 
L-4361 Esch-sur-Alzette, Luxembourg 
From 81 EUR per night



= Trainingday =

=== Trainingday is March 17th ===

== Location ==
The training venue is at the same location as the {{#switchtablink:Venue|conference venue}}.

== Agenda ==
{| class="wikitable"
! Time !! Description !! Room 1 !! Room 2 !! Room 3 !! Room 4
|-
| 08h30 - 9h30
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''
|-
| 09h30 - 11h00 || Training
| rowspan="7" style="width:100px;" | Application Security Primer by Martin Knobloch
| rowspan="7" style="width:100px;" | Hands-on Threat Modeling by Sebastien Deleersnyder
| rowspan="7" style="width:100px;" | Security Shepherd by Mark Denihan
| rowspan="7" style="width:100px;" | O-saft by Achim Hoffman & Torsten Gigler
|-
| 11h00 - 11h30 || ''Coffee Break''
|-
| 11h30 - 13h00 || Training
|-
| 13h00 - 14h00 || ''Lunch''
|-
| 14h00 - 15h30 || Training
|-
| 15h30 - 16h00 || ''Coffee Break''
|-
| 16h00 - 17h30 || Training
|}

== Application Security Primer by Martin Knobloch ==
TBD

== Hands-on Threat Modeling by Sebastien Deleersnyder ==

This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:
* B2B web and mobile applications, sharing the same REST backend
* An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

==== Course topics (1 day) ====

Threat modeling introduction
*Threat modeling in a secure development lifecycle
*What is threat modeling
*Why threat modeling?
*Threat modeling stages
*Diagrams
*Identify threats
*Addressing threats
*Document a threat model
Diagrams – what are you building?
*Understanding context
*Doomsday scenarios
*Data flow diagrams
*Trust Boundaries
*'''Hands-on: diagram B2B web and mobile applications, sharing the same REST backend'''
Identifying threats – what can go wrong?
*STRIDE introduction
*Spoofing threats
*Tampering threats
*Repudiation threats
*Information disclosure threats
*Denial of service threats
*Elevation of privilege threats
*'''Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service'''
Addressing each threat
*Mitigation patterns
*Authentication: mitigating spoofing
*Integrity: mitigating tampering
*Non-repudiation: mitigating repudiation
*Confidentiality: mitigating information disclosure
*Availability: mitigating denial of service
*Authorization: mitigating elevation of privilege
Threat modeling tools
*General tools
*Open-Source tools
*Commercial tools

The course students receive the following package as part of the course:
*Hand-outs of the presentations
*Work sheets of the use cases,
*Detailed solution descriptions of the use cases
*Template to document a threat model
*Template to calculate risk levels of identified threats
The students should bring their own laptop

==== Threat Modeling – real life use cases ====
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world.
In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work.
The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:
*B2B web and mobile applications, sharing the same REST backend
*An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
After each hands-on workshop, the results are discussed, and the students receive a documented solution.

==== Sebastien Deleersnyder ====
Sebastien Deleersnyder, managing partner and application security consultant at [http://www.toreon.com Toreon] will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

== Security Shepherd by Mark Denihan ==
TBD

== O-saft by Achim Hoffman & Torsten Gigler ==
==== Abstract ====
The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and
finally avoid or fix them. 
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.

==== Course Topics ====
The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such. 
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:
* checking for ciphers
* checking for special SSL settings
* check multiple servers at a time
* customizing the results
* customizing o-saft itself
* or simple debugging of various SSL connection problems. 
The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP). 
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.
 

==== Technical requirements ====
The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:
* openssl (1.0.1e or newer)
* perl (5.8 or newer), on windows system Strawberry perl is recommended
* Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
* Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
* python (2.7) optional 
Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).
 

==== Bio's ====
* Achim Hoffmann ... Starting with Linux/network security in the nineties. Achim Hoffmann has been working in web application security since more than 15 years. While working as a developer for web-application for several years he started concentrating on web application security as major subject in different roles like penetration tester, doing SCA and giving security workshops. He is author, co-author and maintainer of various papers about web application security at BSI (Germany), OWASP and WASC. He also published some tools (EnDe, EMiR, ReDoS, O-Saft) which aim to make web application security more visible. Achim is owner of sic[!]sec GmbH, Germany, a company that provides information security services. Outside work he is German OWASP Board Member and helps maintaining OWASP's mailing lists.
* Torsten Gigler ... Internernal Security Consultant in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.



= Conferenceday =
=== Conferenceday is March 18th ===

== Agenda ==
{| class="wikitable"
! width="120pt" | Time
! width="180pt" | Speaker !! Topic
|-
| 08h30 - 09h10
| colspan="2" style="text-align: center; background: grey; color: white" | ''Registration''
|-
| 09h15 - 10h00 || Julie Gommes || Gamers, You're the new Botnets
|-
| 10h00 - 10h45 || Stefan Burgmair || OWASP Top 10 Privacy Risks
|-
| 10h45 - 11h15
| colspan="2" style="text-align: center;background: grey; color: white" | ''Morning Break''
|-
| 11h15 - 12h00 || Erik Poll || LangSec meets State Machines
|-
| 12h00 - 12h45 || Arne Swinnen || The Tales of a Bug Bounty Hunter
|-
| 12h45 - 13h45
| colspan="2" style="text-align: center;background: grey; color: white" | ''Lunch''
|-
| 13h45 - 14h30 || Glenn & Riccardo Ten Cate || OWASP Secure Knowledge Framework (SKF)
|-
| 14h30 - 15h15 || University Luxembourg || Mobile Security
|-
| 15h15 - 15h45
| colspan="2" style="text-align: center;background: grey; color: white" | ''Break''
|-
| 15h45 - 16h30 || Christian Schneider & Alvaro Muñoz || Serial Killer: Silently Pwning your Java Endpoints
|-
| 16h30 - 17h15 || Michael Hamm || Experiences with Paste-Monitoring
|-
| 17h15 - 17h30 || OWASP Benelux 2015 organization || '''Closing Notes'''
|}

<div id="TBD"></div>

== Talks ==

=== Julie Gommes - Gamers, You're the New Botnets ===
''Abstract:'' Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny.
You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games".
Yeas, they're sharing games, but lot of other Tools they enjoy to play with...
Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".
 
''Bio:'' Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete
 

=== Stefan Burgmair - OWASP Top 10 Privacy Risks ===
''Abstract:'' There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.
 
''Bio:'' Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.
 

=== Erik Poll - LangSec meets State Machines ===
''Abstract:'' Language-theoretic Security, or LangSec for short, provides
useful insights into the root causes of an important class
security flaws - namely flaws in handling input - and ways to
avoid these. This talk will discuss the core ideas of LangSec and
the relation with security research we have done at over the
years, where we used state machines as a means to systematically
investigate GSM, bank cards, internet banking tokens, and TLS.
 
''Bio:'' Erik Poll is Associate Professor in the Digital Security group of
the Radboud University in Nijmegen. His research interests
include smart cards, security protocols, the security of payment
systems and smart grids, and formal methods that can improve
security by providing a rigorous basis for design, analysis, and
testing.
 

=== Arne Swinnen - The Tales of a Bug Bounty Hunter ===
''Abstract:'' Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented. 
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery. 
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.
 
''Bio:'' Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students. 
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame''. 
 

=== Christian Schneider & Alvaro Muñoz - Serial Killer: Silently Pwning your Java Endpoints ===
''Abstract:'' In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

''Bio's:''
* Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at [https://www.Christian-Schneider.net Christian-Schneider.net]
* Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at [http://www.pwntester.com pwntester.com]

=== Michael Hamm - Experiences with Paste-Monitoring ===
''Abstract:'' Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks.

''Bio:'' Works since 2000 in the field of security and since 2010 as CIRCL Operator.

=== Glenn ten Cate, Riccardo ten Cate -- Security knowledge framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
</ul>
"Bio:" 
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a developer and penetration tester Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.



= Social Event =

== Social Event ==
'''Wait for it...'''

= CTF =

== Capture the Flag! ==

* Do you like puzzles?
* Do you like challenges?
* Are you a hacker?

Whether you are an experienced hacker or new enthusiast you should come to OWASP BeNeLux Day and participate in the Capture the Flag event.

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools.

So come, show off your skills, learn new tricks and above all have a good time at the CTF event.



= Sponsor =

=== Become a sponsor of OWASP BeNeLux ===

== Donate to OWASP BeNeLux ==

[https://co.clickandpledge.com/?wid=72689 Sponsor]

== Promotion ==
''Feel free to use the text below to promote our event!''

We invite you to our next OWASP event: the '''BeNeLux OWASP Days 2016!'''

The good news: free! No fee!

The bad news: there are only 150 seats available (first register, first serve)!


__NOTOC__
<headertabs/>

=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===

 

[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_BeNeLux_Archives]]

BeNeLux OWASP Day 2016

2016-02-12T06:33:46Z

Riiecco: /* Glenn ten Cate, Riccardo ten Cate -- Security knowledge framework */

<center>[[Image:OWASP BeNeLux 2015.png|center|512px]] </center>

 


= Information =

== OWASP BeNeLux Announcement ==
We are proud to announce the dates of the next edition of BeNeLux OWASP Day!
The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg.
More information on the venue can be found {{#switchtablink:Venue|here}}.
 
{{#switchtablink:Registration| Don't wait and register now!}}



== Confirmed speakers Conference ==
{{#switchtablink:Conferenceday| 
* Julie Gommes
* Stefan Burgmair (OWASP Germany)
* Erik Poll (Radboud University)
* Arne Swinnen (Nviso)
* Glenn & Riccardo Ten Cate
* Christian Schneider & Alvaro Muñoz (HPE)
* Michael Hamm (CIRCL - Computer Incident Response Center Luxembourg)
}}
 

== The OWASP BeNeLux Program Committee ==
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
*Martin Knobloch, OWASP Netherlands
*Jocelyn Aubert, OWASP Luxembourg
 

== Tweet! ==
Event tag is [http://twitter.com/#search?q=%23owaspbnl16 #owaspbnl16]
 
== Donate to OWASP BeNeLux ==
[https://co.clickandpledge.com/?wid=72689 Donate]



= Registration =

== OWASP BeNeLux training day and conference are free, but registration is required! ==

Register today at https://owasp-benelux-day-2016.eventbrite.com . We only have a limited number of seats available for our trainings and conference. First come, first serve!

 
To support the OWASP organisation, consider to become a member, it's only US$50!
 
Check out the [[Membership]] page to find out more.
 



= Venue =

== Venue is ==

'''University of Luxembourg''' 
'''Maison du Savoir''' 
''2, avenue de l'Université 
L-4365 Esch-sur-Alzette''

=== How to reach the venue? ===

==== By car ====
Check the [https://goo.gl/maps/d8lTe Belval Campus map] - available on google maps - for route information.

Outdoor parking areas and underground car parks are available throughout the campus, particularly [http://www.cfl.lu/espaces/voyageurs/en/gares-et-services/auto-moto-v%C3%A9lo/p-r-belval-universit%C3%A9-1-622-places-%C3%A0-votre-disposition P+R Belval Université], or [http://umbelval.lu/wp-content/uploads/2015/08/Tarifs-horaires-2015.pdf Square Mile parking] or [http://umbelval.lu/wp-content/uploads/2015/08/Tarifs-horaires-2015.pdf Belval Plaza].

==== By train ====
Trains departing every 15 minutes from Luxembourg Central Station are direct to "Belval-Université" - line is connection-free via Esch-sur-Alzette. Get information on train schedules on the [http://www.cfl.lu/en CFL’s website].

When on site, access to buildings is easy on foot.

=== Hotel nearby ===
[http://www.accorhotels.com/fr/hotel-7071-ibis-esch-belval/index.shtml Hotel Ibis Esch-Belval] 
12, avenue du Rock'n'Roll 
L-4361 Esch-sur-Alzette, Luxembourg 
From 81 EUR per night



= Trainingday =

=== Trainingday is March 17th ===

== Location ==
The training venue is at the same location as the {{#switchtablink:Venue|conference venue}}.

== Agenda ==
{| class="wikitable"
! Time !! Description !! Room 1 !! Room 2 !! Room 3 !! Room 4
|-
| 08h30 - 9h30
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''
|-
| 09h30 - 11h00 || Training
| rowspan="7" style="width:100px;" | Application Security Primer by Martin Knobloch
| rowspan="7" style="width:100px;" | Hands-on Threat Modeling by Sebastien Deleersnyder
| rowspan="7" style="width:100px;" | Security Shepherd by Mark Denihan
| rowspan="7" style="width:100px;" | O-saft by Achim Hoffman & Torsten Gigler
|-
| 11h00 - 11h30 || ''Coffee Break''
|-
| 11h30 - 13h00 || Training
|-
| 13h00 - 14h00 || ''Lunch''
|-
| 14h00 - 15h30 || Training
|-
| 15h30 - 16h00 || ''Coffee Break''
|-
| 16h00 - 17h30 || Training
|}

== Application Security Primer by Martin Knobloch ==
TBD

== Hands-on Threat Modeling by Sebastien Deleersnyder ==

This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:
* B2B web and mobile applications, sharing the same REST backend
* An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

==== Course topics (1 day) ====

Threat modeling introduction
*Threat modeling in a secure development lifecycle
*What is threat modeling
*Why threat modeling?
*Threat modeling stages
*Diagrams
*Identify threats
*Addressing threats
*Document a threat model
Diagrams – what are you building?
*Understanding context
*Doomsday scenarios
*Data flow diagrams
*Trust Boundaries
*'''Hands-on: diagram B2B web and mobile applications, sharing the same REST backend'''
Identifying threats – what can go wrong?
*STRIDE introduction
*Spoofing threats
*Tampering threats
*Repudiation threats
*Information disclosure threats
*Denial of service threats
*Elevation of privilege threats
*'''Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service'''
Addressing each threat
*Mitigation patterns
*Authentication: mitigating spoofing
*Integrity: mitigating tampering
*Non-repudiation: mitigating repudiation
*Confidentiality: mitigating information disclosure
*Availability: mitigating denial of service
*Authorization: mitigating elevation of privilege
Threat modeling tools
*General tools
*Open-Source tools
*Commercial tools

The course students receive the following package as part of the course:
*Hand-outs of the presentations
*Work sheets of the use cases,
*Detailed solution descriptions of the use cases
*Template to document a threat model
*Template to calculate risk levels of identified threats
The students should bring their own laptop

==== Threat Modeling – real life use cases ====
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world.
In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work.
The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:
*B2B web and mobile applications, sharing the same REST backend
*An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
After each hands-on workshop, the results are discussed, and the students receive a documented solution.

==== Sebastien Deleersnyder ====
Sebastien Deleersnyder, managing partner and application security consultant at [http://www.toreon.com Toreon] will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

== Security Shepherd by Mark Denihan ==
TBD

== O-saft by Achim Hoffman & Torsten Gigler ==
==== Abstract ====
The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and
finally avoid or fix them. 
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.

==== Course Topics ====
The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such. 
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:
* checking for ciphers
* checking for special SSL settings
* check multiple servers at a time
* customizing the results
* customizing o-saft itself
* or simple debugging of various SSL connection problems. 
The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP). 
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.
 

==== Technical requirements ====
The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:
* openssl (1.0.1e or newer)
* perl (5.8 or newer), on windows system Strawberry perl is recommended
* Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
* Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
* python (2.7) optional 
Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).
 

==== Bio's ====
* Achim Hoffmann ... Starting with Linux/network security in the nineties. Achim Hoffmann has been working in web application security since more than 15 years. While working as a developer for web-application for several years he started concentrating on web application security as major subject in different roles like penetration tester, doing SCA and giving security workshops. He is author, co-author and maintainer of various papers about web application security at BSI (Germany), OWASP and WASC. He also published some tools (EnDe, EMiR, ReDoS, O-Saft) which aim to make web application security more visible. Achim is owner of sic[!]sec GmbH, Germany, a company that provides information security services. Outside work he is German OWASP Board Member and helps maintaining OWASP's mailing lists.
* Torsten Gigler ... Internernal Security Consultant in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.



= Conferenceday =
=== Conferenceday is March 18th ===

== Agenda ==
{| class="wikitable"
! width="120pt" | Time
! width="180pt" | Speaker !! Topic
|-
| 08h30 - 09h10
| colspan="2" style="text-align: center; background: grey; color: white" | ''Registration''
|-
| 09h15 - 10h00 || Julie Gommes || Gamers, You're the new Botnets
|-
| 10h00 - 10h45 || Stefan Burgmair || OWASP Top 10 Privacy Risks
|-
| 10h45 - 11h15
| colspan="2" style="text-align: center;background: grey; color: white" | ''Morning Break''
|-
| 11h15 - 12h00 || Erik Poll || LangSec meets State Machines
|-
| 12h00 - 12h45 || Arne Swinnen || The Tales of a Bug Bounty Hunter
|-
| 12h45 - 13h45
| colspan="2" style="text-align: center;background: grey; color: white" | ''Lunch''
|-
| 13h45 - 14h30 || Glenn & Riccardo Ten Cate || OWASP Secure Knowledge Framework (SKF)
|-
| 14h30 - 15h15 || University Luxembourg || Mobile Security
|-
| 15h15 - 15h45
| colspan="2" style="text-align: center;background: grey; color: white" | ''Break''
|-
| 15h45 - 16h30 || Christian Schneider & Alvaro Muñoz || Serial Killer: Silently Pwning your Java Endpoints
|-
| 16h30 - 17h15 || Michael Hamm || Experiences with Paste-Monitoring
|-
| 17h15 - 17h30 || OWASP Benelux 2015 organization || '''Closing Notes'''
|}

<div id="TBD"></div>

== Talks ==

=== Julie Gommes - Gamers, You're the New Botnets ===
''Abstract:'' Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny.
You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games".
Yeas, they're sharing games, but lot of other Tools they enjoy to play with...
Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".
 
''Bio:'' Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete
 

=== Stefan Burgmair - OWASP Top 10 Privacy Risks ===
''Abstract:'' There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.
 
''Bio:'' Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.
 

=== Erik Poll - LangSec meets State Machines ===
''Abstract:'' Language-theoretic Security, or LangSec for short, provides
useful insights into the root causes of an important class
security flaws - namely flaws in handling input - and ways to
avoid these. This talk will discuss the core ideas of LangSec and
the relation with security research we have done at over the
years, where we used state machines as a means to systematically
investigate GSM, bank cards, internet banking tokens, and TLS.
 
''Bio:'' Erik Poll is Associate Professor in the Digital Security group of
the Radboud University in Nijmegen. His research interests
include smart cards, security protocols, the security of payment
systems and smart grids, and formal methods that can improve
security by providing a rigorous basis for design, analysis, and
testing.
 

=== Arne Swinnen - The Tales of a Bug Bounty Hunter ===
''Abstract:'' Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented. 
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery. 
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.
 
''Bio:'' Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students. 
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame''. 
 

=== Christian Schneider & Alvaro Muñoz - Serial Killer: Silently Pwning your Java Endpoints ===
''Abstract:'' In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

''Bio's:''
* Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at [https://www.Christian-Schneider.net Christian-Schneider.net]
* Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at [http://www.pwntester.com pwntester.com]

=== Michael Hamm - Experiences with Paste-Monitoring ===
''Abstract:'' Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks.

''Bio:'' Works since 2000 in the field of security and since 2010 as CIRCL Operator.

=== Glenn ten Cate, Riccardo ten Cate -- Security knowledge framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
</ul>
"Bio:"
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a developer and penetration tester Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.



= Social Event =

== Social Event ==
'''Wait for it...'''

= CTF =

== Capture the Flag! ==

* Do you like puzzles?
* Do you like challenges?
* Are you a hacker?

Whether you are an experienced hacker or new enthusiast you should come to OWASP BeNeLux Day and participate in the Capture the Flag event.

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools.

So come, show off your skills, learn new tricks and above all have a good time at the CTF event.



= Sponsor =

=== Become a sponsor of OWASP BeNeLux ===

== Donate to OWASP BeNeLux ==

[https://co.clickandpledge.com/?wid=72689 Sponsor]

== Promotion ==
''Feel free to use the text below to promote our event!''

We invite you to our next OWASP event: the '''BeNeLux OWASP Days 2016!'''

The good news: free! No fee!

The bad news: there are only 150 seats available (first register, first serve)!


__NOTOC__
<headertabs/>

=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===

 

[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_BeNeLux_Archives]]

BeNeLux OWASP Day 2016

2016-02-12T06:33:26Z

Riiecco: /* Talks */

<center>[[Image:OWASP BeNeLux 2015.png|center|512px]] </center>

 


= Information =

== OWASP BeNeLux Announcement ==
We are proud to announce the dates of the next edition of BeNeLux OWASP Day!
The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg.
More information on the venue can be found {{#switchtablink:Venue|here}}.
 
{{#switchtablink:Registration| Don't wait and register now!}}



== Confirmed speakers Conference ==
{{#switchtablink:Conferenceday| 
* Julie Gommes
* Stefan Burgmair (OWASP Germany)
* Erik Poll (Radboud University)
* Arne Swinnen (Nviso)
* Glenn & Riccardo Ten Cate
* Christian Schneider & Alvaro Muñoz (HPE)
* Michael Hamm (CIRCL - Computer Incident Response Center Luxembourg)
}}
 

== The OWASP BeNeLux Program Committee ==
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
*Martin Knobloch, OWASP Netherlands
*Jocelyn Aubert, OWASP Luxembourg
 

== Tweet! ==
Event tag is [http://twitter.com/#search?q=%23owaspbnl16 #owaspbnl16]
 
== Donate to OWASP BeNeLux ==
[https://co.clickandpledge.com/?wid=72689 Donate]



= Registration =

== OWASP BeNeLux training day and conference are free, but registration is required! ==

Register today at https://owasp-benelux-day-2016.eventbrite.com . We only have a limited number of seats available for our trainings and conference. First come, first serve!

 
To support the OWASP organisation, consider to become a member, it's only US$50!
 
Check out the [[Membership]] page to find out more.
 



= Venue =

== Venue is ==

'''University of Luxembourg''' 
'''Maison du Savoir''' 
''2, avenue de l'Université 
L-4365 Esch-sur-Alzette''

=== How to reach the venue? ===

==== By car ====
Check the [https://goo.gl/maps/d8lTe Belval Campus map] - available on google maps - for route information.

Outdoor parking areas and underground car parks are available throughout the campus, particularly [http://www.cfl.lu/espaces/voyageurs/en/gares-et-services/auto-moto-v%C3%A9lo/p-r-belval-universit%C3%A9-1-622-places-%C3%A0-votre-disposition P+R Belval Université], or [http://umbelval.lu/wp-content/uploads/2015/08/Tarifs-horaires-2015.pdf Square Mile parking] or [http://umbelval.lu/wp-content/uploads/2015/08/Tarifs-horaires-2015.pdf Belval Plaza].

==== By train ====
Trains departing every 15 minutes from Luxembourg Central Station are direct to "Belval-Université" - line is connection-free via Esch-sur-Alzette. Get information on train schedules on the [http://www.cfl.lu/en CFL’s website].

When on site, access to buildings is easy on foot.

=== Hotel nearby ===
[http://www.accorhotels.com/fr/hotel-7071-ibis-esch-belval/index.shtml Hotel Ibis Esch-Belval] 
12, avenue du Rock'n'Roll 
L-4361 Esch-sur-Alzette, Luxembourg 
From 81 EUR per night



= Trainingday =

=== Trainingday is March 17th ===

== Location ==
The training venue is at the same location as the {{#switchtablink:Venue|conference venue}}.

== Agenda ==
{| class="wikitable"
! Time !! Description !! Room 1 !! Room 2 !! Room 3 !! Room 4
|-
| 08h30 - 9h30
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''
|-
| 09h30 - 11h00 || Training
| rowspan="7" style="width:100px;" | Application Security Primer by Martin Knobloch
| rowspan="7" style="width:100px;" | Hands-on Threat Modeling by Sebastien Deleersnyder
| rowspan="7" style="width:100px;" | Security Shepherd by Mark Denihan
| rowspan="7" style="width:100px;" | O-saft by Achim Hoffman & Torsten Gigler
|-
| 11h00 - 11h30 || ''Coffee Break''
|-
| 11h30 - 13h00 || Training
|-
| 13h00 - 14h00 || ''Lunch''
|-
| 14h00 - 15h30 || Training
|-
| 15h30 - 16h00 || ''Coffee Break''
|-
| 16h00 - 17h30 || Training
|}

== Application Security Primer by Martin Knobloch ==
TBD

== Hands-on Threat Modeling by Sebastien Deleersnyder ==

This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:
* B2B web and mobile applications, sharing the same REST backend
* An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

==== Course topics (1 day) ====

Threat modeling introduction
*Threat modeling in a secure development lifecycle
*What is threat modeling
*Why threat modeling?
*Threat modeling stages
*Diagrams
*Identify threats
*Addressing threats
*Document a threat model
Diagrams – what are you building?
*Understanding context
*Doomsday scenarios
*Data flow diagrams
*Trust Boundaries
*'''Hands-on: diagram B2B web and mobile applications, sharing the same REST backend'''
Identifying threats – what can go wrong?
*STRIDE introduction
*Spoofing threats
*Tampering threats
*Repudiation threats
*Information disclosure threats
*Denial of service threats
*Elevation of privilege threats
*'''Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service'''
Addressing each threat
*Mitigation patterns
*Authentication: mitigating spoofing
*Integrity: mitigating tampering
*Non-repudiation: mitigating repudiation
*Confidentiality: mitigating information disclosure
*Availability: mitigating denial of service
*Authorization: mitigating elevation of privilege
Threat modeling tools
*General tools
*Open-Source tools
*Commercial tools

The course students receive the following package as part of the course:
*Hand-outs of the presentations
*Work sheets of the use cases,
*Detailed solution descriptions of the use cases
*Template to document a threat model
*Template to calculate risk levels of identified threats
The students should bring their own laptop

==== Threat Modeling – real life use cases ====
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world.
In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work.
The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:
*B2B web and mobile applications, sharing the same REST backend
*An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
After each hands-on workshop, the results are discussed, and the students receive a documented solution.

==== Sebastien Deleersnyder ====
Sebastien Deleersnyder, managing partner and application security consultant at [http://www.toreon.com Toreon] will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

== Security Shepherd by Mark Denihan ==
TBD

== O-saft by Achim Hoffman & Torsten Gigler ==
==== Abstract ====
The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and
finally avoid or fix them. 
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.

==== Course Topics ====
The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such. 
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:
* checking for ciphers
* checking for special SSL settings
* check multiple servers at a time
* customizing the results
* customizing o-saft itself
* or simple debugging of various SSL connection problems. 
The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP). 
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.
 

==== Technical requirements ====
The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:
* openssl (1.0.1e or newer)
* perl (5.8 or newer), on windows system Strawberry perl is recommended
* Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
* Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
* python (2.7) optional 
Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).
 

==== Bio's ====
* Achim Hoffmann ... Starting with Linux/network security in the nineties. Achim Hoffmann has been working in web application security since more than 15 years. While working as a developer for web-application for several years he started concentrating on web application security as major subject in different roles like penetration tester, doing SCA and giving security workshops. He is author, co-author and maintainer of various papers about web application security at BSI (Germany), OWASP and WASC. He also published some tools (EnDe, EMiR, ReDoS, O-Saft) which aim to make web application security more visible. Achim is owner of sic[!]sec GmbH, Germany, a company that provides information security services. Outside work he is German OWASP Board Member and helps maintaining OWASP's mailing lists.
* Torsten Gigler ... Internernal Security Consultant in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.



= Conferenceday =
=== Conferenceday is March 18th ===

== Agenda ==
{| class="wikitable"
! width="120pt" | Time
! width="180pt" | Speaker !! Topic
|-
| 08h30 - 09h10
| colspan="2" style="text-align: center; background: grey; color: white" | ''Registration''
|-
| 09h15 - 10h00 || Julie Gommes || Gamers, You're the new Botnets
|-
| 10h00 - 10h45 || Stefan Burgmair || OWASP Top 10 Privacy Risks
|-
| 10h45 - 11h15
| colspan="2" style="text-align: center;background: grey; color: white" | ''Morning Break''
|-
| 11h15 - 12h00 || Erik Poll || LangSec meets State Machines
|-
| 12h00 - 12h45 || Arne Swinnen || The Tales of a Bug Bounty Hunter
|-
| 12h45 - 13h45
| colspan="2" style="text-align: center;background: grey; color: white" | ''Lunch''
|-
| 13h45 - 14h30 || Glenn & Riccardo Ten Cate || OWASP Secure Knowledge Framework (SKF)
|-
| 14h30 - 15h15 || University Luxembourg || Mobile Security
|-
| 15h15 - 15h45
| colspan="2" style="text-align: center;background: grey; color: white" | ''Break''
|-
| 15h45 - 16h30 || Christian Schneider & Alvaro Muñoz || Serial Killer: Silently Pwning your Java Endpoints
|-
| 16h30 - 17h15 || Michael Hamm || Experiences with Paste-Monitoring
|-
| 17h15 - 17h30 || OWASP Benelux 2015 organization || '''Closing Notes'''
|}

<div id="TBD"></div>

== Talks ==

=== Julie Gommes - Gamers, You're the New Botnets ===
''Abstract:'' Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny.
You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games".
Yeas, they're sharing games, but lot of other Tools they enjoy to play with...
Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".
 
''Bio:'' Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete
 

=== Stefan Burgmair - OWASP Top 10 Privacy Risks ===
''Abstract:'' There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.
 
''Bio:'' Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.
 

=== Erik Poll - LangSec meets State Machines ===
''Abstract:'' Language-theoretic Security, or LangSec for short, provides
useful insights into the root causes of an important class
security flaws - namely flaws in handling input - and ways to
avoid these. This talk will discuss the core ideas of LangSec and
the relation with security research we have done at over the
years, where we used state machines as a means to systematically
investigate GSM, bank cards, internet banking tokens, and TLS.
 
''Bio:'' Erik Poll is Associate Professor in the Digital Security group of
the Radboud University in Nijmegen. His research interests
include smart cards, security protocols, the security of payment
systems and smart grids, and formal methods that can improve
security by providing a rigorous basis for design, analysis, and
testing.
 

=== Arne Swinnen - The Tales of a Bug Bounty Hunter ===
''Abstract:'' Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented. 
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery. 
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.
 
''Bio:'' Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students. 
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame''. 
 

=== Christian Schneider & Alvaro Muñoz - Serial Killer: Silently Pwning your Java Endpoints ===
''Abstract:'' In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

''Bio's:''
* Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at [https://www.Christian-Schneider.net Christian-Schneider.net]
* Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at [http://www.pwntester.com pwntester.com]

=== Michael Hamm - Experiences with Paste-Monitoring ===
''Abstract:'' Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks.

''Bio:'' Works since 2000 in the field of security and since 2010 as CIRCL Operator.

=== Glenn ten Cate, Riccardo ten Cate -- Security knowledge framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>

"Bio:"
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a developer and penetration tester Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.



= Social Event =

== Social Event ==
'''Wait for it...'''

= CTF =

== Capture the Flag! ==

* Do you like puzzles?
* Do you like challenges?
* Are you a hacker?

Whether you are an experienced hacker or new enthusiast you should come to OWASP BeNeLux Day and participate in the Capture the Flag event.

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools.

So come, show off your skills, learn new tricks and above all have a good time at the CTF event.



= Sponsor =

=== Become a sponsor of OWASP BeNeLux ===

== Donate to OWASP BeNeLux ==

[https://co.clickandpledge.com/?wid=72689 Sponsor]

== Promotion ==
''Feel free to use the text below to promote our event!''

We invite you to our next OWASP event: the '''BeNeLux OWASP Days 2016!'''

The good news: free! No fee!

The bad news: there are only 150 seats available (first register, first serve)!


__NOTOC__
<headertabs/>

=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===

 

[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_BeNeLux_Archives]]

Netherlands February 18th, 2016

2016-02-12T06:32:45Z

Riiecco: /* The OWASP Security Knowledge Framework */

;[[Netherlands | OWASP Netherland Wiki]]
;[[Netherlands_Previous_Events_2016 | All OWASP NL Events 2016]]
= February 18th, 2016=
Registration: Now open via [http://www.eventbrite.nl/e/tickets-owasp-netherlands-chapter-meeting-february-18th-2016-20828755368 EventBrite]

== Venue ==
;De Haagse Hogeschool
:Johanna Westerdijkplein 75
: 2521EN Den Haag

==Programme:==
:18:00 - 18:45 Registration & Pizzas
:18:45 - 19:00 OWASP Netherland and Foundation Updates
:19:00 - 21:00 Het OWASP Security Knowledge Framework (SKF)
:21:00 - 21:30 Networking

==Presentations==
=== The OWASP Security Knowledge Framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>

</ul>

==Speakers==
===Glenn en Riccardo Ten Cate===
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a developer and penetration tester Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.

OWASP Security Knowledge Framework

2016-01-29T21:16:01Z

Riiecco: /* Contributors */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Security post-development functionality in SKF for verification with the OWASP ASVS

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

Installation guide with Chef:
* https://skf.readme.io/docs/installation#section-automated-installation-with-chef 

Installation guide for AWS:
* https://skf.readme.io/docs/installation#section-aws-installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add generic Selenium test cases for the pre-development and post-development security controls.
- Add current code examples and refer them in the advices of the pre-development and post-development items.
- Add CWE to checklists
- Add Python code examples
- Add Java code examples
- Explain the SDLC more in-depth on our website and OWASP wiki page.
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 
Martin Knobloch 
Adam Fisher 
Tom wirschell

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

Netherlands February 18th, 2016

2016-01-06T06:38:58Z

Riiecco: /* Glenn en Riccardo Ten Cate */

;[[Netherlands | OWASP Netherland Wiki]]
;[[Netherlands_Previous_Events_2015 | All OWASP NL Events 2015]]
= September 17th, 2015 =
Registration: http://owasp-netherlands-chapter-meeting-201500917.eventbrite.nl

== Venue ==
;De Haagse Hogeschool
:TBD

==Programme:==
:18:00 - 18:45 Registration & Pizzas
:18:45 - 19:00 OWASP Netherland and Foundation Updates
:19:00 - 21:00 Het OWASP Security Knowledge Framework (SKF)
:21:00 - 21:30 Networking

==Presentations==
=== The OWASP Security Knowledge Framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
<li>Introduction to TDD (test driven development)</li>
<li>Introduction to Unit testing</li>
</ul>

==Speakers==
===Glenn en Riccardo Ten Cate===
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a developer and penetration tester Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.

Netherlands February 18th, 2016

2016-01-06T06:37:21Z

Riiecco: /* Glenn en Riccardo Ten Cate */

;[[Netherlands | OWASP Netherland Wiki]]
;[[Netherlands_Previous_Events_2015 | All OWASP NL Events 2015]]
= September 17th, 2015 =
Registration: http://owasp-netherlands-chapter-meeting-201500917.eventbrite.nl

== Venue ==
;De Haagse Hogeschool
:TBD

==Programme:==
:18:00 - 18:45 Registration & Pizzas
:18:45 - 19:00 OWASP Netherland and Foundation Updates
:19:00 - 21:00 Het OWASP Security Knowledge Framework (SKF)
:21:00 - 21:30 Networking

==Presentations==
=== The OWASP Security Knowledge Framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
<li>Introduction to TDD (test driven development)</li>
<li>Introduction to Unit testing</li>
</ul>

==Speakers==
===Glenn en Riccardo Ten Cate===
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
Employed as a security engineer at Schuberg Philis in the Netherlands and speaking at multiple security conferences. 
His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a penetration tester from the Netherlands employed at The S-Unit, Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.

Netherlands February 18th, 2016

2016-01-06T06:37:07Z

Riiecco: /* Glenn en Riccardo Ten Cate */

;[[Netherlands | OWASP Netherland Wiki]]
;[[Netherlands_Previous_Events_2015 | All OWASP NL Events 2015]]
= September 17th, 2015 =
Registration: http://owasp-netherlands-chapter-meeting-201500917.eventbrite.nl

== Venue ==
;De Haagse Hogeschool
:TBD

==Programme:==
:18:00 - 18:45 Registration & Pizzas
:18:45 - 19:00 OWASP Netherland and Foundation Updates
:19:00 - 21:00 Het OWASP Security Knowledge Framework (SKF)
:21:00 - 21:30 Networking

==Presentations==
=== The OWASP Security Knowledge Framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
<li>Introduction to TDD (test driven development)</li>
<li>Introduction to Unit testing</li>
</ul>

==Speakers==
===Glenn en Riccardo Ten Cate===
Glenn 
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
Employed as a security engineer at Schuberg Philis in the Netherlands and speaking at multiple security conferences. 
His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo 
As a penetration tester from the Netherlands employed at The S-Unit, Riccardo specialises in web-application security and 
has extensive knowledge in securing web applications in multiple coding languages.

Netherlands February 18th, 2016

2016-01-06T06:36:32Z

Riiecco: /* Glenn en Riccardo Ten Cate */

;[[Netherlands | OWASP Netherland Wiki]]
;[[Netherlands_Previous_Events_2015 | All OWASP NL Events 2015]]
= September 17th, 2015 =
Registration: http://owasp-netherlands-chapter-meeting-201500917.eventbrite.nl

== Venue ==
;De Haagse Hogeschool
:TBD

==Programme:==
:18:00 - 18:45 Registration & Pizzas
:18:45 - 19:00 OWASP Netherland and Foundation Updates
:19:00 - 21:00 Het OWASP Security Knowledge Framework (SKF)
:21:00 - 21:30 Networking

==Presentations==
=== The OWASP Security Knowledge Framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
<li>Introduction to TDD (test driven development)</li>
<li>Introduction to Unit testing</li>
</ul>

==Speakers==
===Glenn en Riccardo Ten Cate===
Glenn
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
Employed as a security engineer at Schuberg Philis in the Netherlands and speaking at multiple security conferences. 
His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 
Riccardo
As a penetration tester from the Netherlands employed at The S-Unit, Riccardo specialises in web-application security and
 
has extensive knowledge in securing web applications in multiple coding languages.

Netherlands February 18th, 2016

2016-01-06T06:35:43Z

Riiecco: /* Glenn en Riccardo Ten Cate */

;[[Netherlands | OWASP Netherland Wiki]]
;[[Netherlands_Previous_Events_2015 | All OWASP NL Events 2015]]
= September 17th, 2015 =
Registration: http://owasp-netherlands-chapter-meeting-201500917.eventbrite.nl

== Venue ==
;De Haagse Hogeschool
:TBD

==Programme:==
:18:00 - 18:45 Registration & Pizzas
:18:45 - 19:00 OWASP Netherland and Foundation Updates
:19:00 - 21:00 Het OWASP Security Knowledge Framework (SKF)
:21:00 - 21:30 Networking

==Presentations==
=== The OWASP Security Knowledge Framework ===
Over 10 years of experience in web application security bundled into a single application. 
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. 
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing 
you how to prevent hackers gaining access and running exploits on your application. 

We will be talking about:
<ul>
<li>Training your developers in writing secure code</li>
<li>Security support pre-development (Security by design, early feedback of possible security issues)</li>
<li>Security support post-development(Double check your code by means of the OWASP ASVS checklists )</li>
<li>Code examples for secure coding</li>
<li>Introduction to TDD (test driven development)</li>
<li>Introduction to Unit testing</li>
</ul>

==Speakers==
===Glenn en Riccardo Ten Cate===
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security. 
Employed as a security engineer at Schuberg Philis in the Netherlands and speaking at multiple security conferences. 
His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years. 

 

As a penetration tester from the Netherlands employed at The S-Unit Riccardo specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages.

Netherlands February 18th, 2016

2016-01-06T06:34:13Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:30:43Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:30:32Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:30:02Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:29:48Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:29:29Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:28:13Z

Riiecco: /* The OWASP Security Knowledge Framework */

Netherlands February 18th, 2016

2016-01-06T06:27:41Z

Riiecco: /* The OWASP Security Knowledge Framework */

OWASP Security Knowledge Framework

2015-11-01T13:24:25Z

Riiecco: /* Project Online Demo */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Security post-development functionality in SKF for verification with the OWASP ASVS

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* http://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:24:06Z

Riiecco: /* Project Online Demo */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Security post-development functionality in SKF for verification with the OWASP ASVS

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.secureby.design 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:22:54Z

Riiecco: /* OWASP Security Knowledge Framework */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

* Security Requirements OWASP ASVS for development and for third party vendor applications
* Security knowledge reference (Code examples/ Knowledge Base items)
* Security is part of design with the pre-development functionality in SKF
* Security post-development functionality in SKF for verification with the OWASP ASVS

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:21:18Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:20:30Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;"><img src="http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg" /></div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:19:51Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:http://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:19:36Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:https://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-11-01T13:19:03Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:https://www.securityknowledgeframework.org/img/banner-wiki-owasp.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
 

==Donate==
<paypal>Security Knowledge Framework </paypal>

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

User:Riccardo ten Cate

2015-10-22T19:20:02Z

Riiecco:

Penetration tester @ The S-unit from The Netherlands.

OWASP Security Knowledge Framework

2015-08-11T19:50:09Z

Riiecco: /* Demo video */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video demo ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-08-11T19:49:51Z

Riiecco: /* Video Demo */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Demo video ==
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-08-11T19:49:06Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Video Demo ==
 
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-08-11T19:47:29Z

Riiecco: /* Video Demo */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Video Demo ==
'''' 
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-08-11T19:47:20Z

Riiecco: /* Video Demo */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Video Demo ==
''Watch'' 
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-08-11T19:46:23Z

Riiecco: /* Video Demo */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Video Demo ==
''Video:'' 
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-08-11T19:46:07Z

Riiecco:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework==
The OWASP Security Knowledge Framework is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. Education is the first step in the Secure Software Development Lifecycle.

The 4 Core usage of SKF:

- Security Requirements OWASP ASVS for development and for third party vendor applications 
- Security knowledge reference (Code examples/ Knowledge Base items) 
- Security is part of design with the pre-development functionality in SKF 
- Security post-development functionality in SKF for verification with the OWASP ASVS 

== Description ==

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. It can be used to support developers in pre-development (security by design) as well as after code is released (OWASP ASVS Level 1-3).

== Why Use The OWASP Security Knowledge Framework? ==

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:125px;border-right: 1px dotted gray;padding-right:25px;" |

== Video Demo ==
''Video:''' 
* https://www.youtube.com/watch?v=ogzCVtI8-qE&feature=youtu.be 

== Project Download ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

== Project Online Demo ==
'''username: admin password: test-skf''' 
* https://demo.securityknowledgeframework.org 

'''Project website:''' 
* https://www.securityknowledgeframework.org 

== Project OWASP-SKF Pebble ==
'''Released OWASP-SKF Pebble in the Appstore for free''' 
* http://apps.getpebble.com/en_US/application/556b65b8389795176b000042 

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

|}

=Documentation=

For detailed information, documentation, tutorials and guide's please visit: 
https://skf.readme.io 
OR 
https://www.securityknowledgeframework.org 

Slides of workshop DevOpsDays 2015 Amsterdam: 
https://www.owasp.org/images/5/54/Skf-design-workshop.pptx.pdf

= Roadmap and Getting Involved =

==Roadmap==

Check out the: ''' [https://waffle.io/blabla1337/skf-flask Online Scrum Board] '''

- Add code examples -> relevant knowledge-base items in results
- Add CWE to checklists
- Add user management
- Add Python code examples
- Add Java code examples
- Add Go/Ruby/??? code examples

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Check Travis status if build is still working
Open a Pull Request

One of the authors will check your sample code or knowledge-base item and add it to the master repo.

= SKF SDLC =

SKF uses the following services to provide quality over the code and releases.

== Travis-ci.org:==
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:

https://travis-ci.org/blabla1337/skf-flask

== Coveralls.io:==
DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:

https://coveralls.io/r/blabla1337/skf-flask

== Scrutinizer-ci.com==
Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:

https://scrutinizer-ci.com/g/blabla1337/skf-flask/

== Uptimerobot.com==
Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.

== ssllabs.com & sslbadge.org ==

ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
https://www.ssllabs.com/ssltest/analyze.html?d=securityknowledgeframework.org

sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.

= Contributors =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
Roderick Schaefer 
Jim Manico 
Martijn Gijsberti Hodenpijl 
Bithin Alangot 

 
Thank you to my colleagues at Schuberg Philis for helping and giving feedback.

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-05-21T09:19:21Z

Riiecco: /* Project Resources */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework Project==
The OWASP Security Knowledge Framework Project is intended to be a tool used for building, verification and training. It's the first step in the Software (AND Security) Development Life Cycle.
 
 

==Description==

It is an expert system web-application that uses OWASP Application Security Verification Standard.
It support developers in pre-development (Security by design)
It support developers after release of code (OWASP Checklist Level 1-3)
Code-examples

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Resources ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide:
* http://skf.readme.io/v1.0/docs/installation 

'''Video tutorials:''' 
Pre development stage: 
* https://youtu.be/wETuGtaCCfc
Post development stage: 
* https://youtu.be/ntmiLNH_ECI
Knowledge base: 
* https://youtu.be/p1bQQmLY7CA

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

| valign="top" style="padding-left:25px;width:200px;" |

== News and Events ==

'''[24-03-2015:]''' First Stable release of the Security Knowledge Framework! Easy install with: pip install owasp-skf Check out the Github page for more details. Unix and Windows support

 

'''[17-03-2015:]''' First Alpha release of the Security Knowledge Framework!


|}

=FAQs=

For documentation, tutorials and guide's please visit:
http://www.securityknowledgeframework.com,
for more detailed information.

= Acknowledgements =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
 
Allot of colleagues at Schuberg Philis for helping and giving feedback. 
Thank you guys, let's make it more Awesome!

= Road Map and Getting Involved =

==Roadmap==

Check out the: [https://waffle.io/blabla1337/skf-flask Online Scrum Board]

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Open a Pull Request

One of the authors will check your code example or knowledge-base item and add it to the master repo

=Minimum Viable Product=

We already had allot of the content and experience with the expert system that we created in the PoC version build with PHP. 
The goal is to deliver an web-application that is easy to set-up and can run on different OS. 
For this we chosen the [http://flask.pocoo.org/ Python Flask], this runs both on Windows as Linux and is easy to install.

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-05-21T09:18:44Z

Riiecco: /* Project Resources */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework Project==
The OWASP Security Knowledge Framework Project is intended to be a tool used for building, verification and training. It's the first step in the Software (AND Security) Development Life Cycle.
 
 

==Description==

It is an expert system web-application that uses OWASP Application Security Verification Standard.
It support developers in pre-development (Security by design)
It support developers after release of code (OWASP Checklist Level 1-3)
Code-examples

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Resources ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide and extended documentation:
* http://skf.readme.io/ 

'''Video tutorials:''' 
Pre development stage: 
* https://youtu.be/wETuGtaCCfc
Post development stage: 
* https://youtu.be/ntmiLNH_ECI
Knowledge base: 
* https://youtu.be/p1bQQmLY7CA

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

| valign="top" style="padding-left:25px;width:200px;" |

== News and Events ==

'''[24-03-2015:]''' First Stable release of the Security Knowledge Framework! Easy install with: pip install owasp-skf Check out the Github page for more details. Unix and Windows support

 

'''[17-03-2015:]''' First Alpha release of the Security Knowledge Framework!


|}

=FAQs=

For documentation, tutorials and guide's please visit:
http://www.securityknowledgeframework.com,
for more detailed information.

= Acknowledgements =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
 
Allot of colleagues at Schuberg Philis for helping and giving feedback. 
Thank you guys, let's make it more Awesome!

= Road Map and Getting Involved =

==Roadmap==

Check out the: [https://waffle.io/blabla1337/skf-flask Online Scrum Board]

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Open a Pull Request

One of the authors will check your code example or knowledge-base item and add it to the master repo

=Minimum Viable Product=

We already had allot of the content and experience with the expert system that we created in the PoC version build with PHP. 
The goal is to deliver an web-application that is easy to set-up and can run on different OS. 
For this we chosen the [http://flask.pocoo.org/ Python Flask], this runs both on Windows as Linux and is easy to install.

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-05-11T21:25:36Z

Riiecco: /* Project Resources */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework Project==
The OWASP Security Knowledge Framework Project is intended to be a tool used for building, verification and training. It's the first step in the Software (AND Security) Development Life Cycle.
 
 

==Description==

It is an expert system web-application that uses OWASP Application Security Verification Standard.
It support developers in pre-development (Security by design)
It support developers after release of code (OWASP Checklist Level 1-3)
Code-examples

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Resources ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

Installation guide
* https://github.com/blabla1337/skf-flask/blob/master/README.md 

'''Video tutorials:''' 
Pre development stage: 
* https://youtu.be/wETuGtaCCfc
Post development stage: 
* https://youtu.be/ntmiLNH_ECI
Knowledge base: 
* https://youtu.be/p1bQQmLY7CA

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

| valign="top" style="padding-left:25px;width:200px;" |

== News and Events ==

'''[24-03-2015:]''' First Stable release of the Security Knowledge Framework! Easy install with: pip install owasp-skf Check out the Github page for more details. Unix and Windows support

 

'''[17-03-2015:]''' First Alpha release of the Security Knowledge Framework!


|}

=FAQs=

For documentation, tutorials and guide's please visit:
http://www.securityknowledgeframework.com,
for more detailed information.

= Acknowledgements =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
 
Allot of colleagues at Schuberg Philis for helping and giving feedback. 
Thank you guys, let's make it more Awesome!

= Road Map and Getting Involved =

==Roadmap==

Check out the: [https://waffle.io/blabla1337/skf-flask Online Scrum Board]

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Open a Pull Request

One of the authors will check your code example or knowledge-base item and add it to the master repo

=Minimum Viable Product=

We already had allot of the content and experience with the expert system that we created in the PoC version build with PHP. 
The goal is to deliver an web-application that is easy to set-up and can run on different OS. 
For this we chosen the [http://flask.pocoo.org/ Python Flask], this runs both on Windows as Linux and is easy to install.

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]

OWASP Security Knowledge Framework

2015-05-11T21:25:06Z

Riiecco: /* Project Resources */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==OWASP Security Knowledge Framework Project==
The OWASP Security Knowledge Framework Project is intended to be a tool used for building, verification and training. It's the first step in the Software (AND Security) Development Life Cycle.
 
 

==Description==

It is an expert system web-application that uses OWASP Application Security Verification Standard.
It support developers in pre-development (Security by design)
It support developers after release of code (OWASP Checklist Level 1-3)
Code-examples

Our experience taught us that the current level of security the current web-applications contain is not sufficient enough to ensure security. This is mainly because web-developers simpy aren't aware of the risks and dangers are lurking, waiting to be exploited by hackers.

Because of this we decided to develop a security tool in order to create a guide system available for all developers so they can develop applications secure by design.

The security knowledge framework is here to support developers create secure applications. By analysing proccessing techniques in which the developers use to edit their data the application can link these techniques to different known vulnerabilities and give the developer feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

The seccond stage of the application is validating if the developer properly implemented different types of defense mechanisms by means of
different checklists such as the application security verification standards.

By means of the answers supplied by the developer the application again generates documentation in which it gives feedback on what defense mechanisms he forgot to implement and give him feedback regarding descriptions and solutions on how to properly implement these techniques in a safe manner.

==Licensing==

This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== Project Resources ==
'''Github/source-code:''' 
* https://github.com/blabla1337/skf-flask 

'''Guide's and tutorials:''' 

Installation guide
* https://github.com/blabla1337/skf-flask/blob/master/README.md 
* http://www.securityknowledgeframework.org/index.html?#guide 

'''Video tutorials:''' 
Pre development stage: 
* https://youtu.be/wETuGtaCCfc
Post development stage: 
* https://youtu.be/ntmiLNH_ECI
Knowledge base: 
* https://youtu.be/p1bQQmLY7CA

== Related Projects ==

[[Image:Asvs-satellite.jpg]]'''OWASP Resources'''

* [https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard Project]

== Project Leaders ==
[mailto:glenntencate@gmail.com Glenn ten Cate] 
[mailto:r.tencate77@gmail.com Riccardo ten Cate]

==Classifications==

{| width="200" cellpadding="2"
|-
| colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
|-
|-
| colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
|}

| valign="top" style="padding-left:25px;width:200px;" |

== News and Events ==

'''[24-03-2015:]''' First Stable release of the Security Knowledge Framework! Easy install with: pip install owasp-skf Check out the Github page for more details. Unix and Windows support

 

'''[17-03-2015:]''' First Alpha release of the Security Knowledge Framework!


|}

=FAQs=

For documentation, tutorials and guide's please visit:
http://www.securityknowledgeframework.com,
for more detailed information.

= Acknowledgements =
==Contributors==

Glenn ten Cate 
Riccardo ten Cate 
Alexander Kaasjager 
John Haley 
Daniel Paulus 
Erik de Kuijper 
 
Allot of colleagues at Schuberg Philis for helping and giving feedback. 
Thank you guys, let's make it more Awesome!

= Road Map and Getting Involved =

==Roadmap==

Check out the: [https://waffle.io/blabla1337/skf-flask Online Scrum Board]

==Getting Involved==

Submitting a Pull Request on Guthub:

Fork it.
Create a branch (git checkout -b my_markup)
Commit your changes (git commit -am "Added Snarkdown")
Push to the branch (git push origin my_markup)
Open a Pull Request

One of the authors will check your code example or knowledge-base item and add it to the master repo

=Minimum Viable Product=

We already had allot of the content and experience with the expert system that we created in the PoC version build with PHP. 
The goal is to deliver an web-application that is easy to set-up and can run on different OS. 
For this we chosen the [http://flask.pocoo.org/ Python Flask], this runs both on Windows as Linux and is easy to install.

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]