https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Steven+van+der+Baan 2026-05-17T13:43:28Z User contributions MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=Cambridge&diff=224915 2017-01-11T17:23:39Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 19th January 2017 9:30– 17:00, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, British Computer Society (BCS) Cybercrime Forensics Special Internet Group and OWASP (Open Web Application Security Project) Cambridge Chapter.<br /> <br /> It looks increasingly likely that 2016 is going to be “Year of the Data Breach” with more and more organisation’s than ever before becoming part of the self-fulfilling prophecy, “there are two types of organization, those who know they’ve been breached and those who don’t”....<br /> <br /> So what happens if despite your best efforts your defenses are ineffective and you suffer a data breach. Your organization needs to know how to handle the breach either internally and externally, who to inform and who to call.<br /> <br /> What is needed is “incident response”, an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.<br /> <br /> Background<br /> <br /> OWASP (Open Web Application Security Project is a 501(c)(3) not-for-profit worldwide charitable organization focused on improving the security of application software. Their mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks.<br /> <br /> The British Computer Society (BCS) Cybercrime Forensics Special Interest Group (SIG) promotes Cybercrime Forensics and the use of Cybercrime Forensics; of relevance to computing professionals, lawyers, law enforcement officers, academics and those interested in the use of Cybercrime Forensics and the need to address cybercrime for the benefit of those groups and of the wider public.<br /> <br /> The Department of Computing &amp; Technology at Anglia Ruskin University is enhancing its curricula and capabilities in information security following its successful BSc(Hons) Information Security and Forensic Computing pathway. Establishing a joint professional networking groupwith OWASP concentrating on aspects of computing and application security is a key part of this enhancement.<br /> <br /> '''Guest speakers: Peter Yapp from NCSC, Steve Shepherd MBE from 7Safe/PA Consulting and Tony Drewitt from IT Governance'''<br /> <br /> <br /> <br /> '''Guest Speaker: Steve Shepperd MBE – Senior Forensic Consultant – 7Safe/PA Consulting'''<br /> <br /> '''Abstract:''' Malware Red Alert: the first 24 hours<br /> <br /> It’s Friday at 19:30. You are the acting manager of your organisation’s Security Operations Centre.<br /> You are working the graveyard shift with a colleague when ...<br /> <br /> Your SIEM alerts you to what may be the presence of a Trojan in your system. But before you have a chance to respond, you receive an email from a hacker making demands.<br /> <br /> The threat is that highly-confidential information has been stolen from your financial database. If the hacker does not receive £2 million by midnight on Sunday, they will put this data on the web just before your firm’s annual financial report, due for release on Monday, is published. Their motive: to cause panic among investors by undermining the credibility of your growth and profit forecasts with data that the hacker claims they have found in emails and report documents.<br /> <br /> What do you do next to thwart the attack, contain the incident and prevent, or at least minimise, damage to your brand name and reputation in the markets?Security incidents, both potential and actual, occur on a frequent basis. It is therefore important to accurately categorize incidents and prioritise the most severe. Evaluation is based on the impact that the data breach may have on business operations, the potential reputational risk and the time and cost of resources engaged in recovery.<br /> <br /> Of critical importance is the effective gathering of key information about the attack in real time. Focusing on quick fixes should be avoided. It is important to clearly document all information collected/actions performed for subsequent analysis in a post incident review/lessons learned session. A clear plan must be established, including timeframes and ownership, to implement any required changes that will mitigate future risk.<br /> <br /> Steve Shepherd MBE describes for the business audience a series of real life scenarios that will serve as a warning to Board members and SOC managers alike, as he shares his thoughts on how to apply the CREST Three-Phase CSIR model and invites the audience to role play with him in responding to this incident.<br /> <br /> If you think that you understand incident response procedures from a ‘people, process and technology’ standpoint, be prepared to challenge what you deem to be fact during Steve’s practical talk and demonstration. The emphasis will be on knowledge transfer - and why software tools are never the whole answer.<br /> <br /> <br /> '''Guest Speaker: Tony Drewitt, Head of Consultancy – IT Governance'''<br /> <br /> '''Abstract:''' Cyber resilience and Incident Response<br /> <br /> Tony will introduce today’s cyber threat environment and what it means in terms of security incidents. Cyber assurance techniques will be examined from 4 different perspectives, the conventional theme’s:<br /> <br /> - People,<br /> <br /> - Processes and<br /> <br /> - Technology<br /> <br /> but also examining Digital versus Physical security dimensions.<br /> <br /> The talk will conclude with a discussion on cyber resilience versus incident response and if incident response is a necessity, what structure should it take.<br /> <br /> '''Guest speaker: Peter Yapp - Deputy Director Incident Management for the National Cyber Security Centre (NCSC)'''<br /> <br /> '''Abstract:''' “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> <br /> <br /> '''Biography:''' Peter Yapp <br /> <br /> Before joining the NCSC, Peter was Deputy Director Operations for CERT-UK. Prior to CERT-UK, Peter was the Information Security Advisor for Brecon Group and before that the Managing Director for Accenture’s global Computer Incident Response Team (CIRT) running a team of 50 based at five locations around the world. While there, he set up a cyber threat intelligence team and inputted into technical, policy and training initiatives. He also contributed to the maintenance of the largest ISO27001 certification in the world.<br /> <br /> Prior to Accenture, Peter was head of Forensics and information security consulting at Control Risks in London. Peter devised and delivered information security awareness training courses for Oil and Gas clients around the world, specialised briefings on the threat of state sponsored espionage and a computer forensics training course for CISSPs. Peter reviewed and revised information security policy documents. He carried out IS Security (and ISO27001) reviews and gap analyses (and risk assessments) for the finance and manufacturing sectors. Peter carried out numerous computer investigations into fraud, abuse and misuse.<br /> <br /> Before joining Control Risks in 1998, Peter was a Senior Investigation officer in the National Investigation Service of H.M. Customs &amp; Excise. During this time he represented H.M. Customs &amp; Excise at national and international conferences and seminars, speaking at Interpol on computer crime. He was a member of the British Home Office delegation to the G8 sub group on High Tech crime. Peter trained overseas agencies around the world.<br /> <br /> <br /> '''Biography:''' Steve Shepperd MBE<br /> <br /> Steve leads the 7Safe Cyber Security Incident Response offering. Steve has extensive experience in conducting and directing forensic and hi-tech investigations having been involved in the discipline since the late the 1990’s. Steve has worked within the Civil Service, law enforcement and private industry, latterly employed as a cyber security specialist for a government intelligence agency prior to joining PA Consulting. Steve has been involved as a team member and team leader in myriad digital investigations ranging from civil to criminal and national security level incidents. Steve is also the lead developer and course manager for the Certified Malware Investigator course, the Certified Data Acquisition Technician course and is the author of our new cyber Network Investigations course.<br /> <br /> <br /> '''Biography:''' Tony Drewitt<br /> <br /> Tony leads IT Governance’s consultancy team. He works with clients to help them implement and comply with international standards such as ISO 27001 and ISO 22301 as well as other compliance frameworks such as the NHS Information Governance Toolkit and the UK Gambling Commission’s technical security standard.<br /> <br /> He has helped one of the first companies in the UK to achieve full certification under BS25999-2 (now ISO22301) and is currently delivering a number of ISO27001 ISMS projects for companies in the UK and overseas. He is also a leading business continuity author of ITGP titles A Manager’s Guide to ISO22301; ISO 22301: A Pocket Guide, and Everything You want to Know about Business Continuity.<br /> <br /> Tony is a full member of BCI and is a certified Lead Implementer and Lead Auditor for ISO 27001 and ISO 22301. He also holds CRISC, CISMP and ITIL Foundation certificates.<br /> <br /> '''Agenda'''<br /> <br /> 09:30 – 10:00 Registration &amp; Refreshments<br /> <br /> 10:00 – 10:15 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University <br /> <br /> 10:15 – 11:00 “National Cyber Security Centre’s Incident Response Strategy” – Peter Yapp – Deputy Director – Incident Management – National Cyber Security Centre (NCSC)<br /> <br /> 11:00 – 11:45 “Malware Red Alert: the first 24 hours” - Steven Shepherd MBE, 7Safe/PA Consulting <br /> <br /> 11:45 – 12:30 “Cyber resilience and Incident Response” Tony Drewitt, Head of Consultancy, IT Governance<br /> <br /> 12:30 – 13:15 Lunch &amp; Networking (LAB006)<br /> <br /> 13:15 – 14:15 Dr Jules Disso – Nettitude “Incident Analysis including Live Incident Analysis”<br /> <br /> 14:15 – 14:45 Refreshments (LAB006)<br /> <br /> 14:45 – 15:30 Benn Morris - 3B Data Security LLP &quot;Hacking Incidents - Real Life Case Examples”<br /> <br /> 15:30 – 16:15 Canterbury Christchurch University Speaker TBD<br /> <br /> 16:15 - 16:30 Session Wrap Up &amp; Close<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.eventbrite.com/e/joint-owasp-bcs-cybercrime-forensics-sig-incident-response-day-2017-tickets-30549478312 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=224912 2017-01-11T16:10:28Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 19th January 2017 9:30– 17:00, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, British Computer Society (BCS) Cybercrime Forensics Special Internet Group and OWASP (Open Web Application Security Project) Cambridge Chapter.<br /> <br /> It looks increasingly likely that 2016 is going to be “Year of the Data Breach” with more and more organisation’s than ever before becoming part of the self-fulfilling prophecy, “there are two types of organization, those who know they’ve been breached and those who don’t”....<br /> <br /> So what happens if despite your best efforts your defenses are ineffective and you suffer a data breach. Your organization needs to know how to handle the breach either internally and externally, who to inform and who to call.<br /> <br /> What is needed is “incident response”, an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.<br /> <br /> Background<br /> <br /> OWASP (Open Web Application Security Project is a 501(c)(3) not-for-profit worldwide charitable organization focused on improving the security of application software. Their mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks.<br /> <br /> The British Computer Society (BCS) Cybercrime Forensics Special Interest Group (SIG) promotes Cybercrime Forensics and the use of Cybercrime Forensics; of relevance to computing professionals, lawyers, law enforcement officers, academics and those interested in the use of Cybercrime Forensics and the need to address cybercrime for the benefit of those groups and of the wider public.<br /> <br /> The Department of Computing &amp; Technology at Anglia Ruskin University is enhancing its curricula and capabilities in information security following its successful BSc(Hons) Information Security and Forensic Computing pathway. Establishing a joint professional networking groupwith OWASP concentrating on aspects of computing and application security is a key part of this enhancement.<br /> <br /> '''Guest speakers: Peter Yapp from NCSC, Steve Shepherd MBE from 7Safe/PA Consulting and Tony Drewitt from IT Governance'''<br /> <br /> <br /> <br /> '''Guest Speaker: Steve Shepperd MBE – Senior Forensic Consultant – 7Safe/PA Consulting'''<br /> <br /> '''Abstract:''' Malware Red Alert: the first 24 hours<br /> <br /> It’s Friday at 19:30. You are the acting manager of your organisation’s Security Operations Centre.<br /> You are working the graveyard shift with a colleague when ...<br /> <br /> Your SIEM alerts you to what may be the presence of a Trojan in your system. But before you have a chance to respond, you receive an email from a hacker making demands.<br /> <br /> The threat is that highly-confidential information has been stolen from your financial database. If the hacker does not receive £2 million by midnight on Sunday, they will put this data on the web just before your firm’s annual financial report, due for release on Monday, is published. Their motive: to cause panic among investors by undermining the credibility of your growth and profit forecasts with data that the hacker claims they have found in emails and report documents.<br /> <br /> What do you do next to thwart the attack, contain the incident and prevent, or at least minimise, damage to your brand name and reputation in the markets?Security incidents, both potential and actual, occur on a frequent basis. It is therefore important to accurately categorize incidents and prioritise the most severe. Evaluation is based on the impact that the data breach may have on business operations, the potential reputational risk and the time and cost of resources engaged in recovery.<br /> <br /> Of critical importance is the effective gathering of key information about the attack in real time. Focusing on quick fixes should be avoided. It is important to clearly document all information collected/actions performed for subsequent analysis in a post incident review/lessons learned session. A clear plan must be established, including timeframes and ownership, to implement any required changes that will mitigate future risk.<br /> <br /> Steve Shepherd MBE describes for the business audience a series of real life scenarios that will serve as a warning to Board members and SOC managers alike, as he shares his thoughts on how to apply the CREST Three-Phase CSIR model and invites the audience to role play with him in responding to this incident.<br /> <br /> If you think that you understand incident response procedures from a ‘people, process and technology’ standpoint, be prepared to challenge what you deem to be fact during Steve’s practical talk and demonstration. The emphasis will be on knowledge transfer - and why software tools are never the whole answer.<br /> <br /> <br /> '''Guest Speaker: Tony Drewitt, Head of Consultancy – IT Governance'''<br /> <br /> '''Abstract:''' Cyber resilience and Incident Response<br /> <br /> Tony will introduce today’s cyber threat environment and what it means in terms of security incidents. Cyber assurance techniques will be examined from 4 different perspectives, the conventional theme’s:<br /> <br /> - People,<br /> <br /> - Processes and<br /> <br /> - Technology<br /> <br /> but also examining Digital versus Physical security dimensions.<br /> <br /> The talk will conclude with a discussion on cyber resilience versus incident response and if incident response is a necessity, what structure should it take.<br /> <br /> '''Guest speaker: Peter Yapp - Deputy Director Incident Management for the National Cyber Security Centre (NCSC)'''<br /> <br /> '''Abstract:''' “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> <br /> <br /> '''Biography:''' Peter Yapp <br /> <br /> Before joining the NCSC, Peter was Deputy Director Operations for CERT-UK. Prior to CERT-UK, Peter was the Information Security Advisor for Brecon Group and before that the Managing Director for Accenture’s global Computer Incident Response Team (CIRT) running a team of 50 based at five locations around the world. While there, he set up a cyber threat intelligence team and inputted into technical, policy and training initiatives. He also contributed to the maintenance of the largest ISO27001 certification in the world.<br /> <br /> Prior to Accenture, Peter was head of Forensics and information security consulting at Control Risks in London. Peter devised and delivered information security awareness training courses for Oil and Gas clients around the world, specialised briefings on the threat of state sponsored espionage and a computer forensics training course for CISSPs. Peter reviewed and revised information security policy documents. He carried out IS Security (and ISO27001) reviews and gap analyses (and risk assessments) for the finance and manufacturing sectors. Peter carried out numerous computer investigations into fraud, abuse and misuse.<br /> <br /> Before joining Control Risks in 1998, Peter was a Senior Investigation officer in the National Investigation Service of H.M. Customs &amp; Excise. During this time he represented H.M. Customs &amp; Excise at national and international conferences and seminars, speaking at Interpol on computer crime. He was a member of the British Home Office delegation to the G8 sub group on High Tech crime. Peter trained overseas agencies around the world.<br /> <br /> <br /> '''Biography:''' Steve Shepperd MBE<br /> <br /> Steve leads the 7Safe Cyber Security Incident Response offering. Steve has extensive experience in conducting and directing forensic and hi-tech investigations having been involved in the discipline since the late the 1990’s. Steve has worked within the Civil Service, law enforcement and private industry, latterly employed as a cyber security specialist for a government intelligence agency prior to joining PA Consulting. Steve has been involved as a team member and team leader in myriad digital investigations ranging from civil to criminal and national security level incidents. Steve is also the lead developer and course manager for the Certified Malware Investigator course, the Certified Data Acquisition Technician course and is the author of our new cyber Network Investigations course.<br /> <br /> <br /> '''Biography:''' Tony Drewitt<br /> <br /> Tony leads IT Governance’s consultancy team. He works with clients to help them implement and comply with international standards such as ISO 27001 and ISO 22301 as well as other compliance frameworks such as the NHS Information Governance Toolkit and the UK Gambling Commission’s technical security standard.<br /> <br /> He has helped one of the first companies in the UK to achieve full certification under BS25999-2 (now ISO22301) and is currently delivering a number of ISO27001 ISMS projects for companies in the UK and overseas. He is also a leading business continuity author of ITGP titles A Manager’s Guide to ISO22301; ISO 22301: A Pocket Guide, and Everything You want to Know about Business Continuity.<br /> <br /> Tony is a full member of BCI and is a certified Lead Implementer and Lead Auditor for ISO 27001 and ISO 22301. He also holds CRISC, CISMP and ITIL Foundation certificates.<br /> <br /> '''Agenda'''<br /> <br /> 09:30 – 10:00 Registration &amp; Refreshments<br /> <br /> 10:00 – 10:15 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 10:45 – 11:30 “National Cyber Security Centre’s Incident Response Strategy” – Peter Yapp – Deputy Director – Incident Management – National Cyber Security Centre (NCSC)<br /> <br /> 11:30 – 12:15 “Malware Red Alert: the first 24 hours” - Steven Shepherd MBE, 7Safe/PA Consulting<br /> <br /> 12:15 – 13:00 “Cyber resilience and Incident Response” Tony Drewitt, Head of Consultancy, IT Governance<br /> <br /> 13:00 – 13:45 Lunch &amp; Networking (LAB006)<br /> <br /> 13:45 – 14:30 Chris Dye, Glasswall TBD<br /> <br /> 14:30 – 15:15 Dr Jules Disso – Nettitude TBD<br /> <br /> 15:15 – 15:45 Refreshments (LAB006)<br /> <br /> 15:45 – 16:15 Benn Morris - 3B Data Security LLP TBD<br /> <br /> 16:15 – 16:45 Canterbury Christchurch University Speaker TBD<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.eventbrite.com/e/joint-owasp-bcs-cybercrime-forensics-sig-incident-response-day-2017-tickets-30549478312 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=223988 2016-12-08T10:53:17Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th December 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Guest speaker: Ken Munro from Pen Test Partners, Chris Dye from Glasswall and Ilkka Turunen from Sonatype'''<br /> <br /> <br /> <br /> '''Guest speaker: Ken Munro, Partner, Pen Test Partners'''<br /> <br /> '''Abstract:''' “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> Following the PoC thermostat ransomware that Pen Test Partners performed at DefCon 24, this presentation digs even deeper into IoT devices and their apps. Staying with the thermostat Ken will walk through the ransomware attack and then move onto general malware - which has no easy method for detection. Even when firewalled these devices are still vulnerable to local attacks so we’ll show you how you can achieve a compromise.<br /> <br /> <br /> '''Guest Speaker: Chris Dye VP Marketing &amp; Communications, Glasswall'''<br /> <br /> '''Abstract:''' Prevention is better than cure – don ’ t assume opening a business document is risk free!<br /> <br /> The security industry’s attempt to defend organisations by classifying known bad e.g. signatures or heuristics, is not succeeding, and the industry has turned its focus from prevention to post infection detection and breach mitigation.<br /> Today’s advanced, targeted cyber-attacks use weaponized files as an attack vector with a huge success rate. File-based threats involve hiding malware or malicious code within a common file-types, such as Word, Excel or PDF files. Conventional security controls such as firewalls, AV, and more advanced dynamic network sandboxes are ineffective in dealing with these types of threats as they only identify known threats or are unsuccessful in identifying exploits in the files. Chris will share how files are being manipulated and show the trends in attacks and techniques that can be deployed to eliminate document based attacks.<br /> <br /> <br /> '''Guest Speaker: Ilkka Turunen -Solutions Architect at Sonatype'''<br /> <br /> '''Abstract:''' DevSecOps - Security at Devops speed<br /> <br /> Software development is pressed for faster and faster release cycles with acceptable quality, budget and security. As movements like CI, CD and Devops aim to cut down on release cycles, it's security's job to help control the risk. The risk landscape is complex as modern development practices increasingly consume more and more third party code. Traditional methods do not cut it anymore - it's time for DevSecOps. This session gives an overview of how companies have implemented DevSecOps practices in their own delivery pipelines and how this can help increase developer awareness of risks affecting them. We'll walk an example CICD Pipeline and explore how security has been embedded as a part of it, how the movement is shaping up and how standards are starting to follow suite.<br /> <br /> <br /> '''Biography:''' Ken Munro<br /> <br /> Ken is a regular speaker at events such as the ISSA Dragon’s Den, (ISC)2 Chapter events and CREST (Council of Registered Ethical Security Testers), where he sits on the board. He’s also an Executive Member of the “Internet of Things Security Forum”, a body that aims to promote best security practice and the application of controls in smart device manufacturing, and spoke out on IoT security design flaws at the forum’s inaugural event. He’s also not averse to getting deeply techie, regularly participating in hacking challenges and demos at Black Hat, 44CON, DefCon and Bsides.<br /> Ken has a wealth of experience in penetration testing but it’s the systems and objects we come into contact with on an everyday basis that really pique his interest. This has seen him hack everything from keyless cars and a range of Internet of Things (IoT) devices, from wearable tech to children’s toys and smart home control systems. This has gained him notoriety among the national press, leading to regular appearances on BBC TV and BBC News online as well as the broadsheet press. He’s also a familiar contributor to industry magazines, penning articles for the legal, security, insurance, oil and gas, and manufacturing press.<br /> <br /> <br /> '''Biography:''' Chris Dye<br /> <br /> Having originally trained in electrical engineering and power generation Chris moved initially into IT recruitment and now has over 30 years’ experience of working in IT software and services companies. His career has spanned almost every operational, sales and marketing disciplines including investor relations, company operations, product analysis and design, recruitment, sales and marketing. He is also an experienced training consultant delivering talent development, sales and relationship management programs to commercial and technology companies. An entrepreneur at heart Chris has been involved in Glasswall since the beginning and is now heading up the marketing of its unique and disruptive technology.<br /> <br /> <br /> '''Biography:''' lkka Turunen, Sonatype<br /> <br /> Ilkka Turunen is a Solutions Architect working at Sonatype in Europe and Asia. His background is in software and systems engineering, acting as an architect for several commercial projects. He's helped define everything from the software design to web- scale infrastructure architectures and regularly works with companies across the world to understand and improve their software supply chain and continuous delivery pipelines.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 18:30 Talk from Ken Munro – Pen Test Partners “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> 18:30 - 19:15 Talk from Chris Dye, Glasswall “Prevention is better than cure – don’t assume opening a business document is risk free!”<br /> <br /> 19:15 – 20:00 Talk from Ilkka Turunen – Sonatype “DevSecOps - Security at Devops speed”<br /> <br /> 20:00 - 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006 - Sponsored by Sonatype<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.eventbrite.com/e/owasp-cambridge-chapter-malevolent-devices-documents-development-security-seminar-tickets-29668008813 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=223932 2016-12-06T10:01:09Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 13th December 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Guest speaker: Ken Munro from Pen Test Partners, Chris Dye from Glasswall and Ilkka Turunen from Sonatype'''<br /> <br /> <br /> <br /> '''Guest speaker: Ken Munro, Partner, Pen Test Partners'''<br /> <br /> '''Abstract:''' “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> Following the PoC thermostat ransomware that Pen Test Partners performed at DefCon 24, this presentation digs even deeper into IoT devices and their apps. Staying with the thermostat Ken will walk through the ransomware attack and then move onto general malware - which has no easy method for detection. Even when firewalled these devices are still vulnerable to local attacks so we’ll show you how you can achieve a compromise.<br /> <br /> <br /> '''Guest Speaker: Chris Dye VP Marketing &amp; Communications, Glasswall'''<br /> <br /> '''Abstract:''' Prevention is better than cure – don ’ t assume opening a business document is risk free!<br /> <br /> The security industry’s attempt to defend organisations by classifying known bad e.g. signatures or heuristics, is not succeeding, and the industry has turned its focus from prevention to post infection detection and breach mitigation.<br /> Today’s advanced, targeted cyber-attacks use weaponized files as an attack vector with a huge success rate. File-based threats involve hiding malware or malicious code within a common file-types, such as Word, Excel or PDF files. Conventional security controls such as firewalls, AV, and more advanced dynamic network sandboxes are ineffective in dealing with these types of threats as they only identify known threats or are unsuccessful in identifying exploits in the files. Chris will share how files are being manipulated and show the trends in attacks and techniques that can be deployed to eliminate document based attacks.<br /> <br /> <br /> '''Guest Speaker: Ilkka Turunen -Solutions Architect at Sonatype'''<br /> <br /> '''Abstract:''' DevSecOps - Security at Devops speed<br /> <br /> Software development is pressed for faster and faster release cycles with acceptable quality, budget and security. As movements like CI, CD and Devops aim to cut down on release cycles, it's security's job to help control the risk. The risk landscape is complex as modern development practices increasingly consume more and more third party code. Traditional methods do not cut it anymore - it's time for DevSecOps. This session gives an overview of how companies have implemented DevSecOps practices in their own delivery pipelines and how this can help increase developer awareness of risks affecting them. We'll walk an example CICD Pipeline and explore how security has been embedded as a part of it, how the movement is shaping up and how standards are starting to follow suite.<br /> <br /> <br /> '''Biography:''' Ken Munro<br /> <br /> Ken is a regular speaker at events such as the ISSA Dragon’s Den, (ISC)2 Chapter events and CREST (Council of Registered Ethical Security Testers), where he sits on the board. He’s also an Executive Member of the “Internet of Things Security Forum”, a body that aims to promote best security practice and the application of controls in smart device manufacturing, and spoke out on IoT security design flaws at the forum’s inaugural event. He’s also not averse to getting deeply techie, regularly participating in hacking challenges and demos at Black Hat, 44CON, DefCon and Bsides.<br /> Ken has a wealth of experience in penetration testing but it’s the systems and objects we come into contact with on an everyday basis that really pique his interest. This has seen him hack everything from keyless cars and a range of Internet of Things (IoT) devices, from wearable tech to children’s toys and smart home control systems. This has gained him notoriety among the national press, leading to regular appearances on BBC TV and BBC News online as well as the broadsheet press. He’s also a familiar contributor to industry magazines, penning articles for the legal, security, insurance, oil and gas, and manufacturing press.<br /> <br /> <br /> '''Biography:''' Chris Dye<br /> <br /> Having originally trained in electrical engineering and power generation Chris moved initially into IT recruitment and now has over 30 years’ experience of working in IT software and services companies. His career has spanned almost every operational, sales and marketing disciplines including investor relations, company operations, product analysis and design, recruitment, sales and marketing. He is also an experienced training consultant delivering talent development, sales and relationship management programs to commercial and technology companies. An entrepreneur at heart Chris has been involved in Glasswall since the beginning and is now heading up the marketing of its unique and disruptive technology.<br /> <br /> <br /> '''Biography:''' lkka Turunen, Sonatype<br /> <br /> Ilkka Turunen is a Solutions Architect working at Sonatype in Europe and Asia. His background is in software and systems engineering, acting as an architect for several commercial projects. He's helped define everything from the software design to web- scale infrastructure architectures and regularly works with companies across the world to understand and improve their software supply chain and continuous delivery pipelines.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 18:30 Talk from Ken Munro – Pen Test Partners “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> 18:30 - 19:15 Talk from Chris Dye, Glasswall “Prevention is better than cure – don’t assume opening a business document is risk free!”<br /> <br /> 19:15 – 20:00 Talk from Ilkka Turunen – Sonatype “DevSecOps - Security at Devops speed”<br /> <br /> 20:00 - 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006 - Sponsored by Sonatype<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.eventbrite.com/e/owasp-cambridge-chapter-malevolent-devices-documents-development-security-seminar-tickets-29668008813 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=223740 2016-11-30T15:06:36Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 13th December 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Guest speaker: Ken Munro from Pen Test Partners, Chris Dye from Glasswall and Ilkka Turunen from Sonatype'''<br /> <br /> <br /> <br /> '''Guest speaker: Ken Munro, Partner, Pen Test Partners'''<br /> <br /> '''Abstract:''' “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> Following the PoC thermostat ransomware that Pen Test Partners performed at DefCon 24, this presentation digs even deeper into IoT devices and their apps. Staying with the thermostat Ken will walk through the ransomware attack and then move onto general malware - which has no easy method for detection. Even when firewalled these devices are still vulnerable to local attacks so we’ll show you how you can achieve a compromise.<br /> <br /> <br /> '''Guest Speaker: Chris Dye VP Marketing &amp; Communications, Glasswall'''<br /> <br /> '''Abstract:''' Prevention is better than cure – don ’ t assume opening a business document is risk free!<br /> <br /> The security industry’s attempt to defend organisations by classifying known bad e.g. signatures or heuristics, is not succeeding, and the industry has turned its focus from prevention to post infection detection and breach mitigation.<br /> Today’s advanced, targeted cyber-attacks use weaponized files as an attack vector with a huge success rate. File-based threats involve hiding malware or malicious code within a common file-types, such as Word, Excel or PDF files. Conventional security controls such as firewalls, AV, and more advanced dynamic network sandboxes are ineffective in dealing with these types of threats as they only identify known threats or are unsuccessful in identifying exploits in the files. Chris will share how files are being manipulated and show the trends in attacks and techniques that can be deployed to eliminate document based attacks.<br /> <br /> <br /> '''Guest Speaker: Ilkka Turunen -Solutions Architect at Sonatype'''<br /> <br /> '''Abstract:''' DevSecOps - Security at Devops speed<br /> <br /> Software development is pressed for faster and faster release cycles with acceptable quality, budget and security. As movements like CI, CD and Devops aim to cut down on release cycles, it's security's job to help control the risk. The risk landscape is complex as modern development practices increasingly consume more and more third party code. Traditional methods do not cut it anymore - it's time for DevSecOps. This session gives an overview of how companies have implemented DevSecOps practices in their own delivery pipelines and how this can help increase developer awareness of risks affecting them. We'll walk an example CICD Pipeline and explore how security has been embedded as a part of it, how the movement is shaping up and how standards are starting to follow suite.<br /> <br /> <br /> '''Biography:''' Ken Munro<br /> <br /> Ken is a regular speaker at events such as the ISSA Dragon’s Den, (ISC)2 Chapter events and CREST (Council of Registered Ethical Security Testers), where he sits on the board. He’s also an Executive Member of the “Internet of Things Security Forum”, a body that aims to promote best security practice and the application of controls in smart device manufacturing, and spoke out on IoT security design flaws at the forum’s inaugural event. He’s also not averse to getting deeply techie, regularly participating in hacking challenges and demos at Black Hat, 44CON, DefCon and Bsides.<br /> Ken has a wealth of experience in penetration testing but it’s the systems and objects we come into contact with on an everyday basis that really pique his interest. This has seen him hack everything from keyless cars and a range of Internet of Things (IoT) devices, from wearable tech to children’s toys and smart home control systems. This has gained him notoriety among the national press, leading to regular appearances on BBC TV and BBC News online as well as the broadsheet press. He’s also a familiar contributor to industry magazines, penning articles for the legal, security, insurance, oil and gas, and manufacturing press.<br /> <br /> <br /> '''Biography:''' Chris Dye<br /> <br /> Having originally trained in electrical engineering and power generation Chris moved initially into IT recruitment and now has over 30 years’ experience of working in IT software and services companies. His career has spanned almost every operational, sales and marketing disciplines including investor relations, company operations, product analysis and design, recruitment, sales and marketing. He is also an experienced training consultant delivering talent development, sales and relationship management programs to commercial and technology companies. An entrepreneur at heart Chris has been involved in Glasswall since the beginning and is now heading up the marketing of its unique and disruptive technology.<br /> <br /> <br /> '''Biography:''' lkka Turunen, Sonatype<br /> <br /> Ilkka Turunen is a Solutions Architect working at Sonatype in Europe and Asia. His background is in software and systems engineering, acting as an architect for several commercial projects. He's helped define everything from the software design to web- scale infrastructure architectures and regularly works with companies across the world to understand and improve their software supply chain and continuous delivery pipelines.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 18:30 Talk from Ken Munro – Pen Test Partners “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> 18:30 - 19:15 Talk from Chris Dye, Glasswall “Prevention is better than cure – don’t assume opening a business document is risk free!”<br /> <br /> 19:15 – 20:00 Talk from Ilkka Turunen – Sonatype “DevSecOps - Security at Devops speed”<br /> <br /> 20:00 - 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006 - Sponsored by Sonatype<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.eventbrite.com/e/owasp-cambridge-chapter-malevolent-devices-<br /> documents-development-security-seminar-tickets-29668008813 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=223739 2016-11-30T15:05:50Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 13th December 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Guest speaker: Ken Munro from Pen Test Partners, Chris Dye from Glasswall and Ilkka Turunen from Sonatype'''<br /> <br /> <br /> <br /> '''Guest speaker: Ken Munro, Partner, Pen Test Partners'''<br /> <br /> '''Abstract:''' “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> Following the PoC thermostat ransomware that Pen Test Partners performed at DefCon 24, this presentation digs even deeper into IoT devices and their apps. Staying with the thermostat Ken will walk through the ransomware attack and then move onto general malware - which has no easy method for detection. Even when firewalled these devices are still vulnerable to local attacks so we’ll show you how you can achieve a compromise.<br /> <br /> <br /> '''Guest Speaker: Chris Dye VP Marketing &amp; Communications, Glasswall'''<br /> <br /> '''Abstract:''' Prevention is better than cure – don ’ t assume opening a business document is risk free!<br /> <br /> The security industry’s attempt to defend organisations by classifying known bad e.g. signatures or heuristics, is not succeeding, and the industry has turned its focus from prevention to post infection detection and breach mitigation.<br /> Today’s advanced, targeted cyber-attacks use weaponized files as an attack vector with a huge success rate. File-based threats involve hiding malware or malicious code within a common file-types, such as Word, Excel or PDF files. Conventional security controls such as firewalls, AV, and more advanced dynamic network sandboxes are ineffective in dealing with these types of threats as they only identify known threats or are unsuccessful in identifying exploits in the files. Chris will share how files are being manipulated and show the trends in attacks and techniques that can be deployed to eliminate document based attacks.<br /> <br /> <br /> '''Guest Speaker: Ilkka Turunen -Solutions Architect at Sonatype'''<br /> <br /> '''Abstract:''' DevSecOps - Security at Devops speed<br /> <br /> Software development is pressed for faster and faster release cycles with acceptable quality, budget and security. As movements like CI, CD and Devops aim to cut down on release cycles, it's security's job to help control the risk. The risk landscape is complex as modern development practices increasingly consume more and more third party code. Traditional methods do not cut it anymore - it's time for DevSecOps. This session gives an overview of how companies have implemented DevSecOps practices in their own delivery pipelines and how this can help increase developer awareness of risks affecting them. We'll walk an example CICD Pipeline and explore how security has been embedded as a part of it, how the movement is shaping up and how standards are starting to follow suite.<br /> <br /> <br /> '''Biography:''' Ken Munro<br /> <br /> Ken is a regular speaker at events such as the ISSA Dragon’s Den, (ISC)2 Chapter events and CREST (Council of Registered Ethical Security Testers), where he sits on the board. He’s also an Executive Member of the “Internet of Things Security Forum”, a body that aims to promote best security practice and the application of controls in smart device manufacturing, and spoke out on IoT security design flaws at the forum’s inaugural event. He’s also not averse to getting deeply techie, regularly participating in hacking challenges and demos at Black Hat, 44CON, DefCon and Bsides.<br /> Ken has a wealth of experience in penetration testing but it’s the systems and objects we come into contact with on an everyday basis that really pique his interest. This has seen him hack everything from keyless cars and a range of Internet of Things (IoT) devices, from wearable tech to children’s toys and smart home control systems. This has gained him notoriety among the national press, leading to regular appearances on BBC TV and BBC News online as well as the broadsheet press. He’s also a familiar contributor to industry magazines, penning articles for the legal, security, insurance, oil and gas, and manufacturing press.<br /> <br /> <br /> '''Biography:''' Chris Dye<br /> <br /> Having originally trained in electrical engineering and power generation Chris moved initially into IT recruitment and now has over 30 years’ experience of working in IT software and services companies. His career has spanned almost every operational, sales and marketing disciplines including investor relations, company operations, product analysis and design, recruitment, sales and marketing. He is also an experienced training consultant delivering talent development, sales and relationship management programs to commercial and technology companies. An entrepreneur at heart Chris has been involved in Glasswall since the beginning and is now heading up the marketing of its unique and disruptive technology.<br /> <br /> <br /> '''Biography:''' lkka Turunen, Sonatype<br /> <br /> Ilkka Turunen is a Solutions Architect working at Sonatype in Europe and Asia. His background is in software and systems engineering, acting as an architect for several commercial projects. He's helped define everything from the software design to web- scale infrastructure architectures and regularly works with companies across the world to understand and improve their software supply chain and continuous delivery pipelines.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 18:30 Talk from Ken Munro – Pen Test Partners “The Thermostat, the Hacker, and the Malware&quot;<br /> <br /> 18:30 - 19:15 Talk from Chris Dye, Glasswall “Prevention is better than cure – don’t assume opening a business document is risk free!”<br /> <br /> 19:15 – 20:00 Talk from Ilkka Turunen – Sonatype “DevSecOps - Security at Devops speed”<br /> <br /> 20:00 - 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006 - Sponsored by Sonatype<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=223738 2016-11-30T14:55:55Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 10th November 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Graham Rymer – University of Cambridge and Marc Wickenden – 4Armed'''<br /> <br /> Topic: Pen Testing Tales<br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Presentations<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 13th December 2016<br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Nov 2016<br /> | Graham Rymer / University of Cambridge <br /> |<br /> |-<br /> | 10 Nov 2016<br /> | Mark Wickenden<br /> |<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=222627 2016-10-24T10:09:38Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Thursday 10th November 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Graham Rymer – University of Cambridge and Marc Wickenden – 4Armed'''<br /> <br /> Topic: Pen Testing Tales<br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Presentations<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 13th December 2016<br /> <br /> Thursday 19th January 2017<br /> <br /> Wednesday 25th January 2017<br /> <br /> Tuesday 7th February 2017<br /> <br /> Tuesday 7th March 2017<br /> <br /> Tuesday 4th April 2017<br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=222626 2016-10-24T10:05:43Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 8th March 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Andrew Lee-Thorp - Cigital'''<br /> <br /> Andrew Lee-Thorp is a security consultant with over 10 years of experience cutting his teeth in development from smart cards through to high-end servers systems. He currently works as a Consultant with Cigital Ltd where he performs code reviews, architectural risk analysis, and Android testing. Andrew's strategic focus is in developing assessment tooling and improving mobile testing capability within the company where he works. Andrew holds a postgraduate degree in Computer Science and a Masters in Information Security.<br /> <br /> '''Title : So you want to use a WebView? Android WebView: Attack and Defence'''<br /> <br /> The (Android) WebView is an embeddable component that powers the majority of internet-enabled apps. In Android, WebViews are currently a hot topic but for all the wrong reasons. WebViews make connections, render HTML and run JavaScript and so can be attacked using traditional web attacks like connection hijacking and XSS. Secondly, WebView-enabled apps combine local resources with web-based content that are rendered in the same container. This makes a Same Origin Policy bypass far more dangerous: it can mean access to the local device file-system and juicy local user data that you thought was sandboxed. Malicious code can even target other applications remotely by using the WebView as a proxy. Finally WebViews create residual risks that simply cannot be mitigated through any in-app technical control. This talk is aimed at both testers and developers. They learn some fundamental WebView mistakes, how to attack them, how to fix them and which vulnerabilities simply must be accepted in this design.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Andrew Lee-Thorp, Cigital “So you want to use a WebView? Android WebView: Attack and Defence”<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 08 03 2016<br /> | Andrew Lee-Thorp / So you want to use a WebView? Android WebView: Attack and Defence<br /> |<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=218517 2016-07-04T10:45:01Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 8th March 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Andrew Lee-Thorp - Cigital'''<br /> <br /> Andrew Lee-Thorp is a security consultant with over 10 years of experience cutting his teeth in development from smart cards through to high-end servers systems. He currently works as a Consultant with Cigital Ltd where he performs code reviews, architectural risk analysis, and Android testing. Andrew's strategic focus is in developing assessment tooling and improving mobile testing capability within the company where he works. Andrew holds a postgraduate degree in Computer Science and a Masters in Information Security.<br /> <br /> '''Title : So you want to use a WebView? Android WebView: Attack and Defence'''<br /> <br /> The (Android) WebView is an embeddable component that powers the majority of internet-enabled apps. In Android, WebViews are currently a hot topic but for all the wrong reasons. WebViews make connections, render HTML and run JavaScript and so can be attacked using traditional web attacks like connection hijacking and XSS. Secondly, WebView-enabled apps combine local resources with web-based content that are rendered in the same container. This makes a Same Origin Policy bypass far more dangerous: it can mean access to the local device file-system and juicy local user data that you thought was sandboxed. Malicious code can even target other applications remotely by using the WebView as a proxy. Finally WebViews create residual risks that simply cannot be mitigated through any in-app technical control. This talk is aimed at both testers and developers. They learn some fundamental WebView mistakes, how to attack them, how to fix them and which vulnerabilities simply must be accepted in this design.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Andrew Lee-Thorp, Cigital “So you want to use a WebView? Android WebView: Attack and Defence”<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[Media:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf|presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[MEdia:Building_a_resilient_ICS.pdf|presentation]]<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=File:Cyber_Threat_Presentation_-_ARU_Cyber_Resilience_-_May_2016.pdf&diff=218516 2016-07-04T10:44:30Z

<p>Steven van der Baan: </p> <hr /> <div></div>

Steven van der Baan https://wiki.owasp.org/index.php?title=File:Building_a_resilient_ICS.pdf&diff=218515 2016-07-04T10:42:31Z

<p>Steven van der Baan: </p> <hr /> <div></div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=218514 2016-07-04T10:41:09Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 8th March 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Andrew Lee-Thorp - Cigital'''<br /> <br /> Andrew Lee-Thorp is a security consultant with over 10 years of experience cutting his teeth in development from smart cards through to high-end servers systems. He currently works as a Consultant with Cigital Ltd where he performs code reviews, architectural risk analysis, and Android testing. Andrew's strategic focus is in developing assessment tooling and improving mobile testing capability within the company where he works. Andrew holds a postgraduate degree in Computer Science and a Masters in Information Security.<br /> <br /> '''Title : So you want to use a WebView? Android WebView: Attack and Defence'''<br /> <br /> The (Android) WebView is an embeddable component that powers the majority of internet-enabled apps. In Android, WebViews are currently a hot topic but for all the wrong reasons. WebViews make connections, render HTML and run JavaScript and so can be attacked using traditional web attacks like connection hijacking and XSS. Secondly, WebView-enabled apps combine local resources with web-based content that are rendered in the same container. This makes a Same Origin Policy bypass far more dangerous: it can mean access to the local device file-system and juicy local user data that you thought was sandboxed. Malicious code can even target other applications remotely by using the WebView as a proxy. Finally WebViews create residual risks that simply cannot be mitigated through any in-app technical control. This talk is aimed at both testers and developers. They learn some fundamental WebView mistakes, how to attack them, how to fix them and which vulnerabilities simply must be accepted in this design.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Andrew Lee-Thorp, Cigital “So you want to use a WebView? Android WebView: Attack and Defence”<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 12 05 2016<br /> | Phil Cobley / Modern Policing &amp; the Fight Against Cyber Crime<br /> | [[presentation]]<br /> |-<br /> | 12 05 2016<br /> | Jules Pagna Disso / Building a resilient ICS <br /> | [[presentation]]<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=210346 2016-03-03T10:19:24Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 8th March 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Andrew Lee-Thorp - Cigital'''<br /> <br /> Andrew Lee-Thorp is a security consultant with over 10 years of experience cutting his teeth in development from smart cards through to high-end servers systems. He currently works as a Consultant with Cigital Ltd where he performs code reviews, architectural risk analysis, and Android testing. Andrew's strategic focus is in developing assessment tooling and improving mobile testing capability within the company where he works. Andrew holds a postgraduate degree in Computer Science and a Masters in Information Security.<br /> <br /> '''Title : So you want to use a WebView? Android WebView: Attack and Defence'''<br /> <br /> The (Android) WebView is an embeddable component that powers the majority of internet-enabled apps. In Android, WebViews are currently a hot topic but for all the wrong reasons. WebViews make connections, render HTML and run JavaScript and so can be attacked using traditional web attacks like connection hijacking and XSS. Secondly, WebView-enabled apps combine local resources with web-based content that are rendered in the same container. This makes a Same Origin Policy bypass far more dangerous: it can mean access to the local device file-system and juicy local user data that you thought was sandboxed. Malicious code can even target other applications remotely by using the WebView as a proxy. Finally WebViews create residual risks that simply cannot be mitigated through any in-app technical control. This talk is aimed at both testers and developers. They learn some fundamental WebView mistakes, how to attack them, how to fix them and which vulnerabilities simply must be accepted in this design.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Andrew Lee-Thorp, Cigital “So you want to use a WebView? Android WebView: Attack and Defence”<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=210345 2016-03-03T10:18:27Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 8th March 2016 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, Institute of Information Security Professionals (IISP) East Anglia Branch and OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Andrew Lee-Thorp - Cigital'''<br /> <br /> Andrew Lee-Thorp is a security consultant with over 10 years of experience cutting his teeth in development from smart cards through to high-end servers systems. He currently works as a Consultant with Cigital Ltd where he performs code reviews, architectural risk analysis, and Android testing. Andrew's strategic focus is in developing assessment tooling and improving mobile testing capability within the company where he works. Andrew holds a postgraduate degree in Computer Science and a Masters in Information Security.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> The (Android) WebView is an embeddable component that powers the majority of internet-enabled apps. In Android, WebViews are currently a hot topic but for all the wrong reasons. WebViews make connections, render HTML and run JavaScript and so can be attacked using traditional web attacks like connection hijacking and XSS. Secondly, WebView-enabled apps combine local resources with web-based content that are rendered in the same container. This makes a Same Origin Policy bypass far more dangerous: it can mean access to the local device file-system and juicy local user data that you thought was sandboxed. Malicious code can even target other applications remotely by using the WebView as a proxy. Finally WebViews create residual risks that simply cannot be mitigated through any in-app technical control. This talk is aimed at both testers and developers. They learn some fundamental WebView mistakes, how to attack them, how to fix them and which vulnerabilities simply must be accepted in this design.<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 - 17:45 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 - 19:00 Andrew Lee-Thorp, Cigital “So you want to use a WebView? Android WebView: Attack and Defence”<br /> <br /> 19:00 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=210344 2016-03-03T10:16:51Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th November 2015 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steve Lord - Mandarolian'''<br /> <br /> Steve has been a career penetration tester for 16 years and has a special love for snake oil solutions. When not pulling apart IoT devices, Steve breaks into networks and applications at Mandalorian, co-organises the UKs 44CON Cybersecurity and 44CON London conferences and builds devious hardware.<br /> <br /> Steve keynoted AppSec EU earlier this year talking about the Internet of Things, and previously spoke at AppsecEU in 2009 about WordPress (in)security in Dublin. He also writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magazine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> Have you ever felt that your life is incomplete without socks that tell you when to wash them? Do you feel a strange hollow sense of ennui that can only be filled with a cloud-based solution for tracking the freshness and replenishment of eggs in your fridge? Well worry no more, friend, the Internet of Things is here with solutions for every problem, even ones that don’t exist!<br /> <br /> In this talk we’ll take a humorous look at the way the wonderful world of IoT works, the security issues surrounding it and I’ll focus specifically on the IoT widgets, and problems facing IoT designers and providers. We’ll also look at some hypothetical solutions and my own failed attempts at implementing them.<br /> <br /> '''Guest speakers: John Mersh - Trusted Software'''<br /> <br /> John has worked in the computer industry for the last 30 years in fields ranging from CAD to Hardware Security Modules to Mobile Phones. He has been working in software security for more than ten years.<br /> <br /> John has worked on systems ranging in size from mainframes down to Java cards and has been deeply involved with the development of security standards such as the GlobalPlatform TEE, Trusted Computing Group Mobile TPM, OMTP mobile security standards and the Bluetooth Link Manager. He has worked for a variety of companies including ARM on the TrustZone Architecture and now runs his own consultancy company.<br /> <br /> ''' Title: Software and System Security: a life vest in the IoT ocean'''<br /> <br /> Software and system security is always given at least lip service by every IoT provider but how many actually implement it? <br /> <br /> This talk covers the many areas that software and system security covers which don't just cover the “things” but the whole system. John will explain how the right security solution can not only protect your customers but can protect your IP and your business against the sharks that are to be found in the IoT ocean.<br /> <br /> '''Agenda'''<br /> <br /> 18:00 - 18:15 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 18:15 - 19:15 &quot;Software and System Security: a life vest in the IoT ocean&quot; John Mersh - Trusted Software<br /> <br /> 19:15 - 20:15 &quot;Trying (and failing) to secure the Internet of Things&quot; Steve Lord - Mandarolian<br /> <br /> 20:15 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=210343 2016-03-03T10:16:34Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th November 2015 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steve Lord - Mandarolian'''<br /> <br /> Steve has been a career penetration tester for 16 years and has a special love for snake oil solutions. When not pulling apart IoT devices, Steve breaks into networks and applications at Mandalorian, co-organises the UKs 44CON Cybersecurity and 44CON London conferences and builds devious hardware.<br /> <br /> Steve keynoted AppSec EU earlier this year talking about the Internet of Things, and previously spoke at AppsecEU in 2009 about WordPress (in)security in Dublin. He also writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magazine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> Have you ever felt that your life is incomplete without socks that tell you when to wash them? Do you feel a strange hollow sense of ennui that can only be filled with a cloud-based solution for tracking the freshness and replenishment of eggs in your fridge? Well worry no more, friend, the Internet of Things is here with solutions for every problem, even ones that don’t exist!<br /> <br /> In this talk we’ll take a humorous look at the way the wonderful world of IoT works, the security issues surrounding it and I’ll focus specifically on the IoT widgets, and problems facing IoT designers and providers. We’ll also look at some hypothetical solutions and my own failed attempts at implementing them.<br /> <br /> '''Guest speakers: John Mersh - Trusted Software'''<br /> <br /> John has worked in the computer industry for the last 30 years in fields ranging from CAD to Hardware Security Modules to Mobile Phones. He has been working in software security for more than ten years.<br /> <br /> John has worked on systems ranging in size from mainframes down to Java cards and has been deeply involved with the development of security standards such as the GlobalPlatform TEE, Trusted Computing Group Mobile TPM, OMTP mobile security standards and the Bluetooth Link Manager. He has worked for a variety of companies including ARM on the TrustZone Architecture and now runs his own consultancy company.<br /> <br /> ''' Title: Software and System Security: a life vest in the IoT ocean'''<br /> <br /> Software and system security is always given at least lip service by every IoT provider but how many actually implement it? <br /> <br /> This talk covers the many areas that software and system security covers which don't just cover the “things” but the whole system. John will explain how the right security solution can not only protect your customers but can protect your IP and your business against the sharks that are to be found in the IoT ocean.<br /> <br /> '''Agenda'''<br /> <br /> 18:00 - 18:15 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 18:15 - 19:15 &quot;Software and System Security: a life vest in the IoT ocean&quot; John Mersh - Trusted Software<br /> <br /> 19:15 - 20:15 &quot;Trying (and failing) to secure the Internet of Things&quot; Steve Lord - Mandarolian<br /> <br /> 20:15 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> | -<br /> |<br /> | John Mersh / Software and System Security: a life vest in the IoT ocean<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=210342 2016-03-03T10:14:21Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th November 2015 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steve Lord - Mandarolian'''<br /> <br /> Steve has been a career penetration tester for 16 years and has a special love for snake oil solutions. When not pulling apart IoT devices, Steve breaks into networks and applications at Mandalorian, co-organises the UKs 44CON Cybersecurity and 44CON London conferences and builds devious hardware.<br /> <br /> Steve keynoted AppSec EU earlier this year talking about the Internet of Things, and previously spoke at AppsecEU in 2009 about WordPress (in)security in Dublin. He also writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magazine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> Have you ever felt that your life is incomplete without socks that tell you when to wash them? Do you feel a strange hollow sense of ennui that can only be filled with a cloud-based solution for tracking the freshness and replenishment of eggs in your fridge? Well worry no more, friend, the Internet of Things is here with solutions for every problem, even ones that don’t exist!<br /> <br /> In this talk we’ll take a humorous look at the way the wonderful world of IoT works, the security issues surrounding it and I’ll focus specifically on the IoT widgets, and problems facing IoT designers and providers. We’ll also look at some hypothetical solutions and my own failed attempts at implementing them.<br /> <br /> '''Guest speakers: John Mersh - Trusted Software'''<br /> <br /> John has worked in the computer industry for the last 30 years in fields ranging from CAD to Hardware Security Modules to Mobile Phones. He has been working in software security for more than ten years.<br /> <br /> John has worked on systems ranging in size from mainframes down to Java cards and has been deeply involved with the development of security standards such as the GlobalPlatform TEE, Trusted Computing Group Mobile TPM, OMTP mobile security standards and the Bluetooth Link Manager. He has worked for a variety of companies including ARM on the TrustZone Architecture and now runs his own consultancy company.<br /> <br /> ''' Title: Software and System Security: a life vest in the IoT ocean'''<br /> <br /> Software and system security is always given at least lip service by every IoT provider but how many actually implement it? <br /> <br /> This talk covers the many areas that software and system security covers which don't just cover the “things” but the whole system. John will explain how the right security solution can not only protect your customers but can protect your IP and your business against the sharks that are to be found in the IoT ocean.<br /> <br /> '''Agenda'''<br /> <br /> 18:00 - 18:15 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 18:15 - 19:15 &quot;Software and System Security: a life vest in the IoT ocean&quot; John Mersh - Trusted Software<br /> <br /> 19:15 - 20:15 &quot;Trying (and failing) to secure the Internet of Things&quot; Steve Lord - Mandarolian<br /> <br /> 20:15 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 11 2015<br /> | Steve Lord / Trying (and failing) to secure the Internet of Things<br /> |<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=203147 2015-11-06T10:12:57Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th November 2015 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steve Lord - Mandarolian'''<br /> <br /> Steve has been a career penetration tester for 16 years and has a special love for snake oil solutions. When not pulling apart IoT devices, Steve breaks into networks and applications at Mandalorian, co-organises the UKs 44CON Cybersecurity and 44CON London conferences and builds devious hardware.<br /> <br /> Steve keynoted AppSec EU earlier this year talking about the Internet of Things, and previously spoke at AppsecEU in 2009 about WordPress (in)security in Dublin. He also writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magazine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> Have you ever felt that your life is incomplete without socks that tell you when to wash them? Do you feel a strange hollow sense of ennui that can only be filled with a cloud-based solution for tracking the freshness and replenishment of eggs in your fridge? Well worry no more, friend, the Internet of Things is here with solutions for every problem, even ones that don’t exist!<br /> <br /> In this talk we’ll take a humorous look at the way the wonderful world of IoT works, the security issues surrounding it and I’ll focus specifically on the IoT widgets, and problems facing IoT designers and providers. We’ll also look at some hypothetical solutions and my own failed attempts at implementing them.<br /> <br /> '''Guest speakers: John Mersh - Trusted Software'''<br /> <br /> John has worked in the computer industry for the last 30 years in fields ranging from CAD to Hardware Security Modules to Mobile Phones. He has been working in software security for more than ten years.<br /> <br /> John has worked on systems ranging in size from mainframes down to Java cards and has been deeply involved with the development of security standards such as the GlobalPlatform TEE, Trusted Computing Group Mobile TPM, OMTP mobile security standards and the Bluetooth Link Manager. He has worked for a variety of companies including ARM on the TrustZone Architecture and now runs his own consultancy company.<br /> <br /> ''' Title: Software and System Security: a life vest in the IoT ocean'''<br /> <br /> Software and system security is always given at least lip service by every IoT provider but how many actually implement it? <br /> <br /> This talk covers the many areas that software and system security covers which don't just cover the “things” but the whole system. John will explain how the right security solution can not only protect your customers but can protect your IP and your business against the sharks that are to be found in the IoT ocean.<br /> <br /> '''Agenda'''<br /> <br /> 18:00 - 18:15 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 18:15 - 19:15 &quot;Software and System Security: a life vest in the IoT ocean&quot; John Mersh - Trusted Software<br /> <br /> 19:15 - 20:15 &quot;Trying (and failing) to secure the Internet of Things&quot; Steve Lord - Mandarolian<br /> <br /> 20:15 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=203146 2015-11-06T10:12:05Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:45 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steve Lord - Mandarolian'''<br /> <br /> Steve has been a career penetration tester for 16 years and has a special love for snake oil solutions. When not pulling apart IoT devices, Steve breaks into networks and applications at Mandalorian, co-organises the UKs 44CON Cybersecurity and 44CON London conferences and builds devious hardware.<br /> <br /> Steve keynoted AppSec EU earlier this year talking about the Internet of Things, and previously spoke at AppsecEU in 2009 about WordPress (in)security in Dublin. He also writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magazine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> Have you ever felt that your life is incomplete without socks that tell you when to wash them? Do you feel a strange hollow sense of ennui that can only be filled with a cloud-based solution for tracking the freshness and replenishment of eggs in your fridge? Well worry no more, friend, the Internet of Things is here with solutions for every problem, even ones that don’t exist!<br /> <br /> In this talk we’ll take a humorous look at the way the wonderful world of IoT works, the security issues surrounding it and I’ll focus specifically on the IoT widgets, and problems facing IoT designers and providers. We’ll also look at some hypothetical solutions and my own failed attempts at implementing them.<br /> <br /> '''Guest speakers: John Mersh - Trusted Software'''<br /> <br /> John has worked in the computer industry for the last 30 years in fields ranging from CAD to Hardware Security Modules to Mobile Phones. He has been working in software security for more than ten years.<br /> <br /> John has worked on systems ranging in size from mainframes down to Java cards and has been deeply involved with the development of security standards such as the GlobalPlatform TEE, Trusted Computing Group Mobile TPM, OMTP mobile security standards and the Bluetooth Link Manager. He has worked for a variety of companies including ARM on the TrustZone Architecture and now runs his own consultancy company.<br /> <br /> ''' Title: Software and System Security: a life vest in the IoT ocean'''<br /> <br /> Software and system security is always given at least lip service by every IoT provider but how many actually implement it? <br /> <br /> This talk covers the many areas that software and system security covers which don't just cover the “things” but the whole system. John will explain how the right security solution can not only protect your customers but can protect your IP and your business against the sharks that are to be found in the IoT ocean.<br /> <br /> '''Agenda'''<br /> <br /> 18:00 - 18:15 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 18:15 - 19:15 &quot;Software and System Security: a life vest in the IoT ocean&quot; John Mersh - Trusted Software<br /> <br /> 19:15 - 20:15 &quot;Trying (and failing) to secure the Internet of Things&quot; Steve Lord - Mandarolian<br /> <br /> 20:15 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=202655 2015-10-26T13:59:04Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steve Lord - Mandarolian'''<br /> <br /> Steve has been a career penetration tester for 16 years and has a special love for snake oil solutions. When not pulling apart IoT devices, Steve breaks into networks and applications at Mandalorian, co-organises the UKs 44CON Cybersecurity and 44CON London conferences and builds devious hardware.<br /> <br /> Steve keynoted AppSec EU earlier this year talking about the Internet of Things, and previously spoke at AppsecEU in 2009 about WordPress (in)security in Dublin. He also writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magazine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.<br /> <br /> '''Title : Trying (and failing) to secure the Internet of Things'''<br /> <br /> Have you ever felt that your life is incomplete without socks that tell you when to wash them? Do you feel a strange hollow sense of ennui that can only be filled with a cloud-based solution for tracking the freshness and replenishment of eggs in your fridge? Well worry no more, friend, the Internet of Things is here with solutions for every problem, even ones that don’t exist!<br /> <br /> In this talk we’ll take a humorous look at the way the wonderful world of IoT works, the security issues surrounding it and I’ll focus specifically on the IoT widgets, and problems facing IoT designers and providers. We’ll also look at some hypothetical solutions and my own failed attempts at implementing them.<br /> <br /> '''Guest speakers: John Mersh - Trusted Software'''<br /> <br /> John has worked in the computer industry for the last 30 years in fields ranging from CAD to Hardware Security Modules to Mobile Phones. He has been working in software security for more than ten years.<br /> <br /> John has worked on systems ranging in size from mainframes down to Java cards and has been deeply involved with the development of security standards such as the GlobalPlatform TEE, Trusted Computing Group Mobile TPM, OMTP mobile security standards and the Bluetooth Link Manager. He has worked for a variety of companies including ARM on the TrustZone Architecture and now runs his own consultancy company.<br /> <br /> ''' Title: Software and System Security: a life vest in the IoT ocean'''<br /> <br /> Software and system security is always given at least lip service by every IoT provider but how many actually implement it? <br /> <br /> This talk covers the many areas that software and system security covers which don't just cover the “things” but the whole system. John will explain how the right security solution can not only protect your customers but can protect your IP and your business against the sharks that are to be found in the IoT ocean.<br /> <br /> '''Agenda'''<br /> <br /> 18:00 - 18:15 Welcome from the OWASP Cambridge Chapter Leader &amp; &quot;Introduction to the OWASP IoT Project&quot; Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 18:15 - 19:15 &quot;Software and System Security: a life vest in the IoT ocean&quot; John Mersh - Trusted Software<br /> <br /> 19:15 - 20:15 &quot;Trying (and failing) to secure the Internet of Things&quot; Steve Lord - Mandarolian<br /> <br /> 20:15 - 21:00 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=202654 2015-10-26T13:51:50Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Simit &quot;sid&quot; Siddharth, founder of NotSoSecure Ltd'''<br /> <br /> Sumit &quot;sid&quot; Siddharth is the founder of NotSoSecure Ltd, a specialist IT security firm delivering high-end IT security consultancy and Training. Prior to NotSoSecure, he worked as Head of Penetration Testing for a leading IT security company in UK. He has more than 10 years of experience in Penetration Testing. Sid has authored a number of whitepapers and tools. He has been a Speaker/Trainer at many security conferences including numerous Black Hat, DEF CON, OWASP Appsec, HITB etc. Sid is also a co-author of the book SQL Injection: Attacks and Defence (2nd edition). Over the years, Sid has identified several critical flaws in leading software and helped fix these bugs. These include products from Microsoft, Oracle, Intel, Wordpress etc. He has trained several security consultants/penetration testers and helped them get better at their jobs.<br /> <br /> <br /> <br /> '''Title : Some neat, new and ridiculous hacks from our vault'''<br /> <br /> If you do pentest for living, then you should be used to compromising applications and networks pretty much on a daily basis. However, each hack is unique and some are more special than others. There are those that help you stay in job, those that keep you awake in night and then there are those that define why we do pentest. In this talk, Sid will share some neat, new and ridiculous hacks which he and his colleagues at NotSoSecure have come across during real life pentest.<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:45 Simit Siddharth - Some neat, new and ridiculous hacks from our vault<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 10th November 2015<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=202653 2015-10-26T13:51:37Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Simit &quot;sid&quot; Siddharth, founder of NotSoSecure Ltd'''<br /> <br /> Sumit &quot;sid&quot; Siddharth is the founder of NotSoSecure Ltd, a specialist IT security firm delivering high-end IT security consultancy and Training. Prior to NotSoSecure, he worked as Head of Penetration Testing for a leading IT security company in UK. He has more than 10 years of experience in Penetration Testing. Sid has authored a number of whitepapers and tools. He has been a Speaker/Trainer at many security conferences including numerous Black Hat, DEF CON, OWASP Appsec, HITB etc. Sid is also a co-author of the book SQL Injection: Attacks and Defence (2nd edition). Over the years, Sid has identified several critical flaws in leading software and helped fix these bugs. These include products from Microsoft, Oracle, Intel, Wordpress etc. He has trained several security consultants/penetration testers and helped them get better at their jobs.<br /> <br /> <br /> <br /> '''Title : Some neat, new and ridiculous hacks from our vault'''<br /> <br /> If you do pentest for living, then you should be used to compromising applications and networks pretty much on a daily basis. However, each hack is unique and some are more special than others. There are those that help you stay in job, those that keep you awake in night and then there are those that define why we do pentest. In this talk, Sid will share some neat, new and ridiculous hacks which he and his colleagues at NotSoSecure have come across during real life pentest.<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:45 Simit Siddharth - Some neat, new and ridiculous hacks from our vault<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 10th November 2015<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Oct 2015<br /> | Sumit &quot;sid&quot; Siddharth / Some neat, new and ridiculous hacks from our vault<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=201989 2015-10-12T12:36:27Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Simit &quot;sid&quot; Siddharth, founder of NotSoSecure Ltd'''<br /> <br /> Sumit &quot;sid&quot; Siddharth is the founder of NotSoSecure Ltd, a specialist IT security firm delivering high-end IT security consultancy and Training. Prior to NotSoSecure, he worked as Head of Penetration Testing for a leading IT security company in UK. He has more than 10 years of experience in Penetration Testing. Sid has authored a number of whitepapers and tools. He has been a Speaker/Trainer at many security conferences including numerous Black Hat, DEF CON, OWASP Appsec, HITB etc. Sid is also a co-author of the book SQL Injection: Attacks and Defence (2nd edition). Over the years, Sid has identified several critical flaws in leading software and helped fix these bugs. These include products from Microsoft, Oracle, Intel, Wordpress etc. He has trained several security consultants/penetration testers and helped them get better at their jobs.<br /> <br /> <br /> <br /> '''Title : Some neat, new and ridiculous hacks from our vault'''<br /> <br /> If you do pentest for living, then you should be used to compromising applications and networks pretty much on a daily basis. However, each hack is unique and some are more special than others. There are those that help you stay in job, those that keep you awake in night and then there are those that define why we do pentest. In this talk, Sid will share some neat, new and ridiculous hacks which he and his colleagues at NotSoSecure have come across during real life pentest.<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:45 Simit Siddharth - Some neat, new and ridiculous hacks from our vault<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 10th November 2015<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=201314 2015-09-30T09:52:24Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Simit &quot;sid&quot; Siddharth, founder of NotSoSecure Ltd'''<br /> <br /> umit &quot;sid&quot; Siddharth is the founder of NotSoSecure Ltd, a specialist IT security firm delivering high-end IT security consultancy and Training. Prior to NotSoSecure, he worked as Head of Penetration Testing for a leading IT security company in UK. He has more than 10 years of experience in Penetration Testing. Sid has authored a number of whitepapers and tools. He has been a Speaker/Trainer at many security conferences including numerous Black Hat, DEF CON, OWASP Appsec, HITB etc. Sid is also a co-author of the book SQL Injection: Attacks and Defence (2nd edition). Over the years, Sid has identified several critical flaws in leading software and helped fix these bugs. These include products from Microsoft, Oracle, Intel, Wordpress etc. He has trained several security consultants/penetration testers and helped them get better at their jobs.<br /> <br /> <br /> <br /> '''Title : Some neat, new and ridiculous hacks from our vault'''<br /> <br /> If you do pentest for living, then you should be used to compromising applications and networks pretty much on a daily basis. However, each hack is unique and some are more special than others. There are those that help you stay in job, those that keep you awake in night and then there are those that define why we do pentest. In this talk, Sid will share some neat, new and ridiculous hacks which he and his colleagues at NotSoSecure have come across during real life pentest.<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:45 Simit Siddharth - Some neat, new and ridiculous hacks from our vault<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> Tuesday 10th November 2015<br /> <br /> Tuesday 8th December 2015 (proposed Internet of Things Security with BCS EA Region)<br /> <br /> Tuesday 9th February 2016<br /> <br /> Tuesday 8th March 2016<br /> <br /> Tuesday 12th April 2016<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=201313 2015-09-30T09:50:53Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 13th Octover 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Simit &quot;sid&quot; Siddharth, founder of NotSoSecure Ltd'''<br /> <br /> umit &quot;sid&quot; Siddharth is the founder of NotSoSecure Ltd, a specialist IT security firm delivering high-end IT security consultancy and Training. Prior to NotSoSecure, he worked as Head of Penetration Testing for a leading IT security company in UK. He has more than 10 years of experience in Penetration Testing. Sid has authored a number of whitepapers and tools. He has been a Speaker/Trainer at many security conferences including numerous Black Hat, DEF CON, OWASP Appsec, HITB etc. Sid is also a co-author of the book SQL Injection: Attacks and Defence (2nd edition). Over the years, Sid has identified several critical flaws in leading software and helped fix these bugs. These include products from Microsoft, Oracle, Intel, Wordpress etc. He has trained several security consultants/penetration testers and helped them get better at their jobs.<br /> <br /> <br /> <br /> '''Title : Some neat, new and ridiculous hacks from our vault'''<br /> <br /> If you do pentest for living, then you should be used to compromising applications and networks pretty much on a daily basis. However, each hack is unique and some are more special than others. There are those that help you stay in job, those that keep you awake in night and then there are those that define why we do pentest. In this talk, Sid will share some neat, new and ridiculous hacks which he and his colleagues at NotSoSecure have come across during real life pentest.<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:45 Simit Siddharth - Some neat, new and ridiculous hacks from our vault<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Project_Spending_Policy&diff=199257 2015-08-19T16:48:32Z

<p>Steven van der Baan: /* Guidelines */</p> <hr /> <div>Below you will find a series of guidelines aimed at assisting OWASP Project Leaders with OWASP Project spending related questions. In order to avoid any problems or misunderstandings in the future, we have developed these guidelines to provide clear expectations of how OWASP Projects should spend project funds, and what are appropriate project expenses. <br /> <br /> ==Guidelines==<br /> # OWASP Project funds are to be spent on project related expenses ONLY. If your project has more than one Project Leader, then all Project Leaders must agree to the expense before the purchase.<br /> # Before a purchase is made, the Project Leader must make sure that his/her project actually has the funds to cover the purchase. The easiest way to do this is to communicate your purchase needs to the OWASP Projects Manager, or you can look at the running funds list provided by the foundation.<br /> # Project expenses exceeding $500 USD must be communicated to the OWASP Projects Manager before the purchase.<br /> # All project expenses will preferably be managed via a reimbursement process. Once a purchase is made, the purchaser must submit a reimbursement request using our reimbursement form. Note: A receipt is required for the reimbursement process to be successful. <br /> # If reimbursement is not possible for a project, fill out the Contact Us form and request assistance with payment from the staff.<br /> # Appropriate Project Expenses encompass the following: Graphic Design; Technical Contractor; Web Design; Printing; Software Purchase; Hardware Purchase; Intern Stipends; Team Travel Expenses (for project related work ONLY); Venue Hire (project related work only); Food and Drink (if used to meet with other project leaders, contributors, OWASP staff, or an OWASP related function); Project Contractor. Please check with the OWASP Projects Manager before you move forward with a purchase if your expense falls outside of the items listed above.<br /> # All OWASP Projects are started with the understanding that they will be volunteer run, and they must remain volunteer run.<br /> # In the event that a project’s Leaders decide they would like to hire a contractor to work on a particular aspect of the project, then the Project Leaders must manage the recruitment and payment on a task/work assignment basis. Contractors must be paid upon satisfactory completion of the task/work assignment. Additionally, the OWASP Projects Manager must be be informed that project funds will be used to hire a contractor for project development.<br /> # Hiring Project Leaders as Contractors: If a project’s Leaders decide to hire another Leader as a contractor for a project task/work assignment, then the OWASP Projects Manager must be informed before work begins. Leaders must demonstrate to the OWASP PM that they have searched for 3rd party contractors, before the decision was reached to hire the Project Leader(s) as contractors.The contracted Leader(s) will be paid upon satisfactory completion of the work.<br /> # As of Jan 01, 2014, OWASP will add a disclaimer to the donation page which states that the foundation reserves the right to reallocate funds to the general Foundation income account. For all money received for projects prior to Jan 1st - OWASP will make best efforts to contact donors in respect to their donor intent before reallocating funds in the instance of inactive projects.</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=User:Steven_van_der_Baan&diff=195239 2015-05-25T17:59:48Z

<p>Steven van der Baan: </p> <hr /> <div>Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advise on possible solutions. He can also design a solution that fits the wishes of the client. Steven is determined, steadfast and critical, likes to work in teams, but is capable to work on his own. He is always willing to share his knowledge and help his colleagues. Steven follows the latest developments in the security field to keep his knowledge up to date.<br /> <br /> Steven has the CISSP, CSSLP, CSTA, OSCP (Offensive Security Certified Professional) and Java certifications.<br /> <br /> At OWASP he:<br /> * created and is project leader of the current [[:Category:OWASP CTF Project|OWASP Capture the Flag (CTF)]] Project, <br /> * is a board member of the [[Cambridge|OWASP Cambridge chapter]] and <br /> * is a project leader of the [[:Category:OWASP_Guide_Project|Development Guide]] Project.<br /> <br /> <br /> To see my wiki contributions, [[:Special:Contributions/Steven_van_der_Baan|click here]].<br /> <br /> [mailto:steven.van.der.baan@owasp.org Email address].</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=User:Steven_van_der_Baan&diff=195238 2015-05-25T17:57:14Z

<p>Steven van der Baan: </p> <hr /> <div>Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advise on possible solutions. He can also design a solution that fits the wishes of the client. Steven is determined, steadfast and critical, likes to work in teams, but is capable to work on his own. He is always willing to share his knowledge and help his colleagues. Steven follows the latest developments in the security field to keep his knowledge up to date.<br /> <br /> Steven has the CISSP, CSSLP, CSTA, OSCP (Offensive Security Certified Professional) and Java certifications.<br /> <br /> At OWASP he:<br /> * created the current [[:Category:OWASP CTF Project|OWASP Capture the Flag (CTF)]] application, <br /> * is a board member of the [[Cambridge|OWASP Cambridge chapter]] and <br /> * is a project leader of the [[:Category:OWASP_Guide_Project|Development Guide]].<br /> <br /> <br /> To see my wiki contributions, [[:Special:Contributions/Steven_van_der_Baan|click here]].<br /> <br /> [mailto:steven.van.der.baan@owasp.org Email address].</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=User:Steven_van_der_Baan&diff=195237 2015-05-25T17:55:40Z

<p>Steven van der Baan: </p> <hr /> <div>Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advise on possible solutions. He can also design a solution that fits the wishes of the client. Steven is determined, steadfast and critical, likes to work in teams, but is capable to work on his own. He is always willing to share his knowledge and help his colleagues. Steven follows the latest developments in the security field to keep his knowledge up to date.<br /> Steven has the CISSP, CSSLP, CSTA, OSCP (Offensive Security Certified Professional) and Java certifications.<br /> <br /> At OWASP he created the current [[:Category:OWASP CTF Project|OWASP Capture the Flag (CTF)]] application, he's a board member of the [[Cambridge|OWASP Cambridge chapter]] and he's a project leader of the [[:Category:OWASP_Guide_Project|Development Guide]].<br /> <br /> * To see my wiki contributions, [[:Special:Contributions/Steven_van_der_Baan|click here]].<br /> * [mailto:steven.van.der.baan@owasp.org Email address].</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=User:Steven_van_der_Baan&diff=195236 2015-05-25T17:45:58Z

<p>Steven van der Baan: </p> <hr /> <div>Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advise on possible solutions. He can also design a solution that fits the wishes of the client. Steven is determined, steadfast and critical, likes to work in teams, but is capable to work on his own. He is always willing to share his knowledge and help his colleagues. Steven follows the latest developments in the security field to keep his knowledge up to date.<br /> Steven has the CISSP, CSSLP, CSTA, OSCP (Offensive Security Certified Professional) and Java certifications.<br /> <br /> At OWASP he created the current OWASP Capture the Flag (CTF) application, he's a board member of the Cambridge chapter and he's a project leader of the Development Guide.<br /> <br /> * To see my wiki contributions, [[:Special:Contributions/Steven_van_der_Baan|click here]].<br /> * [mailto:steven.van.der.baan@owasp.org Email address].</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=User:Steven_van_der_Baan&diff=195235 2015-05-25T17:45:23Z

<p>Steven van der Baan: </p> <hr /> <div>Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advise on possible solutions. He can also design a solution that fits the wishes of the client. Steven is determined, steadfast and critical, likes to work in teams, but is capable to work on his own. He is always willing to share his knowledge and help his colleagues. Steven follows the latest developments in the security field to keep his knowledge up to date.<br /> Steven has the CISSP, CSSLP, CSTA, OSCP (Offensive Security Certified Professional) and Java certifications.<br /> <br /> At OWASP he created the current OWASP Capture the Flag (CTF) application.<br /> <br /> * To see my wiki contributions, [[:Special:Contributions/Steven_van_der_Baan|click here]].<br /> * [mailto:steven.van.der.baan@owasp.org Email address].</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=User:Steven_van_der_Baan&diff=195234 2015-05-25T17:44:22Z

<p>Steven van der Baan: </p> <hr /> <div>Steven van der Baan is employed as Security Consultant at Sogeti Nederland BV. In his daily work, Steven is responsible for education in application security matters, advice and implementation of application security measures, performing code and design review and executing web-application security assessments. Steven started as a Core Java developer, grew into the role of Software architect and then made the transfer to application security. <br /> Steven has the CISSP, OSCP (Offensive Security Certified Professional) and Java certifications.<br /> <br /> At OWASP he created the current OWASP Capture the Flag (CTF) application.<br /> <br /> * To see my wiki contributions, [[:Special:Contributions/Steven_van_der_Baan|click here]].<br /> * [mailto:steven.van.der.baan@owasp.org Email address].</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=190942 2015-03-07T11:31:37Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th February 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> <br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University,<br /> Institute of Information Security Professionals (IISP) East Anglia Branch and<br /> OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Peter Batchelor, Head of UK Public Sector, ForeScout Technologies'''<br /> <br /> Peter is Head of UK - Public Sector, working for ForeScout Technologies for the past<br /> 2 years. He has an extended career in the IT industry with industry leaders such as<br /> EMC and Readsoft.<br /> <br /> <br /> <br /> '''Title : Vulnerability Management'''<br /> <br /> The theme for this talk is around vulnerability management and will cover the<br /> challenges in managing the growing number of endpoints, compounded by the<br /> Internet of Things. The talk will focus on how the speaker sees the security landscape<br /> in this area and some of the up and coming challenges for the industry as a whole.<br /> <br /> How technical advancements could help mitigate some of these vulnerability issues<br /> will be explored with the audience along with how this creates new challenges for<br /> vulnerability management and how those challenges may differ within different<br /> sectors such and government and health as examples.----<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:45 Peter Batchelor - Vulnerability Management<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASPMarch15 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB002 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=190941 2015-03-07T11:27:47Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th February 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steven van der Baan'''<br /> <br /> Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. He is currently a Principle Security Consultant with 7Safe/PA Consulting. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advice on possible solutions. He can also design a solution that fits the wishes of the client. <br /> <br /> In his daily work, Steven is responsible for education in application security matters, advice and implementation of application security measures, performing code and design review and executing web-application security assessments. Steven started as a Core Java developer, grew into the role of Software architect and then made the transfer to application security. Steven has the ISC2, OSCP (Offensive Security Certified Professional) and Java certifications. <br /> <br /> Steven is currenty Project manager of the OWASP Capture the Flag (CTF) project.<br /> <br /> '''Title : Web Application Security Testing with Burp Suite'''<br /> <br /> Ever wondered how tools like Burp Suite are used by penetration testers and software security testers to evaluate the robustness of enterprise web applications?<br /> <br /> Steven van der Baan will be running a workshop on how to use Burp Suite to find vulnerabilities in a variety of web application scenarios. Using “Capture the Flag” scenario’s which have been successfully deployed at both OWASP AppSec and other information security conferences and guidance from the speaker, you will have the opportunity to experience the tools first hand.<br /> <br /> Bring along your laptop (and a wireless card) with Burp Suite installed (potentially this could be part of Kali Live CD, USB or running as a VM)----<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:15 Web Application Security Testing with Burp Suite – Steven van der Baan<br /> <br /> 19:15 – 19:30 Q &amp; A – Further meetings and ideas.<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASP_Cambs_Dec2014 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB003 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 10 February 2015<br /> <br /> 17 March 2015<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 10 Feb 2015<br /> | Steven van der Baan / Web Application Security Testing with Burp Suite<br /> |<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Category:OWASP_CTF_Project&diff=189665 2015-02-14T09:43:34Z

<p>Steven van der Baan: /* FAQs */</p> <hr /> <div>=Main=<br /> <br /> <br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP CTF Project==<br /> <br /> The OWASP CTF Project is designed to be used during (OWASP) conferences as an 'entertainment' to all the sessions that are available. Due to this nature, as it contains various challenges that allow participant to win prices at an event, the source code of the challenges is not disclosed, but the framework is publicly available.<br /> This framework is designed to be open for modification, extension so that people can use it as a base to hold their own CTF events.<br /> <br /> ==Introduction==<br /> <br /> The purpose of this Project is to create a competitive environment which can be used at conferences and to have fun and teach in a playful way the various mistakes which are made in regards to web applications. <br /> <br /> <br /> ==Description==<br /> The OWASP CTF Project a web base hacking challenge application with challenges categorized in web, network and ‘others’. You require creativity, resourcefulness and networking skills to solve the various challenges. (a copy of the Live CD can help as well)<br /> <br /> '''Open Source?'''<br /> <br /> First of all... sorry, but of course, we can not make the CTF and all challenges opensource. Hereby my apologies for not being as open as I want OWASP and OWASP projects to be. <br /> ..I know you understand!<br /> Ahead of the OWASP AppSec-NY in 2009, the idea came up to supply an OWASP CTF event. This has been repeated successfully for the AppSec-EU 2009. Both developed by volunteering individuals, putting in a big amount of work, building the CTF from scratch. As the CTF event was warmly welcomed by those who participated, it was clear, the CTF has to become a event available for each OWASP event. To make this possible, the CTF project has been created!<br /> <br /> Unfortunately, and I guess you understand, we can't share the current used CTF freely. For previous CTF applications and challenges, please see the download section.<br /> To get the CTF at your (OWASP) event, send an email to steven.van.der.baan 'at' owasp.org.<br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == What is CTF? ==<br /> [[Image:CTFLogo.jpg|right]]<br /> <br /> <br /> OWASP CTF Project provides:<br /> <br /> * web related challenges<br /> * entertainment at conferences<br /> <br /> == Presentation ==<br /> <br /> <br /> == Project Leader ==<br /> <br /> [mailto:steven.van.der.baan@owasp.org Steven van der Baan]<br /> <br /> == Related Projects ==<br /> <br /> <br /> <br /> == Ohloh ==<br /> <br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == Quick Download ==<br /> As we can not make the current CTF and challenges available, so what is available to download? We will share previous used CTF applications, not longer used!<br /> Further, we are currently working on a plug-in system for the challenges. We will release a setup where to install challenges as plugins, soon. Also, we will continuously make obsolete challenges available to download!<br /> Available downloads:<br /> *Framework<br /> *Initial challenge<br /> <br /> [https://code.google.com/p/owaspctf/ Google Code]<br /> <br /> == Email List ==<br /> <br /> [https://lists.owasp.org/mailman/listinfo/owasp-ctf Sign Up!]<br /> <br /> == News and Events ==<br /> * [20 Nov 2013] News 2<br /> * [30 Sep 2013] News 1<br /> <br /> <br /> == In Print ==<br /> <br /> <br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |}<br /> <br /> |}<br /> <br /> =Playing the CTF=<br /> <br /> ==Playing the CTF==<br /> <br /> The rules to participate and playing the CTF might change depending to the event the CTF is organized at. What you find below is what we think, the CTF should be done.. <br /> <br /> ==Participating==<br /> <br /> Register at the CTF organizer with your MAC address and participant name. Once you have access to the application, register with your chosen game name and the game is started. You can join whenever you like when the game has started until the declared end of the game.<br /> <br /> ==Rules==<br /> <br /> * You play with your own laptop.<br /> * The game is open during the conference time.<br /> * Attacking the CTF outside of the challenges results in disqualification.<br /> * Attacking CTF competitors results in disqualification.<br /> <br /> ==Scoring==<br /> <br /> * For each solved challenge you get one point.<br /> * Who has the most challenges solved wins.<br /> * By same score, first scored wins.<br /> * Groups and single player are treated the same<br /> * This is a proposal of rules. Those can be changed, depending on the event where the CTF is held.<br /> <br /> ==Who can anticipate in the CTF?==<br /> * Single Players, every one can participate in a CTF event by themselves. <br /> * Groups, you can team up with others and participate as a group. Dividing the prices is the responsibility of the group members, though.<br /> <br /> ==Pointing System==<br /> * With each challenge you can get a certain score, depending on the difficulty of the challenge. After solving a challenge, a key is gained. You will have to insert that key into your account screen and points are added to your account. In case of same number of points, whoever scores first wins.<br /> * With the current CTF system all challenges are worth one (1) point.<br /> <br /> ==Categories==<br /> <br /> The challenges are categorized in Web, Networking and Forensic.<br /> * Web challenges<br /> * Networking challenges<br /> * Forensic challenges<br /> <br /> The current CTF contains the following categories:<br /> * Web; your &quot;default&quot; web challenges<br /> * Networking; networking related challenges<br /> * Others; all other challenges that can't be fitted under the other categories.<br /> <br /> ==Score Board==<br /> <br /> The scoreboard will display the ranking of all playing users.<br /> <br /> =Past Events=<br /> *Confidence 2008 <br /> *OWASP Appsec Europe 2008 <br /> *AppSec-EU Poland 2009 <br /> *AppSec-DC 2009 <br /> *AppSec-EU Stockholm 2010 <br /> *HITB Amsterdam 2010 <br /> *AppSec-USA 2010 <br /> *GovWare Singapore 2010 <br /> *AppSec-Brazil 2010<br /> *OWASP BeNeLux day 2010<br /> *HITB Amsterdam 2011<br /> *AppSec-EU Dublin 2011<br /> *AppSec-USA Minneapolis 2011<br /> *OWASP Benelux day 2011<br /> *OWASP Appsec EU Athens 2012<br /> *AppSec-USA Austin 2012<br /> *OWASP BeNeLux day 2012<br /> *OWASP Appsec EU Hamburg 2013<br /> *AppSec-USA New York 2013<br /> *OWASP Appsec EU Cambridge 2014<br /> <br /> =FAQs=<br /> <br /> ; Can I have a copy of the challenges?<br /> : Short answer, no. Long answer, depending on the 'strength' of the challenges they will be reused across multiple Capture the Flag events. Releasing the challenges might bring an unfair advantage to some of the players. <br /> <br /> ; How can I help?<br /> : Everybody can help by providing challenges, or ideas for challenges.<br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> CTF is developed by a worldwide team of volunteers. The primary contributors to date have been:<br /> <br /> * [mailto:martin.knobloch@owasp.org Martin Knobloch]<br /> * [mailto:bradcausey@owasp.org Brad Causey]<br /> * [mailto:ralf.allar@allar.it Ralf Allar]<br /> * [mailto:andres.riancho@gmail.com Andres Riancho]<br /> * Danny Chrastil<br /> <br /> <br /> = Road Map and Getting Involved =<br /> As of 2014, the priorities are:<br /> *Development <br /> **Framework<br /> <br /> The framework is almost finished. The final quirkes are tested at the Owasp BeNeLux days and will be uploaded afterwards. &lt;br&gt; The latest design and logo (thanks to my wife) are used, waiting on some feedback from actual players.&lt;br&gt; The next version of the framework will contain a better template mechanism for customisation and a construction to be able to play network challenges without having to worry of you hackers taking over the complete system&amp;nbsp;;) <br /> <br /> *Challenges<br /> <br /> The various challenges that will be released depend on the feedback from the various events where the CTF has been held. The easiest challenges will slowly disapear from the CTF and will be made available for download. <br /> <br /> *Obsolete<br /> <br /> Involvement in the development and promotion of the CTF is actively encouraged!<br /> We need people who can help in designing and building challenges. Feel free to send ideas (or even finished challenges) to Steven (steven.van.der.baan@owasp.org) and he'll try to include it in the CTF.<br /> <br /> =Project About=<br /> {{:Projects/OWASP CTF Project | Project About}} <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Category:OWASP_CTF_Project&diff=189664 2015-02-14T09:39:40Z

<p>Steven van der Baan: /* What is CTF? */</p> <hr /> <div>=Main=<br /> <br /> <br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP CTF Project==<br /> <br /> The OWASP CTF Project is designed to be used during (OWASP) conferences as an 'entertainment' to all the sessions that are available. Due to this nature, as it contains various challenges that allow participant to win prices at an event, the source code of the challenges is not disclosed, but the framework is publicly available.<br /> This framework is designed to be open for modification, extension so that people can use it as a base to hold their own CTF events.<br /> <br /> ==Introduction==<br /> <br /> The purpose of this Project is to create a competitive environment which can be used at conferences and to have fun and teach in a playful way the various mistakes which are made in regards to web applications. <br /> <br /> <br /> ==Description==<br /> The OWASP CTF Project a web base hacking challenge application with challenges categorized in web, network and ‘others’. You require creativity, resourcefulness and networking skills to solve the various challenges. (a copy of the Live CD can help as well)<br /> <br /> '''Open Source?'''<br /> <br /> First of all... sorry, but of course, we can not make the CTF and all challenges opensource. Hereby my apologies for not being as open as I want OWASP and OWASP projects to be. <br /> ..I know you understand!<br /> Ahead of the OWASP AppSec-NY in 2009, the idea came up to supply an OWASP CTF event. This has been repeated successfully for the AppSec-EU 2009. Both developed by volunteering individuals, putting in a big amount of work, building the CTF from scratch. As the CTF event was warmly welcomed by those who participated, it was clear, the CTF has to become a event available for each OWASP event. To make this possible, the CTF project has been created!<br /> <br /> Unfortunately, and I guess you understand, we can't share the current used CTF freely. For previous CTF applications and challenges, please see the download section.<br /> To get the CTF at your (OWASP) event, send an email to steven.van.der.baan 'at' owasp.org.<br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == What is CTF? ==<br /> [[Image:CTFLogo.jpg|right]]<br /> <br /> <br /> OWASP CTF Project provides:<br /> <br /> * web related challenges<br /> * entertainment at conferences<br /> <br /> == Presentation ==<br /> <br /> <br /> == Project Leader ==<br /> <br /> [mailto:steven.van.der.baan@owasp.org Steven van der Baan]<br /> <br /> == Related Projects ==<br /> <br /> <br /> <br /> == Ohloh ==<br /> <br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == Quick Download ==<br /> As we can not make the current CTF and challenges available, so what is available to download? We will share previous used CTF applications, not longer used!<br /> Further, we are currently working on a plug-in system for the challenges. We will release a setup where to install challenges as plugins, soon. Also, we will continuously make obsolete challenges available to download!<br /> Available downloads:<br /> *Framework<br /> *Initial challenge<br /> <br /> [https://code.google.com/p/owaspctf/ Google Code]<br /> <br /> == Email List ==<br /> <br /> [https://lists.owasp.org/mailman/listinfo/owasp-ctf Sign Up!]<br /> <br /> == News and Events ==<br /> * [20 Nov 2013] News 2<br /> * [30 Sep 2013] News 1<br /> <br /> <br /> == In Print ==<br /> <br /> <br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |}<br /> <br /> |}<br /> <br /> =Playing the CTF=<br /> <br /> ==Playing the CTF==<br /> <br /> The rules to participate and playing the CTF might change depending to the event the CTF is organized at. What you find below is what we think, the CTF should be done.. <br /> <br /> ==Participating==<br /> <br /> Register at the CTF organizer with your MAC address and participant name. Once you have access to the application, register with your chosen game name and the game is started. You can join whenever you like when the game has started until the declared end of the game.<br /> <br /> ==Rules==<br /> <br /> * You play with your own laptop.<br /> * The game is open during the conference time.<br /> * Attacking the CTF outside of the challenges results in disqualification.<br /> * Attacking CTF competitors results in disqualification.<br /> <br /> ==Scoring==<br /> <br /> * For each solved challenge you get one point.<br /> * Who has the most challenges solved wins.<br /> * By same score, first scored wins.<br /> * Groups and single player are treated the same<br /> * This is a proposal of rules. Those can be changed, depending on the event where the CTF is held.<br /> <br /> ==Who can anticipate in the CTF?==<br /> * Single Players, every one can participate in a CTF event by themselves. <br /> * Groups, you can team up with others and participate as a group. Dividing the prices is the responsibility of the group members, though.<br /> <br /> ==Pointing System==<br /> * With each challenge you can get a certain score, depending on the difficulty of the challenge. After solving a challenge, a key is gained. You will have to insert that key into your account screen and points are added to your account. In case of same number of points, whoever scores first wins.<br /> * With the current CTF system all challenges are worth one (1) point.<br /> <br /> ==Categories==<br /> <br /> The challenges are categorized in Web, Networking and Forensic.<br /> * Web challenges<br /> * Networking challenges<br /> * Forensic challenges<br /> <br /> The current CTF contains the following categories:<br /> * Web; your &quot;default&quot; web challenges<br /> * Networking; networking related challenges<br /> * Others; all other challenges that can't be fitted under the other categories.<br /> <br /> ==Score Board==<br /> <br /> The scoreboard will display the ranking of all playing users.<br /> <br /> =Past Events=<br /> *Confidence 2008 <br /> *OWASP Appsec Europe 2008 <br /> *AppSec-EU Poland 2009 <br /> *AppSec-DC 2009 <br /> *AppSec-EU Stockholm 2010 <br /> *HITB Amsterdam 2010 <br /> *AppSec-USA 2010 <br /> *GovWare Singapore 2010 <br /> *AppSec-Brazil 2010<br /> *OWASP BeNeLux day 2010<br /> *HITB Amsterdam 2011<br /> *AppSec-EU Dublin 2011<br /> *AppSec-USA Minneapolis 2011<br /> *OWASP Benelux day 2011<br /> *OWASP Appsec EU Athens 2012<br /> *AppSec-USA Austin 2012<br /> *OWASP BeNeLux day 2012<br /> *OWASP Appsec EU Hamburg 2013<br /> *AppSec-USA New York 2013<br /> *OWASP Appsec EU Cambridge 2014<br /> <br /> =FAQs=<br /> <br /> ; Q1<br /> : A1<br /> <br /> ; Q2<br /> : A2<br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> CTF is developed by a worldwide team of volunteers. The primary contributors to date have been:<br /> <br /> * [mailto:martin.knobloch@owasp.org Martin Knobloch]<br /> * [mailto:bradcausey@owasp.org Brad Causey]<br /> * [mailto:ralf.allar@allar.it Ralf Allar]<br /> * [mailto:andres.riancho@gmail.com Andres Riancho]<br /> * Danny Chrastil<br /> <br /> <br /> = Road Map and Getting Involved =<br /> As of 2014, the priorities are:<br /> *Development <br /> **Framework<br /> <br /> The framework is almost finished. The final quirkes are tested at the Owasp BeNeLux days and will be uploaded afterwards. &lt;br&gt; The latest design and logo (thanks to my wife) are used, waiting on some feedback from actual players.&lt;br&gt; The next version of the framework will contain a better template mechanism for customisation and a construction to be able to play network challenges without having to worry of you hackers taking over the complete system&amp;nbsp;;) <br /> <br /> *Challenges<br /> <br /> The various challenges that will be released depend on the feedback from the various events where the CTF has been held. The easiest challenges will slowly disapear from the CTF and will be made available for download. <br /> <br /> *Obsolete<br /> <br /> Involvement in the development and promotion of the CTF is actively encouraged!<br /> We need people who can help in designing and building challenges. Feel free to send ideas (or even finished challenges) to Steven (steven.van.der.baan@owasp.org) and he'll try to include it in the CTF.<br /> <br /> =Project About=<br /> {{:Projects/OWASP CTF Project | Project About}} <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Category:OWASP_CTF_Project&diff=189663 2015-02-14T09:33:43Z

<p>Steven van der Baan: </p> <hr /> <div>=Main=<br /> <br /> <br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP CTF Project==<br /> <br /> The OWASP CTF Project is designed to be used during (OWASP) conferences as an 'entertainment' to all the sessions that are available. Due to this nature, as it contains various challenges that allow participant to win prices at an event, the source code of the challenges is not disclosed, but the framework is publicly available.<br /> This framework is designed to be open for modification, extension so that people can use it as a base to hold their own CTF events.<br /> <br /> ==Introduction==<br /> <br /> The purpose of this Project is to create a competitive environment which can be used at conferences and to have fun and teach in a playful way the various mistakes which are made in regards to web applications. <br /> <br /> <br /> ==Description==<br /> The OWASP CTF Project a web base hacking challenge application with challenges categorized in web, network and ‘others’. You require creativity, resourcefulness and networking skills to solve the various challenges. (a copy of the Live CD can help as well)<br /> <br /> '''Open Source?'''<br /> <br /> First of all... sorry, but of course, we can not make the CTF and all challenges opensource. Hereby my apologies for not being as open as I want OWASP and OWASP projects to be. <br /> ..I know you understand!<br /> Ahead of the OWASP AppSec-NY in 2009, the idea came up to supply an OWASP CTF event. This has been repeated successfully for the AppSec-EU 2009. Both developed by volunteering individuals, putting in a big amount of work, building the CTF from scratch. As the CTF event was warmly welcomed by those who participated, it was clear, the CTF has to become a event available for each OWASP event. To make this possible, the CTF project has been created!<br /> <br /> Unfortunately, and I guess you understand, we can't share the current used CTF freely. For previous CTF applications and challenges, please see the download section.<br /> To get the CTF at your (OWASP) event, send an email to steven.van.der.baan 'at' owasp.org.<br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == What is CTF? ==<br /> [[Image:CTFLogo.jpg|right]]<br /> <br /> <br /> OWASP CTF Project provides:<br /> <br /> * xxx<br /> * xxx<br /> <br /> <br /> == Presentation ==<br /> <br /> <br /> == Project Leader ==<br /> <br /> [mailto:steven.van.der.baan@owasp.org Steven van der Baan]<br /> <br /> == Related Projects ==<br /> <br /> <br /> <br /> == Ohloh ==<br /> <br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == Quick Download ==<br /> As we can not make the current CTF and challenges available, so what is available to download? We will share previous used CTF applications, not longer used!<br /> Further, we are currently working on a plug-in system for the challenges. We will release a setup where to install challenges as plugins, soon. Also, we will continuously make obsolete challenges available to download!<br /> Available downloads:<br /> *Framework<br /> *Initial challenge<br /> <br /> [https://code.google.com/p/owaspctf/ Google Code]<br /> <br /> == Email List ==<br /> <br /> [https://lists.owasp.org/mailman/listinfo/owasp-ctf Sign Up!]<br /> <br /> == News and Events ==<br /> * [20 Nov 2013] News 2<br /> * [30 Sep 2013] News 1<br /> <br /> <br /> == In Print ==<br /> <br /> <br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |}<br /> <br /> |}<br /> <br /> =Playing the CTF=<br /> <br /> ==Playing the CTF==<br /> <br /> The rules to participate and playing the CTF might change depending to the event the CTF is organized at. What you find below is what we think, the CTF should be done.. <br /> <br /> ==Participating==<br /> <br /> Register at the CTF organizer with your MAC address and participant name. Once you have access to the application, register with your chosen game name and the game is started. You can join whenever you like when the game has started until the declared end of the game.<br /> <br /> ==Rules==<br /> <br /> * You play with your own laptop.<br /> * The game is open during the conference time.<br /> * Attacking the CTF outside of the challenges results in disqualification.<br /> * Attacking CTF competitors results in disqualification.<br /> <br /> ==Scoring==<br /> <br /> * For each solved challenge you get one point.<br /> * Who has the most challenges solved wins.<br /> * By same score, first scored wins.<br /> * Groups and single player are treated the same<br /> * This is a proposal of rules. Those can be changed, depending on the event where the CTF is held.<br /> <br /> ==Who can anticipate in the CTF?==<br /> * Single Players, every one can participate in a CTF event by themselves. <br /> * Groups, you can team up with others and participate as a group. Dividing the prices is the responsibility of the group members, though.<br /> <br /> ==Pointing System==<br /> * With each challenge you can get a certain score, depending on the difficulty of the challenge. After solving a challenge, a key is gained. You will have to insert that key into your account screen and points are added to your account. In case of same number of points, whoever scores first wins.<br /> * With the current CTF system all challenges are worth one (1) point.<br /> <br /> ==Categories==<br /> <br /> The challenges are categorized in Web, Networking and Forensic.<br /> * Web challenges<br /> * Networking challenges<br /> * Forensic challenges<br /> <br /> The current CTF contains the following categories:<br /> * Web; your &quot;default&quot; web challenges<br /> * Networking; networking related challenges<br /> * Others; all other challenges that can't be fitted under the other categories.<br /> <br /> ==Score Board==<br /> <br /> The scoreboard will display the ranking of all playing users.<br /> <br /> =Past Events=<br /> *Confidence 2008 <br /> *OWASP Appsec Europe 2008 <br /> *AppSec-EU Poland 2009 <br /> *AppSec-DC 2009 <br /> *AppSec-EU Stockholm 2010 <br /> *HITB Amsterdam 2010 <br /> *AppSec-USA 2010 <br /> *GovWare Singapore 2010 <br /> *AppSec-Brazil 2010<br /> *OWASP BeNeLux day 2010<br /> *HITB Amsterdam 2011<br /> *AppSec-EU Dublin 2011<br /> *AppSec-USA Minneapolis 2011<br /> *OWASP Benelux day 2011<br /> *OWASP Appsec EU Athens 2012<br /> *AppSec-USA Austin 2012<br /> *OWASP BeNeLux day 2012<br /> *OWASP Appsec EU Hamburg 2013<br /> *AppSec-USA New York 2013<br /> *OWASP Appsec EU Cambridge 2014<br /> <br /> =FAQs=<br /> <br /> ; Q1<br /> : A1<br /> <br /> ; Q2<br /> : A2<br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> CTF is developed by a worldwide team of volunteers. The primary contributors to date have been:<br /> <br /> * [mailto:martin.knobloch@owasp.org Martin Knobloch]<br /> * [mailto:bradcausey@owasp.org Brad Causey]<br /> * [mailto:ralf.allar@allar.it Ralf Allar]<br /> * [mailto:andres.riancho@gmail.com Andres Riancho]<br /> * Danny Chrastil<br /> <br /> <br /> = Road Map and Getting Involved =<br /> As of 2014, the priorities are:<br /> *Development <br /> **Framework<br /> <br /> The framework is almost finished. The final quirkes are tested at the Owasp BeNeLux days and will be uploaded afterwards. &lt;br&gt; The latest design and logo (thanks to my wife) are used, waiting on some feedback from actual players.&lt;br&gt; The next version of the framework will contain a better template mechanism for customisation and a construction to be able to play network challenges without having to worry of you hackers taking over the complete system&amp;nbsp;;) <br /> <br /> *Challenges<br /> <br /> The various challenges that will be released depend on the feedback from the various events where the CTF has been held. The easiest challenges will slowly disapear from the CTF and will be made available for download. <br /> <br /> *Obsolete<br /> <br /> Involvement in the development and promotion of the CTF is actively encouraged!<br /> We need people who can help in designing and building challenges. Feel free to send ideas (or even finished challenges) to Steven (steven.van.der.baan@owasp.org) and he'll try to include it in the CTF.<br /> <br /> =Project About=<br /> {{:Projects/OWASP CTF Project | Project About}} <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Category:OWASP_CTF_Project&diff=189662 2015-02-14T09:32:52Z

<p>Steven van der Baan: </p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[Image:OWASP Active Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] &lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP CTF Project==<br /> <br /> The OWASP CTF Project is designed to be used during (OWASP) conferences as an 'entertainment' to all the sessions that are available. Due to this nature, as it contains various challenges that allow participant to win prices at an event, the source code of the challenges is not disclosed, but the framework is publicly available.<br /> This framework is designed to be open for modification, extension so that people can use it as a base to hold their own CTF events.<br /> <br /> ==Introduction==<br /> <br /> The purpose of this Project is to create a competitive environment which can be used at conferences and to have fun and teach in a playful way the various mistakes which are made in regards to web applications. <br /> <br /> <br /> ==Description==<br /> The OWASP CTF Project a web base hacking challenge application with challenges categorized in web, network and ‘others’. You require creativity, resourcefulness and networking skills to solve the various challenges. (a copy of the Live CD can help as well)<br /> <br /> '''Open Source?'''<br /> <br /> First of all... sorry, but of course, we can not make the CTF and all challenges opensource. Hereby my apologies for not being as open as I want OWASP and OWASP projects to be. <br /> ..I know you understand!<br /> Ahead of the OWASP AppSec-NY in 2009, the idea came up to supply an OWASP CTF event. This has been repeated successfully for the AppSec-EU 2009. Both developed by volunteering individuals, putting in a big amount of work, building the CTF from scratch. As the CTF event was warmly welcomed by those who participated, it was clear, the CTF has to become a event available for each OWASP event. To make this possible, the CTF project has been created!<br /> <br /> Unfortunately, and I guess you understand, we can't share the current used CTF freely. For previous CTF applications and challenges, please see the download section.<br /> To get the CTF at your (OWASP) event, send an email to steven.van.der.baan 'at' owasp.org.<br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == What is CTF? ==<br /> [[Image:CTFLogo.jpg|right]]<br /> <br /> <br /> OWASP CTF Project provides:<br /> <br /> * xxx<br /> * xxx<br /> <br /> <br /> == Presentation ==<br /> <br /> <br /> == Project Leader ==<br /> <br /> [mailto:steven.van.der.baan@owasp.org Steven van der Baan]<br /> <br /> == Related Projects ==<br /> <br /> <br /> <br /> == Ohloh ==<br /> <br /> <br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == Quick Download ==<br /> As we can not make the current CTF and challenges available, so what is available to download? We will share previous used CTF applications, not longer used!<br /> Further, we are currently working on a plug-in system for the challenges. We will release a setup where to install challenges as plugins, soon. Also, we will continuously make obsolete challenges available to download!<br /> Available downloads:<br /> *Framework<br /> *Initial challenge<br /> <br /> [https://code.google.com/p/owaspctf/ Google Code]<br /> <br /> == Email List ==<br /> <br /> [https://lists.owasp.org/mailman/listinfo/owasp-ctf Sign Up!]<br /> <br /> == News and Events ==<br /> * [20 Nov 2013] News 2<br /> * [30 Sep 2013] News 1<br /> <br /> <br /> == In Print ==<br /> <br /> <br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |}<br /> <br /> |}<br /> <br /> =Playing the CTF=<br /> <br /> ==Playing the CTF==<br /> <br /> The rules to participate and playing the CTF might change depending to the event the CTF is organized at. What you find below is what we think, the CTF should be done.. <br /> <br /> ==Participating==<br /> <br /> Register at the CTF organizer with your MAC address and participant name. Once you have access to the application, register with your chosen game name and the game is started. You can join whenever you like when the game has started until the declared end of the game.<br /> <br /> ==Rules==<br /> <br /> * You play with your own laptop.<br /> * The game is open during the conference time.<br /> * Attacking the CTF outside of the challenges results in disqualification.<br /> * Attacking CTF competitors results in disqualification.<br /> <br /> ==Scoring==<br /> <br /> * For each solved challenge you get one point.<br /> * Who has the most challenges solved wins.<br /> * By same score, first scored wins.<br /> * Groups and single player are treated the same<br /> * This is a proposal of rules. Those can be changed, depending on the event where the CTF is held.<br /> <br /> ==Who can anticipate in the CTF?==<br /> * Single Players, every one can participate in a CTF event by themselves. <br /> * Groups, you can team up with others and participate as a group. Dividing the prices is the responsibility of the group members, though.<br /> <br /> ==Pointing System==<br /> * With each challenge you can get a certain score, depending on the difficulty of the challenge. After solving a challenge, a key is gained. You will have to insert that key into your account screen and points are added to your account. In case of same number of points, whoever scores first wins.<br /> * With the current CTF system all challenges are worth one (1) point.<br /> <br /> ==Categories==<br /> <br /> The challenges are categorized in Web, Networking and Forensic.<br /> * Web challenges<br /> * Networking challenges<br /> * Forensic challenges<br /> <br /> The current CTF contains the following categories:<br /> * Web; your &quot;default&quot; web challenges<br /> * Networking; networking related challenges<br /> * Others; all other challenges that can't be fitted under the other categories.<br /> <br /> ==Score Board==<br /> <br /> The scoreboard will display the ranking of all playing users.<br /> <br /> =Past Events=<br /> *Confidence 2008 <br /> *OWASP Appsec Europe 2008 <br /> *AppSec-EU Poland 2009 <br /> *AppSec-DC 2009 <br /> *AppSec-EU Stockholm 2010 <br /> *HITB Amsterdam 2010 <br /> *AppSec-USA 2010 <br /> *GovWare Singapore 2010 <br /> *AppSec-Brazil 2010<br /> *OWASP BeNeLux day 2010<br /> *HITB Amsterdam 2011<br /> *AppSec-EU Dublin 2011<br /> *AppSec-USA Minneapolis 2011<br /> *OWASP Benelux day 2011<br /> *OWASP Appsec EU Athens 2012<br /> *AppSec-USA Austin 2012<br /> *OWASP BeNeLux day 2012<br /> *OWASP Appsec EU Hamburg 2013<br /> *AppSec-USA New York 2013<br /> *OWASP Appsec EU Cambridge 2014<br /> <br /> =FAQs=<br /> <br /> ; Q1<br /> : A1<br /> <br /> ; Q2<br /> : A2<br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> CTF is developed by a worldwide team of volunteers. The primary contributors to date have been:<br /> <br /> * [mailto:martin.knobloch@owasp.org Martin Knobloch]<br /> * [mailto:bradcausey@owasp.org Brad Causey]<br /> * [mailto:ralf.allar@allar.it Ralf Allar]<br /> * [mailto:andres.riancho@gmail.com Andres Riancho]<br /> * Danny Chrastil<br /> <br /> <br /> = Road Map and Getting Involved =<br /> As of 2014, the priorities are:<br /> *Development <br /> **Framework<br /> <br /> The framework is almost finished. The final quirkes are tested at the Owasp BeNeLux days and will be uploaded afterwards. &lt;br&gt; The latest design and logo (thanks to my wife) are used, waiting on some feedback from actual players.&lt;br&gt; The next version of the framework will contain a better template mechanism for customisation and a construction to be able to play network challenges without having to worry of you hackers taking over the complete system&amp;nbsp;;) <br /> <br /> *Challenges<br /> <br /> The various challenges that will be released depend on the feedback from the various events where the CTF has been held. The easiest challenges will slowly disapear from the CTF and will be made available for download. <br /> <br /> *Obsolete<br /> <br /> Involvement in the development and promotion of the CTF is actively encouraged!<br /> We need people who can help in designing and building challenges. Feel free to send ideas (or even finished challenges) to Steven (steven.van.der.baan@owasp.org) and he'll try to include it in the CTF.<br /> <br /> =Project About=<br /> {{:Projects/OWASP CTF Project | Project About}} <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=188869 2015-02-01T16:47:36Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 10th February 2015 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Steven van der Baan'''<br /> <br /> Steven is a passionate Security Consultant and Software Architect, with a broad history in software development and architecture. He is currently a Principle Security Consultant with 7Safe/PA Consulting. Steven has a varied background in developing complex systems, mainly in Java. He has the capability to analyse problems and provide sound advice on possible solutions. He can also design a solution that fits the wishes of the client. <br /> <br /> In his daily work, Steven is responsible for education in application security matters, advice and implementation of application security measures, performing code and design review and executing web-application security assessments. Steven started as a Core Java developer, grew into the role of Software architect and then made the transfer to application security. Steven has the ISC2, OSCP (Offensive Security Certified Professional) and Java certifications. <br /> <br /> Steven is currenty Project manager of the OWASP Capture the Flag (CTF) project.<br /> <br /> '''Title : Web Application Security Testing with Burp Suite'''<br /> <br /> Ever wondered how tools like Burp Suite are used by penetration testers and software security testers to evaluate the robustness of enterprise web applications?<br /> <br /> Steven van der Baan will be running a workshop on how to use Burp Suite to find vulnerabilities in a variety of web application scenarios. Using “Capture the Flag” scenario’s which have been successfully deployed at both OWASP AppSec and other information security conferences and guidance from the speaker, you will have the opportunity to experience the tools first hand.<br /> <br /> Bring along your laptop (and a wireless card) with Burp Suite installed (potentially this could be part of Kali Live CD, USB or running as a VM)----<br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:15 Web Application Security Testing with Burp Suite – Steven van der Baan<br /> <br /> 19:15 – 19:30 Q &amp; A – Further meetings and ideas.<br /> <br /> 19:45 – 20:30 Refreshments &amp; Networking (coffee, tea, juice) in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASP_Cambs_Dec2014 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB003 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 10 February 2015<br /> <br /> 17 March 2015<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=188867 2015-02-01T16:44:02Z

<p>Steven van der Baan: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 2 nd December 2014 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Colin Watson'''<br /> <br /> Colin Watson is founder of Watson Hall Ltd, based in London, where his work involves the management of application risk, designing defensive measures, building security &amp; privacy in to systems development and keeping abreast of relevant international legislation and standards. He was a member of the former OWASP Global Industry Committee, and is currently project leader for the OWASP Codes of Conduct and OWASP Cornucopia projects, co-leader for the OWASP AppSensor project, contributes to Open Software Assurance Maturity Model, CISO Guide and CISO Survey, and wrote the Application Logging Cheat sheet. He holds a BSc in Chemical Engineering from Heriott-Watt University in Edinburgh, and an MSc in Computation from the University of Oxford.<br /> <br /> '''Title : OWASP Cornucopia'''<br /> <br /> Microsoft's Escalation of Privilege (EoP) threat modelling card game has been refreshed into a new version more suitable for common web applications, and aligned with OWASP advice and guides. &quot;OWASP Cornucopia - Ecommerce Web Application Edition&quot; will be presented and used to demonstrate how it can help software architects and developers identify security requirements from the OWASP Secure Coding Practices - Quick Reference Guide. He will also provide a brief introduction about how to contribute ideas and content to OWASP projects, and how to start a project.<br /> ----<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 18:35 Colin Watson – OWASP Cornucopia<br /> <br /> 18:35 – 18:45 Q &amp; A<br /> <br /> 18:45 – 19:00 Colin’ s Round Up Featuring OWASP Snakes &amp; Ladders<br /> <br /> 19:00 – 20:00 Refreshments, Networking, Cornucopia and Snakes &amp; Ladders in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASP_Cambs_Dec2014 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB003 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 10 February 2015<br /> <br /> 17 March 2015<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 2 December 2014<br /> | Colin Watson / OWASP Cornucopia<br /> |<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=186330 2014-12-01T20:16:51Z

<p>Steven van der Baan: /* Local News */</p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 2 nd December 2014 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> '''Guest speakers: Colin Watson'''<br /> <br /> Colin Watson is founder of Watson Hall Ltd, based in London, where his work involves the management of application risk, designing defensive measures, building security &amp; privacy in to systems development and keeping abreast of relevant international legislation and standards. He was a member of the former OWASP Global Industry Committee, and is currently project leader for the OWASP Codes of Conduct and OWASP Cornucopia projects, co-leader for the OWASP AppSensor project, contributes to Open Software Assurance Maturity Model, CISO Guide and CISO Survey, and wrote the Application Logging Cheat sheet. He holds a BSc in Chemical Engineering from Heriott-Watt University in Edinburgh, and an MSc in Computation from the University of Oxford.<br /> <br /> '''Title : OWASP Cornucopia'''<br /> <br /> Microsoft's Escalation of Privilege (EoP) threat modelling card game has been refreshed into a new version more suitable for common web applications, and aligned with OWASP advice and guides. &quot;OWASP Cornucopia - Ecommerce Web Application Edition&quot; will be presented and used to demonstrate how it can help software architects and developers identify security requirements from the OWASP Secure Coding Practices - Quick Reference Guide. He will also provide a brief introduction about how to contribute ideas and content to OWASP projects, and how to start a project.<br /> ----<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 18:35 Colin Watson – OWASP Cornucopia<br /> <br /> 18:35 – 18:45 Q &amp; A<br /> <br /> 18:45 – 19:00 Colin’ s Round Up Featuring OWASP Snakes &amp; Ladders<br /> <br /> 19:00 – 20:00 Refreshments, Networking, Cornucopia and Snakes &amp; Ladders in LAB006<br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASP_Cambs_Dec2014 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB003 (Breakout Room LAB006 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 10 February 2015<br /> <br /> 17 March 2015<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> <br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=185377 2014-11-14T15:01:21Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 21 st October 2014 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> <br /> '''Guest speakers: Eireann Leverett'''<br /> <br /> Eireann Leverett is a Senior Consultant at IOActive where he focuses on Smart Grid and SCADA systems. He studied Artificial Intelligence (AI) and Software Engineering at Edinburgh University and went on to get his Masters in Advanced Computer Science at University of Cambridge. He studied under Frank Stajano and Jon Crowcroft in Cambridge's computer security group. In between, he worked for five years at GE Energy and did a six-month engagement with ABB in their corporate research department.<br /> <br /> '''Title : Switches get Stitches'''<br /> <br /> This mini workshop is based on the successful 44Con talk this year and will introduce you to Industrial Ethernet Switches and their vulnerabilities. These switches are used in environments with industrial automation equipment, like substations, factories, refineries, and ports; in other words, SCADA and ICS switches. You will become familiar with how these switches are used and do some light traffic analysis and firmware reverse engineering, '''bring your laptop with Wireshark installed!!''' During this workshop, Eireann will discuss several vulnerabilities and share the methods used to discover them as well as techniques for exploitation. <br /> <br /> This is partially a hands-on workshop, with pcaps, network forensics, binary analysis, web application vulnerabilities, etc. It teaches about bad session entropy, sidejacking, CSRF, brute forcing MD5, DoS in the context of industrial processes, and carving default private keys from firmware images. Essentially, this is &quot;how I found the bugs in my CVE list for 2013-2014&quot;, breaking industrial ethernet switches.<br /> <br /> Bring along your laptop with Wireshark installed. <br /> ----<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:15 Eireann Leverett – IOActive – Switches got Stitches<br /> <br /> 19:15 – 19:30 Q &amp; A – Further meetings and ideas.<br /> <br /> 19:30 – 20:30 Refreshments &amp; Networking in LAB027<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASP_Cambs_Apr2014 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB003 (Breakout Room LAB027 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> ----<br /> '''Planned dates for upcoming events'''<br /> <br /> 2 December 2014<br /> <br /> 10 February 2015<br /> <br /> 17 March 2015<br /> <br /> 21 April 2015<br /> <br /> &lt;!-- second tab --&gt;<br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=Cambridge&diff=185376 2014-11-14T14:56:56Z

<p>Steven van der Baan: </p> <hr /> <div>{{Chapter Template|chaptername=Cambridge|extra=The chapter leaders are [mailto:Adrian.Winckles@owasp.org Adrian Winckles ] and [mailto:Steven.van.der.Baan@owasp.org Steven van der Baan].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Cambridge|emailarchives=http://lists.owasp.org/pipermail/owasp-Cambridge}}<br /> <br /> &lt;paypal&gt;Cambridge&lt;/paypal&gt;<br /> &lt;!-- first tab --&gt;<br /> = Local News =<br /> ==='''Local News'''===<br /> '''Cambridge OWASP Chapter Meeting<br /> <br /> Tuesday 21 st October 2014 17:30 – 20:30, Lord Ashcroft Building (LAB003), Anglia Ruskin University, Cambridge.<br /> Hosted by the Department of Computing &amp; Technology, Anglia Ruskin University, OWASP (Open Web Application Security Project) Cambridge Chapter<br /> <br /> <br /> '''Guest speakers: Eireann Leverett'''<br /> <br /> Eireann Leverett is a Senior Consultant at IOActive where he focuses on Smart Grid and SCADA systems. He studied Artificial Intelligence (AI) and Software Engineering at Edinburgh University and went on to get his Masters in Advanced Computer Science at University of Cambridge. He studied under Frank Stajano and Jon Crowcroft in Cambridge's computer security group. In between, he worked for five years at GE Energy and did a six-month engagement with ABB in their corporate research department.<br /> <br /> '''Title : Switches get Stitches'''<br /> <br /> This mini workshop is based on the successful 44Con talk this year and will introduce you to Industrial Ethernet Switches and their vulnerabilities. These switches are used in environments with industrial automation equipment, like substations, factories, refineries, and ports; in other words, SCADA and ICS switches. You will become familiar with how these switches are used and do some light traffic analysis and firmware reverse engineering, '''bring your laptop with Wireshark installed!!''' During this workshop, Eireann will discuss several vulnerabilities and share the methods used to discover them as well as techniques for exploitation. <br /> <br /> This is partially a hands-on workshop, with pcaps, network forensics, binary analysis, web application vulnerabilities, etc. It teaches about bad session entropy, sidejacking, CSRF, brute forcing MD5, DoS in the context of industrial processes, and carving default private keys from firmware images. Essentially, this is &quot;how I found the bugs in my CVE list for 2013-2014&quot;, breaking industrial ethernet switches.<br /> <br /> Bring along your laptop with Wireshark installed. <br /> ----<br /> <br /> <br /> '''Agenda'''<br /> <br /> 17:30 – 17:45 Welcome from the OWASP Cambridge Chapter Leader, Adrian Winckles, Course Leader in Information Security &amp; Forensic Computing, Anglia Ruskin University<br /> <br /> 17:45 – 19:15 Eireann Leverett – IOActive – Switches got Stitches<br /> <br /> 19:15 – 19:30 Q &amp; A – Further meetings and ideas.<br /> <br /> 19:30 – 20:30 Refreshments &amp; Networking in LAB027<br /> <br /> ----<br /> <br /> '''Registration:''' <br /> <br /> To register for this free event, please register online <br /> [https://www.surveymonkey.com/s/OWASP_Cambs_Apr2014 here]<br /> <br /> The conference will be held in the Lord Ashcroft Building, Room LAB003 (Breakout Room LAB027 for networking &amp; refreshments).<br /> <br /> Please enter through the Helmore Building and ask at reception.<br /> <br /> ----<br /> <br /> '''Meeting Location'''<br /> <br /> Anglia Ruskin University<br /> <br /> Cambridge Campus<br /> <br /> East Road<br /> <br /> Cambridge<br /> <br /> CB1 1PT<br /> <br /> Get further information on travelling to the university. <br /> <br /> http://www.anglia.ac.uk/ruskin/en/home/your_university/anglia_ruskin_campuses/cambridge_campus/find_cambridge.html<br /> <br /> Everyone is welcome to join us at our chapter meetings.<br /> <br /> <br /> &lt;!-- second tab --&gt;<br /> = Past Events =<br /> {|class=&quot;wikitable&quot; border=&quot;1&quot; style=&quot;text-align:center;&quot;|<br /> ! width=&quot;300&quot; | Date<br /> ! width=&quot;350&quot; | Name / Title<br /> ! width=&quot;300&quot; | Link<br /> |-<br /> | 21 October 2014<br /> | Eireann Leverett<br /> | [[Media:20141021-Eireann_Leverett-SwitchesGetStitches.pdf|presentation]]<br /> |- <br /> | 1st April 2014<br /> | Ian Glover (CREST) / Overview of the CREST activities to professionalise the industry.<br /> |<br /> |-<br /> |<br /> | Yiannis Chrysanthou (KPMG) / Modern Password Cracking<br /> |<br /> |-<br /> |<br /> | Damien King (KPMG) / Filename Enumeration with TildeTool<br /> |<br /> |-<br /> | 12th November 2013<br /> | Paul Cain / Tracking Data using Forensics<br /> |<br /> |-<br /> | 12th November 2013<br /> | James Forshaw/ The Forger's Art: Exploiting XML Digital Signature Implementations<br /> | [[Media:20131112-James_Forshaw-the_forgers_art-james_forshaw-breakpoint2k13.pdf|presentation]]<br /> |- <br /> | 5th March 2013<br /> | Sarantis Makoudis / Android (in)Security<br /> | [[Media:20130305-sarantis.pdf|presentation]]<br /> |-<br /> | 5th March 2013<br /> | Nikhil Sreekumar / Power On, Powershell<br /> | [http://www.slideshare.net/Roo7break/power-on-powershell presentation]<br /> |<br /> |}<br /> <br /> &lt;!-- Don't remove this tag --&gt;<br /> __NOTOC__ <br /> &lt;headertabs/&gt;</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=OWASP_Secu-RT_Project&diff=184858 2014-11-06T11:47:10Z

<p>Steven van der Baan: /* News and Events */</p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:OWASP_Project_Header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP Secu-RT Project==<br /> The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: &quot;Prove it&quot;. It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.<br /> <br /> ==Description==<br /> This project aims to provide an invisible source-sink analyser/taint tracker. It will do this by knowing the various sources and sinks in each JVM language and displays the full trace of a string that entered through a source and exits unmanaged at a sink. <br /> <br /> This project is not intended to be used in a production environment, but as an aid in testing the security flow during the QA phase.<br /> <br /> ==Licensing==<br /> <br /> This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright &amp;copy; by Steven van der Baan 2014<br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == Project Resources ==<br /> [https://github.com/vdbaan/SecuRT Source Code]<br /> <br /> == Project Leader ==<br /> [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> == Related Projects ==<br /> <br /> <br /> * [https://www.owasp.org/index.php/Category:OWASP_Code_Crawler OWASP Code Crawler]<br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=Builders]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=Defenders]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]<br /> |}<br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == News and Events ==<br /> &lt;!--<br /> * [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.<br /> * [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.<br /> * [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product. <br /> --&gt;<br /> |}<br /> <br /> =FAQs=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> Many projects have &quot;Frequently Asked Questions&quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'<br /> &lt;/span&gt;<br /> <br /> ==How can I participate in your project?==<br /> All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. <br /> <br /> ==If I am not a programmer can I participate in your project?==<br /> Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. <br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;!--<br /> The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. <br /> --&gt;<br /> The first contributors to the project were:<br /> <br /> * [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> = Road Map and Getting Involved =<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.<br /> Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. <br /> &lt;/span&gt;<br /> ==Roadmap==<br /> As of &lt;strong&gt;November, 2013, the highest priorities for the next 6 months&lt;/strong&gt; are:<br /> &lt;strong&gt;<br /> * Complete the first draft of the Code Project Template<br /> * Get other people to review the Code Project Template and provide feedback<br /> * Incorporate feedback into changes in the Code Project Template<br /> * Finalize the Code Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project<br /> &lt;/strong&gt;<br /> <br /> Subsequent Releases will add<br /> &lt;strong&gt;<br /> * Internationalization Support<br /> * Additional Unit Tests<br /> * Automated Regression tests<br /> &lt;/strong&gt;<br /> <br /> ==Getting Involved==<br /> Involvement in the development and promotion of &lt;strong&gt;Code Project Template&lt;/strong&gt; is actively encouraged!<br /> You do not have to be a security expert or a programmer to contribute.<br /> Some of the ways you can help are as follows:<br /> <br /> ===Coding===<br /> We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests<br /> ===Localization===<br /> Are you fluent in another language? Can you help translate the text strings in the &lt;strong&gt;Code Project Template&lt;/strong&gt; into that language?<br /> ===Testing===<br /> Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.<br /> ===Feedback===<br /> Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:<br /> &lt;ul&gt;<br /> &lt;li&gt;What do like?&lt;/li&gt;<br /> &lt;li&gt;What don't you like?&lt;/li&gt;<br /> &lt;li&gt;What features would you like to see prioritized on the roadmap?&lt;/li&gt;<br /> &lt;/ul&gt;<br /> <br /> =Minimum Viable Product=<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.<br /> Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.<br /> <br /> It would also be ideal if the sample text was translated into different languages.<br /> <br /> =Project About=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &quot;OWASP_Example_Project&quot;. When in doubt, ask the OWASP Projects Manager. <br /> Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project<br /> &lt;/span&gt;<br /> <br /> {{:Projects/OWASP_Example_Project_About_Page}} <br /> <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Code]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=OWASP_Secu-RT_Project&diff=184857 2014-11-06T11:44:25Z

<p>Steven van der Baan: /* Related Projects */</p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:OWASP_Project_Header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP Secu-RT Project==<br /> The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: &quot;Prove it&quot;. It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.<br /> <br /> ==Description==<br /> This project aims to provide an invisible source-sink analyser/taint tracker. It will do this by knowing the various sources and sinks in each JVM language and displays the full trace of a string that entered through a source and exits unmanaged at a sink. <br /> <br /> This project is not intended to be used in a production environment, but as an aid in testing the security flow during the QA phase.<br /> <br /> ==Licensing==<br /> <br /> This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright &amp;copy; by Steven van der Baan 2014<br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == Project Resources ==<br /> [https://github.com/vdbaan/SecuRT Source Code]<br /> <br /> == Project Leader ==<br /> [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> == Related Projects ==<br /> <br /> <br /> * [https://www.owasp.org/index.php/Category:OWASP_Code_Crawler OWASP Code Crawler]<br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=Builders]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=Defenders]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]<br /> |}<br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == News and Events ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. <br /> &lt;/span&gt;<br /> * [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.<br /> * [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.<br /> * [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product. <br /> <br /> |}<br /> <br /> =FAQs=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> Many projects have &quot;Frequently Asked Questions&quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'<br /> &lt;/span&gt;<br /> <br /> ==How can I participate in your project?==<br /> All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. <br /> <br /> ==If I am not a programmer can I participate in your project?==<br /> Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. <br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;!--<br /> The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. <br /> --&gt;<br /> The first contributors to the project were:<br /> <br /> * [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> = Road Map and Getting Involved =<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.<br /> Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. <br /> &lt;/span&gt;<br /> ==Roadmap==<br /> As of &lt;strong&gt;November, 2013, the highest priorities for the next 6 months&lt;/strong&gt; are:<br /> &lt;strong&gt;<br /> * Complete the first draft of the Code Project Template<br /> * Get other people to review the Code Project Template and provide feedback<br /> * Incorporate feedback into changes in the Code Project Template<br /> * Finalize the Code Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project<br /> &lt;/strong&gt;<br /> <br /> Subsequent Releases will add<br /> &lt;strong&gt;<br /> * Internationalization Support<br /> * Additional Unit Tests<br /> * Automated Regression tests<br /> &lt;/strong&gt;<br /> <br /> ==Getting Involved==<br /> Involvement in the development and promotion of &lt;strong&gt;Code Project Template&lt;/strong&gt; is actively encouraged!<br /> You do not have to be a security expert or a programmer to contribute.<br /> Some of the ways you can help are as follows:<br /> <br /> ===Coding===<br /> We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests<br /> ===Localization===<br /> Are you fluent in another language? Can you help translate the text strings in the &lt;strong&gt;Code Project Template&lt;/strong&gt; into that language?<br /> ===Testing===<br /> Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.<br /> ===Feedback===<br /> Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:<br /> &lt;ul&gt;<br /> &lt;li&gt;What do like?&lt;/li&gt;<br /> &lt;li&gt;What don't you like?&lt;/li&gt;<br /> &lt;li&gt;What features would you like to see prioritized on the roadmap?&lt;/li&gt;<br /> &lt;/ul&gt;<br /> <br /> =Minimum Viable Product=<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.<br /> Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.<br /> <br /> It would also be ideal if the sample text was translated into different languages.<br /> <br /> =Project About=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &quot;OWASP_Example_Project&quot;. When in doubt, ask the OWASP Projects Manager. <br /> Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project<br /> &lt;/span&gt;<br /> <br /> {{:Projects/OWASP_Example_Project_About_Page}} <br /> <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Code]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=OWASP_Secu-RT_Project&diff=184856 2014-11-06T11:43:06Z

<p>Steven van der Baan: /* Related Projects */</p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:OWASP_Project_Header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP Secu-RT Project==<br /> The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: &quot;Prove it&quot;. It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.<br /> <br /> ==Description==<br /> This project aims to provide an invisible source-sink analyser/taint tracker. It will do this by knowing the various sources and sinks in each JVM language and displays the full trace of a string that entered through a source and exits unmanaged at a sink. <br /> <br /> This project is not intended to be used in a production environment, but as an aid in testing the security flow during the QA phase.<br /> <br /> ==Licensing==<br /> <br /> This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright &amp;copy; by Steven van der Baan 2014<br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == Project Resources ==<br /> [https://github.com/vdbaan/SecuRT Source Code]<br /> <br /> == Project Leader ==<br /> [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> == Related Projects ==<br /> <br /> <br /> * [[OWASP_Code_Crawler]]<br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=Builders]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=Defenders]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]<br /> |}<br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == News and Events ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. <br /> &lt;/span&gt;<br /> * [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.<br /> * [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.<br /> * [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product. <br /> <br /> |}<br /> <br /> =FAQs=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> Many projects have &quot;Frequently Asked Questions&quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'<br /> &lt;/span&gt;<br /> <br /> ==How can I participate in your project?==<br /> All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. <br /> <br /> ==If I am not a programmer can I participate in your project?==<br /> Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. <br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;!--<br /> The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. <br /> --&gt;<br /> The first contributors to the project were:<br /> <br /> * [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> = Road Map and Getting Involved =<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.<br /> Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. <br /> &lt;/span&gt;<br /> ==Roadmap==<br /> As of &lt;strong&gt;November, 2013, the highest priorities for the next 6 months&lt;/strong&gt; are:<br /> &lt;strong&gt;<br /> * Complete the first draft of the Code Project Template<br /> * Get other people to review the Code Project Template and provide feedback<br /> * Incorporate feedback into changes in the Code Project Template<br /> * Finalize the Code Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project<br /> &lt;/strong&gt;<br /> <br /> Subsequent Releases will add<br /> &lt;strong&gt;<br /> * Internationalization Support<br /> * Additional Unit Tests<br /> * Automated Regression tests<br /> &lt;/strong&gt;<br /> <br /> ==Getting Involved==<br /> Involvement in the development and promotion of &lt;strong&gt;Code Project Template&lt;/strong&gt; is actively encouraged!<br /> You do not have to be a security expert or a programmer to contribute.<br /> Some of the ways you can help are as follows:<br /> <br /> ===Coding===<br /> We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests<br /> ===Localization===<br /> Are you fluent in another language? Can you help translate the text strings in the &lt;strong&gt;Code Project Template&lt;/strong&gt; into that language?<br /> ===Testing===<br /> Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.<br /> ===Feedback===<br /> Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:<br /> &lt;ul&gt;<br /> &lt;li&gt;What do like?&lt;/li&gt;<br /> &lt;li&gt;What don't you like?&lt;/li&gt;<br /> &lt;li&gt;What features would you like to see prioritized on the roadmap?&lt;/li&gt;<br /> &lt;/ul&gt;<br /> <br /> =Minimum Viable Product=<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.<br /> Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.<br /> <br /> It would also be ideal if the sample text was translated into different languages.<br /> <br /> =Project About=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &quot;OWASP_Example_Project&quot;. When in doubt, ask the OWASP Projects Manager. <br /> Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project<br /> &lt;/span&gt;<br /> <br /> {{:Projects/OWASP_Example_Project_About_Page}} <br /> <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Code]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=OWASP_Secu-RT_Project&diff=184855 2014-11-06T11:42:13Z

<p>Steven van der Baan: /* Project Resources */</p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:OWASP_Project_Header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP Secu-RT Project==<br /> The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: &quot;Prove it&quot;. It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.<br /> <br /> ==Description==<br /> This project aims to provide an invisible source-sink analyser/taint tracker. It will do this by knowing the various sources and sinks in each JVM language and displays the full trace of a string that entered through a source and exits unmanaged at a sink. <br /> <br /> This project is not intended to be used in a production environment, but as an aid in testing the security flow during the QA phase.<br /> <br /> ==Licensing==<br /> <br /> This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright &amp;copy; by Steven van der Baan 2014<br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == Project Resources ==<br /> [https://github.com/vdbaan/SecuRT Source Code]<br /> <br /> == Project Leader ==<br /> [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> == Related Projects ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can link to other OWASP Projects that are similar to yours. <br /> &lt;/span&gt;<br /> <br /> * [[OWASP_Code_Tool_Template]]<br /> * [[OWASP_Documentation_Project_Template]]<br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=Builders]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=Defenders]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]<br /> |}<br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == News and Events ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. <br /> &lt;/span&gt;<br /> * [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.<br /> * [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.<br /> * [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product. <br /> <br /> |}<br /> <br /> =FAQs=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> Many projects have &quot;Frequently Asked Questions&quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'<br /> &lt;/span&gt;<br /> <br /> ==How can I participate in your project?==<br /> All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. <br /> <br /> ==If I am not a programmer can I participate in your project?==<br /> Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. <br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;!--<br /> The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. <br /> --&gt;<br /> The first contributors to the project were:<br /> <br /> * [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> = Road Map and Getting Involved =<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.<br /> Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. <br /> &lt;/span&gt;<br /> ==Roadmap==<br /> As of &lt;strong&gt;November, 2013, the highest priorities for the next 6 months&lt;/strong&gt; are:<br /> &lt;strong&gt;<br /> * Complete the first draft of the Code Project Template<br /> * Get other people to review the Code Project Template and provide feedback<br /> * Incorporate feedback into changes in the Code Project Template<br /> * Finalize the Code Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project<br /> &lt;/strong&gt;<br /> <br /> Subsequent Releases will add<br /> &lt;strong&gt;<br /> * Internationalization Support<br /> * Additional Unit Tests<br /> * Automated Regression tests<br /> &lt;/strong&gt;<br /> <br /> ==Getting Involved==<br /> Involvement in the development and promotion of &lt;strong&gt;Code Project Template&lt;/strong&gt; is actively encouraged!<br /> You do not have to be a security expert or a programmer to contribute.<br /> Some of the ways you can help are as follows:<br /> <br /> ===Coding===<br /> We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests<br /> ===Localization===<br /> Are you fluent in another language? Can you help translate the text strings in the &lt;strong&gt;Code Project Template&lt;/strong&gt; into that language?<br /> ===Testing===<br /> Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.<br /> ===Feedback===<br /> Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:<br /> &lt;ul&gt;<br /> &lt;li&gt;What do like?&lt;/li&gt;<br /> &lt;li&gt;What don't you like?&lt;/li&gt;<br /> &lt;li&gt;What features would you like to see prioritized on the roadmap?&lt;/li&gt;<br /> &lt;/ul&gt;<br /> <br /> =Minimum Viable Product=<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.<br /> Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.<br /> <br /> It would also be ideal if the sample text was translated into different languages.<br /> <br /> =Project About=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &quot;OWASP_Example_Project&quot;. When in doubt, ask the OWASP Projects Manager. <br /> Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project<br /> &lt;/span&gt;<br /> <br /> {{:Projects/OWASP_Example_Project_About_Page}} <br /> <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Code]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=OWASP_Secu-RT_Project&diff=184854 2014-11-06T11:40:51Z

<p>Steven van der Baan: /* Description */</p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:OWASP_Project_Header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP Secu-RT Project==<br /> The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: &quot;Prove it&quot;. It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.<br /> <br /> ==Description==<br /> This project aims to provide an invisible source-sink analyser/taint tracker. It will do this by knowing the various sources and sinks in each JVM language and displays the full trace of a string that entered through a source and exits unmanaged at a sink. <br /> <br /> This project is not intended to be used in a production environment, but as an aid in testing the security flow during the QA phase.<br /> <br /> ==Licensing==<br /> <br /> This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright &amp;copy; by Steven van der Baan 2014<br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == Project Resources ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can link to the key locations for project files, including setup programs, the source code repository, online documentation, a Wiki Home Page, threaded discussions about the project, and Issue Tracking system, etc. <br /> &lt;/span&gt;<br /> <br /> [https://github.com/SamanthaGroves Compiled DLLs]<br /> <br /> [https://github.com/SamanthaGroves Source Code]<br /> <br /> [https://github.com/SamanthaGroves Documentation]<br /> <br /> [https://github.com/SamanthaGroves Wiki Home Page]<br /> <br /> [https://github.com/SamanthaGroves Issue Tracker]<br /> <br /> [https://github.com/SamanthaGroves Slide Presentation]<br /> <br /> [https://github.com/SamanthaGroves Video]<br /> <br /> == Project Leader ==<br /> [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> == Related Projects ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can link to other OWASP Projects that are similar to yours. <br /> &lt;/span&gt;<br /> <br /> * [[OWASP_Code_Tool_Template]]<br /> * [[OWASP_Documentation_Project_Template]]<br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=Builders]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=Defenders]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]<br /> |}<br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == News and Events ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. <br /> &lt;/span&gt;<br /> * [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.<br /> * [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.<br /> * [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product. <br /> <br /> |}<br /> <br /> =FAQs=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> Many projects have &quot;Frequently Asked Questions&quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'<br /> &lt;/span&gt;<br /> <br /> ==How can I participate in your project?==<br /> All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. <br /> <br /> ==If I am not a programmer can I participate in your project?==<br /> Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. <br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;!--<br /> The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. <br /> --&gt;<br /> The first contributors to the project were:<br /> <br /> * [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> = Road Map and Getting Involved =<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.<br /> Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. <br /> &lt;/span&gt;<br /> ==Roadmap==<br /> As of &lt;strong&gt;November, 2013, the highest priorities for the next 6 months&lt;/strong&gt; are:<br /> &lt;strong&gt;<br /> * Complete the first draft of the Code Project Template<br /> * Get other people to review the Code Project Template and provide feedback<br /> * Incorporate feedback into changes in the Code Project Template<br /> * Finalize the Code Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project<br /> &lt;/strong&gt;<br /> <br /> Subsequent Releases will add<br /> &lt;strong&gt;<br /> * Internationalization Support<br /> * Additional Unit Tests<br /> * Automated Regression tests<br /> &lt;/strong&gt;<br /> <br /> ==Getting Involved==<br /> Involvement in the development and promotion of &lt;strong&gt;Code Project Template&lt;/strong&gt; is actively encouraged!<br /> You do not have to be a security expert or a programmer to contribute.<br /> Some of the ways you can help are as follows:<br /> <br /> ===Coding===<br /> We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests<br /> ===Localization===<br /> Are you fluent in another language? Can you help translate the text strings in the &lt;strong&gt;Code Project Template&lt;/strong&gt; into that language?<br /> ===Testing===<br /> Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.<br /> ===Feedback===<br /> Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:<br /> &lt;ul&gt;<br /> &lt;li&gt;What do like?&lt;/li&gt;<br /> &lt;li&gt;What don't you like?&lt;/li&gt;<br /> &lt;li&gt;What features would you like to see prioritized on the roadmap?&lt;/li&gt;<br /> &lt;/ul&gt;<br /> <br /> =Minimum Viable Product=<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.<br /> Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.<br /> <br /> It would also be ideal if the sample text was translated into different languages.<br /> <br /> =Project About=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &quot;OWASP_Example_Project&quot;. When in doubt, ask the OWASP Projects Manager. <br /> Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project<br /> &lt;/span&gt;<br /> <br /> {{:Projects/OWASP_Example_Project_About_Page}} <br /> <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Code]]</div>

Steven van der Baan https://wiki.owasp.org/index.php?title=OWASP_Secu-RT_Project&diff=184853 2014-11-06T11:35:32Z

<p>Steven van der Baan: /* Volunteers */</p> <hr /> <div>=Main=<br /> <br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:OWASP_Project_Header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> ==OWASP Secu-RT Project==<br /> The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: &quot;Prove it&quot;. It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.<br /> <br /> ==Description==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you need to add your more robust project description. A project description should outline the purpose of the project, how it is used, and the value it provides to application security. Ideally, project descriptions should be written in such a way that there is no question what value the project provides to the software security community. This section will be seen and used in various places within the Projects Portal. Poorly written project descriptions therefore detract from a project’s visibility, so project leaders should ensure that the description is meaningful. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template is simply a sample project that was developed for instructional purposes that can be used to create default project pages for a Code project. After copying this template to your new project, all you have to do is follow the instructions in red, replace the sample text with text suited for your project, and then delete the sections in red. Doing so should make it clearer to both consumers of this project, as well as OWASP reviewers who are trying to determine if the project can be promoted to the next category. The information requested is also intended to help Project Leaders think about the roadmap and feature priorities, and give guidance to the reviews as a result of that effort.<br /> <br /> Creating a new set of project pages from scratch can be a challenging task. By providing a sample layout, with instructional text and examples, the OWASP Code Project Template makes it easier for Project Leaders to create effective security projects and hence helps promote security.<br /> <br /> ==Licensing==<br /> <br /> This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright &amp;copy; by Steven van der Baan 2014<br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> <br /> == Project Resources ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can link to the key locations for project files, including setup programs, the source code repository, online documentation, a Wiki Home Page, threaded discussions about the project, and Issue Tracking system, etc. <br /> &lt;/span&gt;<br /> <br /> [https://github.com/SamanthaGroves Compiled DLLs]<br /> <br /> [https://github.com/SamanthaGroves Source Code]<br /> <br /> [https://github.com/SamanthaGroves Documentation]<br /> <br /> [https://github.com/SamanthaGroves Wiki Home Page]<br /> <br /> [https://github.com/SamanthaGroves Issue Tracker]<br /> <br /> [https://github.com/SamanthaGroves Slide Presentation]<br /> <br /> [https://github.com/SamanthaGroves Video]<br /> <br /> == Project Leader ==<br /> [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> == Related Projects ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can link to other OWASP Projects that are similar to yours. <br /> &lt;/span&gt;<br /> <br /> * [[OWASP_Code_Tool_Template]]<br /> * [[OWASP_Documentation_Project_Template]]<br /> <br /> ==Classifications==<br /> <br /> {| width=&quot;200&quot; cellpadding=&quot;2&quot;<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Project_Type_Files_CODE.jpg|link=]]<br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot; rowspan=&quot;2&quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-builders-small.png|link=Builders]] <br /> |-<br /> | align=&quot;center&quot; valign=&quot;top&quot; width=&quot;50%&quot;| [[File:Owasp-defenders-small.png|link=Defenders]]<br /> |-<br /> | colspan=&quot;2&quot; align=&quot;center&quot; | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]<br /> |}<br /> <br /> | valign=&quot;top&quot; style=&quot;padding-left:25px;width:200px;&quot; | <br /> <br /> == News and Events ==<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. <br /> &lt;/span&gt;<br /> * [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.<br /> * [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.<br /> * [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product. <br /> <br /> |}<br /> <br /> =FAQs=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> Many projects have &quot;Frequently Asked Questions&quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'<br /> &lt;/span&gt;<br /> <br /> ==How can I participate in your project?==<br /> All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. <br /> <br /> ==If I am not a programmer can I participate in your project?==<br /> Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. <br /> <br /> = Acknowledgements =<br /> ==Volunteers==<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;!--<br /> The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. <br /> --&gt;<br /> The first contributors to the project were:<br /> <br /> * [[User:Steven_van_der_Baan|Steven van der Baan]]<br /> <br /> = Road Map and Getting Involved =<br /> <br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.<br /> Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. <br /> &lt;/span&gt;<br /> ==Roadmap==<br /> As of &lt;strong&gt;November, 2013, the highest priorities for the next 6 months&lt;/strong&gt; are:<br /> &lt;strong&gt;<br /> * Complete the first draft of the Code Project Template<br /> * Get other people to review the Code Project Template and provide feedback<br /> * Incorporate feedback into changes in the Code Project Template<br /> * Finalize the Code Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project<br /> &lt;/strong&gt;<br /> <br /> Subsequent Releases will add<br /> &lt;strong&gt;<br /> * Internationalization Support<br /> * Additional Unit Tests<br /> * Automated Regression tests<br /> &lt;/strong&gt;<br /> <br /> ==Getting Involved==<br /> Involvement in the development and promotion of &lt;strong&gt;Code Project Template&lt;/strong&gt; is actively encouraged!<br /> You do not have to be a security expert or a programmer to contribute.<br /> Some of the ways you can help are as follows:<br /> <br /> ===Coding===<br /> We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests<br /> ===Localization===<br /> Are you fluent in another language? Can you help translate the text strings in the &lt;strong&gt;Code Project Template&lt;/strong&gt; into that language?<br /> ===Testing===<br /> Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.<br /> ===Feedback===<br /> Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:<br /> &lt;ul&gt;<br /> &lt;li&gt;What do like?&lt;/li&gt;<br /> &lt;li&gt;What don't you like?&lt;/li&gt;<br /> &lt;li&gt;What features would you like to see prioritized on the roadmap?&lt;/li&gt;<br /> &lt;/ul&gt;<br /> <br /> =Minimum Viable Product=<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.<br /> Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. <br /> &lt;/span&gt;<br /> <br /> The Code Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.<br /> <br /> It would also be ideal if the sample text was translated into different languages.<br /> <br /> =Project About=<br /> &lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&gt;<br /> &lt;span style=&quot;color:#ff0000&quot;&gt;<br /> This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &quot;OWASP_Example_Project&quot;. When in doubt, ask the OWASP Projects Manager. <br /> Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project<br /> &lt;/span&gt;<br /> <br /> {{:Projects/OWASP_Example_Project_About_Page}} <br /> <br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Code]]</div>

Steven van der Baan