OWASP - User contributions [en]

Dubai

2017-03-14T05:40:41Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

=== OWASP Middle East Partners with MISTI Europe ===
----
[[File:CISO_ME.png]]

Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!

'''You can get a 20% off by using the follow code: OWASP17'''

Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win). Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].
 If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-03-12T10:22:13Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

=== OWASP Middle East Partners with MISTI Europe ===
----
[[File:CISO_ME.png]]

Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!

Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win).
 

Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].
 

If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-03-12T10:19:18Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

=== OWASP Middle East Partners with MISTI Europe ===
----
'''<code><nowiki>[[File:CISO_ME.png]]</nowiki></code>'''

Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!

Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win).
 

Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].
 

If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-03-12T10:17:53Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

=== OWASP Middle East Partners with MISTI Europe ===
----
'''<code>[http://www.cisomiddleeast.misti.com/ <nowiki>[[File:CISO_ME.png]]</nowiki>]</code>'''

Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!

Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win).
 

Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].
 

If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

File:CISO ME.png

2017-03-12T10:15:41Z

Tarek:

Dubai

2017-03-12T05:42:38Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

=== OWASP Middle East Partners with MISTI Europe ===
----
Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!
 
Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win).
 
Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].
 
If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP ]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-03-12T05:41:07Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

=== OWASP Middle East Partners with MISTI Europe ===
Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!
 
Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win).
 
Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].
 
If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP ]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-03-12T05:32:27Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

== OWASP Middle East Partners with MISTI Europe ==

'''Returning to the [http://habtoor-grand-beach-resort-spa.hotels-in-dubai.org/en/ Habtoor Grand Resort], 27-29 March 2017, the 9th annual [http://www.cisomiddleeast.misti.com/?_ga=1.114765698.486057116.1487900262 CISO Middle East Conference & Roundtable] has new topics, revised sessions and world-class speakers that will leave you on the edge of your seat. With the agenda focusing on burning issues such as phishing attacks, how digital transformation is changing the threat landscape and security/privacy challenges of IoT, we are certain there is something for everyone. If you haven't secured your spot yet, now is the time!'''

Book now, attend the conference, and you'll automatically be entered into the prize drawer to win one of three Amazon Echo Dots! (Please note, delegates can only win once, and you must be present on the day to win).

Now while we know you don't have the voice service that powers Echo, Alexa, to assist you quite yet in planning your time at the event, you can still download a copy of the [http://training.misti.com/acton/form/10465/004e:d-0001/0/-/-/-/-/index.htminteractive event brochure here].

If you have any inquiries regarding the event or would like to register, please get in touch with [mailto:cclarke@misti.com Chris Clarke] directly.'''

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP ]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-02-27T09:46:29Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

 

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.
----

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP ]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-02-27T09:44:34Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

 

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''7th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP ]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

Dubai

2017-02-27T09:44:13Z

Tarek:

{{Chapter Template|chaptername=Dubai|extra=The chapter leaders are [mailto:amro@owasp.org Amro AlOlaqi] and [mailto:tarek@owasp.org Tarek Naja]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dubai|emailarchives=http://lists.owasp.org/pipermail/owasp-dubai}}

 

== Local News ==

'''OWASP Moves to MediaWiki Portal - 11:15, 20 May 2006 (EDT)'''

== Past Events ==
'''77th of Feb 2017 at 12:30pm'''
Abu Dhabi Cyber Resilience & InfoSeC

Topics:
; Cracking Passwords for Security's Sake
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He currently the head of information security at a major middle east organization.

'''27th of August 2014 at 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

Topics:
; OWASP Top 10 A2 - Broken Authentication and session management
: Speaker: [http://ae.linkedin.com/in/tareknaja Tarek Naja]
: Bio: Tarek is the OWASP UAE chapter leader. He is a seasoned security consultant who focuses on penetration testing.

; OWASP Top 10 A3 - Cross site scripting (XSS)
: Speaker: [http://ae.linkedin.com/in/mhendrickx Michael Hendrickx]
: Bio: Michael is an experienced IT security professional with strong, deep technical knowledge on wide variety of applications.

----
'''28th of May, 2014. 6:30pm'''
Nakheel Sales Office [https://maps.google.com/maps?q=Nakheel+Sales+Center+-+Al+Sufouh+-+Dubai+-+United+Arab+Emirates&hl=en&ll=25.104759,55.156517&spn=0.038589,0.066047&sll=31.128199,-72.773437&sspn=71.247495,135.263672&oq=Nakheel&dirflg=r&ttype=now&noexp=0&noal=0&sort=def&hq=Nakheel+Sales+Center+-&hnear=Al+Sufouh+-+Dubai+-+United+Arab+Emirates&t=m&z=15 MAP]
Al Sufouh Road,
Jumeirah - Dubai
United Arab Emirates

We're honored to have our guest speak [http://ae.linkedin.com/pub/ammar-almarzooqi/30/b11/b86 Ammar Almarzooqi] - Chief Information Security Officer at Abu Dhabi Department of Economic Development.

Ammar will be talking about seamless implementation of security controls. If you're dealing with some elements that are inherently secure, such as an application that cannot be modified, how would you be able to secure your environment? Ammar will be addressing this question and discussing a real case scenario from his organization.

 
Our other presenter is [http://ae.linkedin.com/in/tareknaja Tarek Naja] - Senior Security Consultant.
Tarek will be answering questions about the vulnerability you all heard about recently: Heart Bleed. Tarek specializes in penetration testing, mainly web application and mobile application penetration testing.

----
'''19th of Feb 2014 at 8pm'''
Cafe Rider [http://cafe-rider.com/styled-4/index.html MAP]
Close to Mall of the Emirates
Al Quoz Industrial - Dubai
United Arab Emirates

Topics:
; Managing Web & Application Security with OWASP – bringing it all together
: Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. A journey through different organisational stages and how OWASP tools help organisations moving forward improving their web and application security. This talk will discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation

; Application Security for managers: OWASP CISO Guide and CISO Survey
: The OWASP CISO guide and CISO report 2013. This talk will present two new OWASP projects, the CISO guide and the newly released results of the OWASP CISO Survey report 2013. Their main goal is to provide guidance on application and web security for senior managers and to introduce Chief Information Security Officers (CISO) to the OWASP Application Security Guide and the results of the CISO Survey. Over the last years, we noticed that application security risks and threats have been on the rise and OWASP has started the CISO survey project to gather intelligence and provide it to CISOs and senior managers in order to improve their security strategies, assess their priorities and learn from their peers about what works best protecting web and application security in organizations across various industries.

Speaker: [http://hk.linkedin.com/in/gondrom Tobias Gondrom]

Tobias Gondrom is a global board member of OWASP (Open Web Application Security Project) and CEO at Thames Stanley, a boutique Global CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany.

----
'''14th of Dec 2013 at 6-8pm.'''

MAKE Business Hub [https://maps.google.com/maps?ie=UTF8&q=MAKE+Business+Hub+Cafe&fb=1&hq=make+business+hub&cid=1882949530944650280&hnear=&ll=25.079127,55.136797&spn=0.011816,0.021136&t=m&z=16&vpsrc=0&iwloc=A MAP ]
Al Fattan Tower - Dubai
United Arab Emirates
+971 4 392 9216
Speaker: Peter Dowley
Topic: Security Architecture for Applications, titled "What's the difference between a security bug and a security flaw?"

Speaker bio : Peter has been working in computer security for over 10 years, after
another decade in other areas of IT - System & infrastructure architecture,
Windows desktop & server design & management, database modelling & design,
programming. He has strong expertise in security architecture (especially
for banking systems) and how this relates to risk and fraud management. He
is a senior security consultant with Hewlett-Packard (HP) in Dubai and has
been based in the Gulf region for 5 years.

'''Download the presentation:''' [https://www.owasp.org/index.php/File:Security_Bugs_vs_Flaws.pptx "What's the difference between a security bug and a security flaw"]

----
'''Casual OWASP meetup'''
This will be our first meeting in a while. It will be an opportunity to get introduced to the other members of the OWASP UAE Chapter and discuss the type of events you'd like to see in the future.

This will be a casual meeting at a Caribou Coffee at DIFC

http://www.mealadvisors.com/uae/dubai/restaurant/map/branch_id/1294

Gathering agenda will be:

Meeting on Saturday the 9th of November 2013 at 6pm.
Introductions
Intro to OWASP
Open discussion about Dubai chapter
Networking
Conclude at 8pm

----

'''IDC's IT Security Roadshow 2013 - Dubai '''

Date and Time : Wednesday, April 3, 2013
Venue: Mina A' Salam Hotel (Madinat Jumeirah)
Web Application Security "Think like a hacker"
Speaker: Amro Alolaqi

Reference: http://idc-cema.com/eng/events/50679-idc-s-it-security-roadshow-2013/11-speakers

----

'''Cyber Security Summit 2012- DUBAI'''

Date and Time : 2nd & 3rd of October 2012 - 9:00 AM to 4:00 PM
Venue: Grand Hayat - Dubai
Web Application Critical Vulnerabilities (OWASP top ten)
Speaker: Amro AlOlaqi

http://we-initiative.com/wp-content/uploads/2012/07/Cyber-Security-UAE-2012-EM12.pdf
----

'''ISACA UAE - ISAFE conference 2011 - Dubai'''

Date and Time : 18th - 9:00 AM to 4:00 PM
Venue: The Address Hotel - Dubai Mall
Web Application Critical Vulnerabilities and Threat Modeling
Speaker: Amro AlOlaqi

http://www.isacauae.org/isafe2011/doc/isafe2011brochure.pdf

https://plus.google.com/photos/117947441088827793360/albums/5712379217298867441?banner=pwa

----

'''IT For Government 2011- DUBAI'''

''Location: Dusit Thani Hotel - 133, Sheikh Zayed Road ''

''Date: 4/Oct/2011''

''Registration 8:00 AM''

''NAUGURAL KEYNOTE PRESENTATION BY His Excellency Salem Khamis Al Shair Al Suwaidi Emirates e-Government Director General''

OWASP's session: 11:20 PM
Speaker: Amro AlOlaqi
Subject: The Ten Web Application Critical Risks

For more information about the event, please visit http://www.fleminggulf.com/cms/uploads/conference/downloads/Postshow_report_DBTC15.pdf

[[Category:United Arab Emirates]]

File:Santoku.png

2013-06-07T10:56:05Z

Tarek: uploaded a new version of "File:Santoku.png": Reverted to version as of 11:58, 6 June 2013

santoku screenshot

File:Santoku.png

2013-06-07T10:55:36Z

Tarek: uploaded a new version of "File:Santoku.png"

santoku screenshot

SettingupMobileTestingLab

2013-06-07T10:52:18Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:1-_sdk_manager.png]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below.

[[File:install emulator.png]]

Once the installation is complete you'll need to create a new AVD simply by clicking on New on the Android Virtual Device Manager

[[File:andoird avd new.png]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:create avd.png]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:working emulator.png]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:apk.png]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:adb install.png]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:proxy command.png]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:mallory.png]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

[[File:shell.png]]

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

[[File:ddms.png]]

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

[[File:mem analyzer.png]]

== Santoku ==

Now if all this sounds like a lot of work luckily there's a ready made Linux distro called Santoku that has all the tools preinstalled.

[[File:Santoku.png]]

File:Santoku.png

2013-06-06T11:58:08Z

Tarek: santoku screenshot

santoku screenshot

File:Mem analyzer.png

2013-06-06T11:57:15Z

Tarek: eclipse memory analyze screenshot

eclipse memory analyze screenshot

File:Ddms.png

2013-06-06T11:56:32Z

Tarek: Dalvik Debug Monitor Server (DDMS) screenshot

Dalvik Debug Monitor Server (DDMS) screenshot

File:Shell.png

2013-06-06T11:55:33Z

Tarek: android emulator shell command

android emulator shell command

File:Mallory.png

2013-06-06T11:55:09Z

Tarek: mallory proxy logo

mallory proxy logo

File:Proxy command.png

2013-06-06T11:54:16Z

Tarek: android emulator http proxy command

android emulator http proxy command

File:Adb install.png

2013-06-06T11:53:57Z

Tarek: install Android Debugging Bridge (adb) command

install Android Debugging Bridge (adb) command

File:Apk.png

2013-06-06T11:53:19Z

Tarek: android package (apk) screenshot

android package (apk) screenshot

SettingupMobileTestingLab

2013-06-06T11:52:42Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:1-_sdk_manager.png]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below.

[[File:install emulator.png]]

Once the installation is complete you'll need to create a new AVD simply by clicking on New on the Android Virtual Device Manager

[[File:andoird avd new.png]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:create avd.png]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:working emulator.png]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:apk.png]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:adb install.png]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:proxy command.png]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:mallory.png]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

[[File:shell.png]]

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

[[File:ddms.png]]

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

[[File:mem analyzer.png]]

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

[[File:Santoku.png]]

File:Working emulator.png

2013-06-06T11:52:30Z

Tarek: android emulator screenshot

android emulator screenshot

File:Create avd.png

2013-06-06T11:51:52Z

Tarek: create android virtual device (avd)

create android virtual device (avd)

File:Andoird avd new.png

2013-06-06T11:51:13Z

Tarek: create new android emulator screenshot

create new android emulator screenshot

SettingupMobileTestingLab

2013-06-06T11:50:36Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:1-_sdk_manager.png]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below.

[[File:install emulator.png]]

Once the installation is complete you'll need to create a new AVD simply by clicking on New on the Android Virtual Device Manager

[[File:andoird avd new.png]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:create avd.png]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:working emulator.png]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:apk.pgn]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:adb install.png]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:proxy command.png]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:mallory.png]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

[[File:shell.png]]

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

[[File:ddms.png]]

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

[[File:mem analyzer.png]]

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

[[File:Santoku.png]]

SettingupMobileTestingLab

2013-06-06T11:50:12Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:1-_sdk_manager.png]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below.

[[File:install emulator.png]]

Once the installation is complete you'll need to create a new AVD simply by clicking on New on the Android Virtual Device Manager

[[File:andoird avd new.pgn]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:create avd.png]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:working emulator.png]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:apk.pgn]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:adb install.png]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:proxy command.png]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:mallory.png]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

[[File:shell.png]]

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

[[File:ddms.png]]

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

[[File:mem analyzer.png]]

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

[[File:Santoku.png]]

File:Install emulator.png

2013-06-06T11:47:01Z

Tarek: install android emulator screenshot

install android emulator screenshot

SettingupMobileTestingLab

2013-06-06T11:46:20Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:1-_sdk_manager.png]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below. You click on New and here's what these options mean.

[[File:install emulator.png]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:create avd.png]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:working emulator.png]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:apk.pgn]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:adb install.png]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:proxy command.png]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:mallory.png]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

[[File:shell.png]]

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

[[File:ddms.png]]

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

[[File:mem analyzer.png]]

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

[[File:Santoku.png]]

SettingupMobileTestingLab

2013-06-06T11:44:58Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:sdk manager.png]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below. You click on New and here's what these options mean.

[[File:install emulator.png]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:create avd.png]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:working emulator.png]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:apk.pgn]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:adb install.png]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:proxy command.png]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:mallory.png]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

[[File:shell.png]]

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

[[File:ddms.png]]

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

[[File:mem analyzer.png]]

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

[[File:Santoku.png]]

File:1- sdk manager.png

2013-06-06T11:38:10Z

Tarek:

SettingupMobileTestingLab

2013-06-06T11:32:55Z

Tarek:

This document details how to set up an Android lab so you can perform mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.

[[File:Example.jpg]]

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below. You click on New and here's what these options mean.

[[File:Example.jpg]]

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

[[File:Example.jpg]]

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

[[File:Example.jpg]]

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.

[[File:Example.jpg]]

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

[[File:Example.jpg]]

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.

[[File:Example.jpg]]

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.

[[File:Example.jpg]]

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular WAVA there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools. Here's an example of a class Adel found the encryption key in.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

SettingupMobileTestingLab

2013-06-06T11:26:55Z

Tarek:

This document details how to set up an Android lab so you can do mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. I usually go with the latest version. It's a straight forward next install process but it might take a while.

== Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks something like this. You click on New and here's what these options mean.

== Create AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

Diff between Android and Google API?

== Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

== Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. It sounds fancy but it's really a zipped file based on JAR format which will come in handy when we try to reverse the application later. Usually the client will provide this file.

== ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the paltform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

== Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems a lot of ways to documented to overcome this but non has worked for me. So if anyone has any tips or solutions please do share hem with me.

== Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit of pain but the process is well documented online. If you need the resources let me know and I'll send them over.

== Decompiling app (jd-gui) ==

Apart from treating the application as a regular WAVA there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools. Here's an example of a class Adel found the encryption key in.

== Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

== Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

== Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

== Santoku ==

Now if all this sounds like a lot of work luckily the good guys at owasp and our french t&v team has saved us a lot of trouble. Owasp has created a backtrack like os for mobile testing called santoku. And the good guys in our french team namely alaeddin and adel have created working vms and avds to save us all some time. So feel free to reach out for them and ask them for those

SettingupMobileTestingLab

2013-06-06T11:25:41Z

Tarek: Created page with "This document details how to set up an Android lab so you can do mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and us..."

This document details how to set up an Android lab so you can do mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== 1- Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== 2- Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. I usually go with the latest version. It's a straight forward next install process but it might take a while.

== 3- Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks something like this. You click on New and here's what these options mean.

== 4- Creat AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

Diff between Android and Google API?

== 5- Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

== 6- Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. It sounds fancy but it's really a zipped file based on JAR format which will come in handy when we try to reverse the application later. Usually the client will provide this file.

== 7- ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the paltform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

== 8- Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems a lot of ways to documented to overcome this but non has worked for me. So if anyone has any tips or solutions please do share hem with me.

== 9- Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit of pain but the process is well documented online. If you need the resources let me know and I'll send them over.

== 10- Decompiling app (jd-gui) ==

Apart from treating the application as a regular WAVA there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools. Here's an example of a class Adel found the encryption key in.

== 11- Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

== 12- Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

== 13-Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

== 14- Santoku ==

Now if all this sounds like a lot of work luckily the good guys at owasp and our french t&v team has saved us a lot of trouble. Owasp has created a backtrack like os for mobile testing called santoku. And the good guys in our french team namely alaeddin and adel have created working vms and avds to save us all some time. So feel free to reach out for them and ask them for those