OWASP - User contributions [en]

Project Information:template Live CD 2008 Project

2008-09-15T23:14:37Z

Wirefall:

{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''PROJECT IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Project Name'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|'''OWASP Live CD 2008 Project'''
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|This project aims to take the existing applications and documentation in the current Live CD and add significantly more tools and documentation specifically focused on Web application security. I think [[:Phoenix/Tools|OWASP's Phoenix/Tools]] page would be a good starting point for potential tools. I'd also like to use [http://www.webappsec.org/ WASC] and [http://www.isecom.org/ ISECOM/OSSTMM] as sources for material.
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Email Contacts'''
| style="width:14%; background:#cccccc" align="center"|Project Leader [mailto:mtesauro(at)gmail.com '''Matt Tesauro''']
| style="width:14%; background:#cccccc" align="center"|Project Contributors (if applicable) [mailto:to(at)change '''Name&Email''']
| style="width:14%; background:#cccccc" align="center"|[https://lists.owasp.org/mailman/listinfo/owasp-live-cd-2008-project '''Mailing List/Subscribe'''] [mailto:Owasp-Live-CD-2008-Project(at)lists.owasp.org '''Mailing List/Use''']
| style="width:14%; background:#cccccc" align="center"|First Reviewer [mailto:admin(at)wirefall.com '''Dustin Dykes'''] [http://www.linkedin.com/pub/1/607/6b1 Curriculm]
| style="width:14%; background:#cccccc" align="center"|Second Reviewer [mailto:jkpoots(at)rogers.com '''Kent Poots'''] [http://www.linkedin.com/pub/5/25B/114 Curriculum]
| style="width:15%; background:#cccccc" align="center"|OWASP Board Member (if applicable) [mailto:name(at)name '''Name&Email''']
|}
{| style="width:100%" border="0" align="center"
! colspan="6" align="center" style="background:#4058A0; color:white"|'''PROJECT MAIN LINKS'''
|-
| style="width:100%; background:#cccccc" align="center"|
[http://mtesauro.com/livecd/ ISO Download Site and Documentation Wiki] 
The SoC release ISO is currently available [http://mtesauro.com/owasp-livecd-2008-SoC.iso owasp-livecd-2008-SoC.iso]. 
The following general documentation exists:
*[http://mtesauro.com/livecd/index.php?title=How_I_created_the_live_CD how I created the live CD]
*[http://mtesauro.com/livecd/index.php?title=Category:Making_Modules Making Modules]
*[http://mtesauro.com/livecd/index.php?title=Add_modules_to_a_running_system Add modules to a running system]
*[http://mtesauro.com/livecd/index.php?title=Starting_the_SSH_daemon_on_the_Live_CD Starting the SSH daemon on the Live CD]
*[http://mtesauro.com/livecd/index.php?title=Checking_sources Checking sources Checking sources]
[http://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project Original SoC 2008 Application]
|}
{| style="width:100%" border="0" align="center"
! colspan="6" align="center" style="background:#4058A0; color:white"|'''RELATED PROJECTS'''
|-
| style="width:100%; background:#cccccc" align="center"|
[[:Category:OWASP_Live_CD_Project|OWASP Live CD 2007 Project - A]] [[SpoC 007 - OWASP LiveCD Project|OWASP Live CD 2007 Project - B]]
|}
{| style="width:100%" border="0" align="center"
! colspan="6" align="center" style="background:#4058A0; color:white"|'''SPONSORS & GUIDELINES'''
|-
| style="width:50%; background:#cccccc" align="center"|[[OWASP Summer of Code 2008|Sponsor - '''OWASP Summer of Code 2008''']]
| style="width:50%; background:#cccccc" align="center"|[[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|'''Sponsored Project/Guidelines/Roadmap''']]
|}
{| style="width:100%" border="0" align="center"
! colspan="5" align="center" style="background:#4058A0; color:white"|ASSESSMENT AND REVIEW PROCESS
|-
| style="width:15%; background:#6C82B5" align="center"|'''Review/Reviewer'''
| style="width:21%; background:#b3b3b3" align="center"|'''Author's Self Evaluation''' (applicable for Alpha Quality & further)
| style="width:21%; background:#b3b3b3" align="center"|'''First Reviewer''' (applicable for Alpha Quality & further)
| style="width:21%; background:#b3b3b3" align="center"|'''Second Reviewer''' (applicable for Beta Quality & further)
| style="width:22%; background:#b3b3b3" align="center"|'''OWASP Board Member''' (applicable just for Release Quality)
|-
| style="width:15%; background:#7B8ABD" align="center"|'''50% Review'''
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes''' --------- [[Project Information:template Live CD 2008 Project - 50 Review - Self Evaluation - A|See&Edit:50% Review/Self-Evaluation (A)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes''' --------- [[Project Information:template Live CD 2008 Project - 50 Review - First Reviewer - C|See&Edit: 50% Review/1st Reviewer (C)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes''' --------- [[Project Information:template Live CD 2008 Project 50 Review Second Review E|See&Edit: 50%Review/2nd Reviewer (E)]]
| style="width:22%; background:#C2C2C2" align="center"|X
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Final Review'''
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes''' --------- Which status has been reached? '''Release Quality''' --------- [[Project Information:template Live CD 2008 Project - Final Review - Self Evaluation - B|See&Edit: Final Review/SelfEvaluation (B)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes''' --------- Which status has been reached? '''Release Quality''' --------- [[Project Information:template Live CD 2008 Project - Final Review - First Reviewer - D|See&Edit: Final Review/1st Reviewer (D)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- Which status has been reached? '''Release Quality''' --------- [[Project Information:template Live CD 2008 Project - Final Review - Second Reviewer - F|See&Edit: Final Review/2nd Reviewer (F)]]
| style="width:22%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes''' --------- Which status has been reached? '''Season of Code''' - (To update) --------- [[Project Information:template Live CD 2008 Project - Final Review - OWASP Board Member - G|See/Edit: Final Review/Board Member (G)]]
|-
|}

Project Information:template Live CD 2008 Project - Final Review - First Reviewer - D

2008-09-15T23:11:46Z

Wirefall:

[[Project Information:template Live CD 2008 Project|Clik here to return to the previous page]].

{| style="width:100%" border="0" align="center"
! colspan="3" align="center" style="background:#4058A0; color:white"|'''FINAL REVIEW'''
|-
| style="width:25%; background:white" align="center"|'''PART I'''
| colspan="2" style="width:75%; background:white" align="left"|
|-
| style="width:25%; background:#7B8ABD" align="center"|
Project Deliveries & Objectives
| colspan="2" style="width:25%; background:#cccccc" align="left"|
[[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|OWASP Live CD 2008 Project's Deliveries & Objectives]]
|-
| style="width:25%; background:#4058A0" align="center"|'''QUESTIONS'''
| colspan="2" style="width:75%; background:#4058A0" align="left"|'''ANSWERS'''
|-
| style="width:25%; background:#7B8ABD" align="center"|
1. At what extent have the project deliveries & objectives been accomplished? Having in consideration [[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|'''the assumed ones''']], please exemplify writing down those of them that haven't been realised.
| colspan="2" style="width:75%; background:#cccccc" align="left"|
The stated goals for this project are:
#Move from Morphix to SLAX (100% complete)
#Get SLAX to have an equal number of tools as had existed in the Live CD 2007 (100% complete)
#Add OWASP branding to SLAX (100% complete)
#Add additional, quality tools (100% complete)
#Document the Live CD, both how it was created and general documentation (100% complete). 
|-
| style="width:25%; background:#7B8ABD" align="center"|
2. At what extent have the project deliveries & objectives been accomplished? Having in consideration [[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|'''the assumed ones''']], please quantify in terms of percentage.
| colspan="2" style="width:75%; background:#cccccc" align="left"|
#Move to SLAX = 100%
#Tool parity with 2007 Live CD = 100%
#OWASP Branding = 100% 
#Additional Tools
##Planning = 100%
##Implementation = 100%
#Documentation
##Planning = 100%
##Implementation = 100%
|-
| style="width:25%; background:#7B8ABD" align="center"|
3. What kind of help is required either from the Reviewers or from the OWASP Community?
| colspan="2" style="width:75%; background:#cccccc" align="left"|
The collection of tools and documentation make this LiveCD a valuable addition to the OWASP security toolset. The ease-of-use and nicities that Matt Tesauro has added, such as on-screen messages to indicate the status of launched applications, will be a welcome addition for new users.
|-
| style="width:25%; background:white" align="center"|'''PART II'''
| colspan="2" style="width:75%; background:white" align="left"|
|-
| style="width:25%; background:#7B8ABD" align="center"|
Assessment Criteria
| colspan="2" style="width:75%; background:#cccccc" align="left"|
[[:Category:OWASP Project Assessment|OWASP Project Assessment Criteria]]
|-
| style="width:25%; background:#4058A0" align="center"|'''QUESTIONS'''
| colspan="2" style="width:75%; background:#4058A0" align="left"|'''ANSWERS'''
|-
| style="width:25%; background:#7B8ABD" align="center"|
1. Having into consideration the [[:Category:OWASP Project Assessment|OWASP Project Assessment Methodology]] which criteria, if any, haven’t been fulfilled in terms of '''Alpha Quality''' status?
| colspan="2" style="width:75%; background:#cccccc" align="left"|
100% complete
|-
| style="width:25%; background:#7B8ABD" align="center"|
2. Having into consideration the [[:Category:OWASP Project Assessment|OWASP Project Assessment Methodology]] which criteria, if any, haven’t been fulfilled in terms of '''Beta Quality''' status?
| colspan="2" style="width:75%; background:#cccccc" align="left"|
100% complete
|-
| style="width:25%; background:#7B8ABD" align="center"|
3. Having into consideration the [[:Category:OWASP Project Assessment|OWASP Project Assessment Methodology]] which criteria, if any, haven’t been fulfilled in terms of '''Release Quality''' status?
| colspan="2" style="width:75%; background:#cccccc" align="left"|
100% complete
|-
| style="width:25%; background:#7B8ABD" align="center"|
4. What kind of help is required either from the Reviewers or from the OWASP Community?
| colspan="2" style="width:75%; background:#cccccc" align="left"|
All recommendations have been made through the active bug tracking application - http://code.google.com/p/owasp-livecd-2008/issues/list
|}

Project Information:template Live CD 2008 Project - 50 Review - First Reviewer - C

2008-06-29T21:51:52Z

Wirefall:

[[Project Information:template Live CD 2008 Project|Click here to return to the previous page]].

{| style="width:100%" border="0" align="center"
! colspan="3" align="center" style="background:#4058A0; color:white"|'''50% REVIEW PROCESS'''
|-
| style="width:25%; background:#7B8ABD" align="center"|
Project Deliveries & Objectives
| colspan="2" style="width:75%; background:#cccccc" align="left"|
[[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|OWASP Live CD 2008 Project's Deliveries & Objectives]]
|-
| style="width:25x%; background:#4058A0" align="center"|'''QUESTIONS'''
| colspan="2" style="width:75%; background:#4058A0" align="left"|'''ANSWERS'''
|-
| style="width:25%; background:#7B8ABD" align="center"|
1. At what extent have the project deliveries & objectives been accomplished? Having in consideration [[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|'''the assumed ones''']], please exemplify writing down those of them that haven't been realised.
| colspan="2" style="width:75%; background:#cccccc" align="left"|
The stated goals for this project are:
#Move from Morphix to SLAX
#Get SLAX to have an equal number of tools as had existed in the Live CD 2007 (updating tools where necessary)
#Add OWASP branding to SLAX
#Add additional, quality tools
#Document the Live CD, both how it was created and general documentation (e.g. OWASP Testing Guide). 
REVIEW
*No problems have been encountered booting and testing the SLAX Live CD on multiple platforms.
*Parity of tools between the Live CD 2007 and Live CD 2008 has been accomplished.
*The look and feel of the Live CD 2008 follows the developers intent of OWASP branding SLAX.
*In discussions with the developer concerning the tools and documentation to be added to the Live CD 2008, the timeline is aggressive, but reasonable.
|-
| style="width:25%; background:#7B8ABD" align="center"|

2. At what extent have the project deliveries & objectives been accomplished? Having in consideration [[OWASP Summer of Code 2008 Applications#OWASP Live CD 2008 Project|'''the assumed ones''']], please quantify in terms of percentage.
| colspan="2" style="width:75%; background:#cccccc" align="left"|
REVIEW
#Move to SLAX = 100%
#Tool parity with 2007 Live CD = 100%
#OWASP Branding = 100% 
#Additional Tools
##Planning = 25%
##Implementation = 0%
#Documentation
##Planning = 25%
##Implementation = 0%
|-
|-
| style="width:25%; background:#7B8ABD" align="center"|

3. Please do use the right hand side column to provide advice and make work suggestions.
| colspan="2" style="width:75%; background:#cccccc" align="left"|
Very good initial effort! Regarding Metasploit and other popular tools that are not web-centric, I agree with the developer. These tools should be made available, but in a ''MISCELLANEOUS'' or ''OTHER'' sub-menu. While the purpose is not to compete with BackTrack and other penetration testing distributions, some tools are ubiquitous enough to be expected on any pentest platform. The focus is still, as it should be, on web application testing. As per our discussions, I concur that the tools listed in the OWASP Testing Guide should receive priority for implementation with additional tools being added on a time/resource/licensing basis.
|}