This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

OWASP Secu-RT Project

From OWASP
Jump to: navigation, search
OWASP Project Header.jpg

OWASP Secu-RT Project

The OWASP Secu-RT Project is an attempt to use the JVM itself for taint tracking. This project started by a challenge given to me at Appsec EU conference in Hamburg as I said that it should be possible to do dynamic source-sink analysis in basic Java applications. My challengers then told me: "Prove it". It took a while, but fairly soon I had a simple setup in which I demonstrated simple Log manipulation on the commandline and that it was detectable. This project is the continuation of that proof and is aimed at developers to help them detect security vulnerabilities using live source-sink analysis. It is dependent on the code coverage and not aimed to be used in a production environment.

Description

This project aims to provide an invisible source-sink analyser/taint tracker. It will do this by knowing the various sources and sinks in each JVM language and displays the full trace of a string that entered through a source and exits unmanaged at a sink.

This project is not intended to be used in a production environment, but as an aid in testing the security flow during the QA phase.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of the link GNU Affero General Public License 3.0 as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright © by Steven van der Baan 2014

Project Resources

Source Code

Project Leader

Steven van der Baan

Related Projects

Classifications

Project Type Files CODE.jpg
Incubator Project Owasp-builders-small.png
Owasp-defenders-small.png
Affero General Public License 3.0

News and Events