View source for OWASP Faux Bank Project

=Main=

<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File:Incubator_big.jpg|link=OWASP_Project_Stages#tab=Incubator_Projects]]</div>
[[File:Owaspfauxbanklogo-big.png]]

OWASP Faux Bank is a real-world type system with all 10 of OWASPs top 10 vulnerabilities implemented.
The idea behind this project is to have a website with vulnerabilities that developers can play with an exploit, and then view the source code to see the site is vulnerable. OWASP Faux Bank also features a "secure mode", which prevents exploits, so that developers can also see how these vulnerabilities can be prevented within web applications.

The full source code is available from GitHub at: [http://github.com/thatcoderguy/owasp-faux-bank github.com/thatcoderguy/owasp-faux-bank]

Currently OWASP Faux Bank is written in Classic ASP, but eventually there will also be PHP and .Net versions written, so that developers of these languages can also see how the vulnerabilities work.

OWASP Faux Bank is also running at: [http://www.fauxbank.co.uk www.fauxbank.co.uk] with all of the vulnerabilities implemented.

== Project Leader ==
[mailto:davie.elliott@owasp.org Davie Elliott]

I am a web developer with 11 years commercial experience, currently in a Technical Director position for a small website company. I have an avid interest in security; network and web application development, and have written numerous pieces security software and also trained developers on how to write secure code. I have my own website: [http://www.thatcoderguy.co.uk www.thatcoderguy.co.uk] which also hosts my bi-weekly blog where I write about security and web development.

== Licensing ==
OWASP Faux Bank is free to use. It is licensed under the Apache 2.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== Email List ==
[https://lists.owasp.org/mailman/listinfo/owasp_faux_bank Sign Up!]


=The Vulnerabilities=

This section will be properly fleshed out.
For the moment, the first 5 vulnerabilities can be read about on my blog:

;[http://www.thatcoderguy.co.uk/2014/05/13/is-your-web-application-secure-part-1-cross-site-request-forgery/ Is your web application secure? – Part 1: Cross Site Request Forgery]
;[http://www.thatcoderguy.co.uk/2014/05/20/hacking-websites-part-2-cross-site-scripting/ Hacking Websites – Part 2: Cross Site Scripting]
;[http://www.thatcoderguy.co.uk/2014/05/27/hacking-websites-part-3-broken-authentication-session-management/ Hacking Websites – Part 3: Broken Authentication and Session Management]
;[http://www.thatcoderguy.co.uk/2014/06/17/hacking-websites-part-4-sql-injection-attack/ Hacking Websites – Part 4: SQL Injection Attack]
;[http://www.thatcoderguy.co.uk/2014/07/01/hacking-websites-part-5-missing-function-level-access-control/ Hacking Websites – Part 5: Missing Function Level Access Control]
;[http://www.thatcoderguy.co.uk/2014/09/16/hacking-websites-part-6-unvalidated-redirects-and-forwards/ Hacking Websites – Part 6: Unvalidated Redirects and Forwards]

=Road Map and Getting Involved=

As of 7th July, there are 5 vulnerabilities implemented in the Classic ASP version of OWASP Faux Bank.

The immediate road map for the classic ASP Version is as follows:
;A9 - Using Components with Known Vulnerabilities 
;A6 – Sensitive Data Exposure 
;A5 – Security Misconfiguration 
;A4 – Insecure Direct Object References 

The PHP version is looking to be completed in 2015, and the .Net version will then follow.

If you'd like to get involved, why not [mailto:davie.elliott@owasp.org contact me], or if you'd like to write the PHP or .Net versions (which haven't been started yet), why not just create a fork on GitHub and create your own version and upload it.

=Project About=
{{:Projects/OWASP_Faux_Bank_Page}}  

__NOTOC__ <headertabs /> 

[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]