Category:OWASP AppSensor Project - Revision history

Paulo Coimbra: Replaced content with '#REDIRECT OWASP AppSensor Project'

2010-10-06T16:35:29Z

Replaced content with '#REDIRECT OWASP AppSensor Project'

Show changes

Paulo Coimbra: Redirected page to OWASP AppSensor Project

2010-10-06T16:33:57Z

Redirected page to OWASP AppSensor Project

MichaelCoates at 17:28, 16 September 2010

2010-09-16T17:28:10Z

MichaelCoates at 23:00, 11 September 2010

2010-09-11T23:00:49Z

Clerkendweller: Detection point list on 'Detection Points' tab updated to match full details page / Recent presentations added to 'Media' tab

2010-08-27T18:49:31Z

Detection point list on 'Detection Points' tab updated to match full details page / Recent presentations added to 'Media' tab

MichaelCoates at 16:58, 28 June 2010

2010-06-28T16:58:29Z

MichaelCoates at 03:52, 9 April 2010

2010-04-09T03:52:21Z

MichaelCoates at 22:34, 28 January 2010

2010-01-28T22:34:34Z

MichaelCoates at 22:33, 28 January 2010

2010-01-28T22:33:37Z

MichaelCoates at 22:31, 28 January 2010

2010-01-28T22:31:45Z

← Older revision		Revision as of 16:33, 6 October 2010
Line 1:		Line 1:
		+	#REDIRECT [[OWASP AppSensor Project]]
		+
	{{OWASP Book\|5984542}}		{{OWASP Book\|5984542}}

@@ Line 34: / Line 34: @@
 Proj_Mail=
-AppSensor-Tutorial [http://code.google.com/p/appsensor/source/browse/trunk/AppSensor-Tutorial/?r=71 Now Available]!
+AppSensor-Tutorial [http://code.google.com/p/appsensor/source/browse/trunk/AppSensor-Tutorial/ Now Available]!
 AppSensor Presented at AppSecUSA
@@ Line 41: / Line 41: @@
 ==== Project Roadmap  ====
-'''July, 2010''' - Active ESAPI Integration Underway!
+'''September, 2010''' - Presented at AppSecUSA [http://www.slideshare.net/michael_coates/real-time-application-defenses-the-reality-of-appsensor-esapi-5181743 slides]
 '''November, 2009''' [http://www.owasp.org/images/0/06/Defend_Yourself-Integrating_Real_Time_Defenses_into_Online_Applications-Michael_Coates.pdf OWASP DC, November 2009]

← Older revision		Revision as of 23:00, 11 September 2010
Line 33:		Line 33:

	Proj_Mail=		Proj_Mail=
−	~~'''Next Presentation:''' [http://www.owasp.org/index.php/Defend_Yourself:_Integrating_Real_Time_Defenses_into_Online_Applications OWASP AppSec DC] - Thursday, November 12, 2009~~

−	~~'''Demo~~:~~''' The~~ AppSensor ~~project will soon be releasing a working demo. This web application will include a working example of the~~ AppSensor ~~detection points integrated with ESAPI. Stay tuned for more.~~	+	AppSensor-Tutorial [http://code.google.com/p/appsensor/source/browse/trunk/AppSensor-Tutorial/?r=71 Now Available]!
		+
		+	AppSensor Presented at AppSecUSA

@@ Line 82: / Line 82: @@
 FIO - File IO
 UT - User Trend
 STE - System Trend
@@ Line 92: / Line 96: @@
 ID Event
-RE1 Unexpected HTTP Commands
+RE1 Unexpected HTTP Command
-RE2 Attempts To Invoke Unsupported HTTP Methods
+RE2 Attempt to Invoke Unsupported HTTP Method
 RE3 GET When Expecting POST
 RE4 POST When Expecting GET
 AE1 Use Of Multiple Usernames
@@ Line 104: / Line 112: @@
 AE2 Multiple Failed Passwords
-AE3 High Rate Of Login Attempts
+AE3 High Rate of Login Attempts
-AE4 Unexpected Quantity Of Characters In Username
+AE4 Unexpected Quantity of Characters in Username
-AE5 Unexpected Quantity Of Characters In Password
+AE5 Unexpected Quantity of Characters in Password
-AE6 Unexpected Types Of Characters In Username
+AE6 Unexpected Type of Character in Username
-AE7 Unexpected Types Of Characters In Password
+AE7 Unexpected Type of Character in Password
-AE8 Providing Only The Username
+AE8 Providing Only the Username
-AE9 Providing Only The Password
+AE9 Providing Only the Password
-AE10 Adding Additional POST Variables
+AE10 Adding POST Variable
-AE11 Removing POST Variables
+AE11 Missing POST Variable
-SE1 Modifying Existing Cookies
+AE12 Utilization of Common Usernames
-SE2 Adding New Cookies
+SE1 Modifying Existing Cookie
-SE3 Deleting Existing Cookies
+SE2 Adding New Cookie
-SE4 Substituting Another User's Valid Session ID Or Cookie
+SE3 Deleting Existing Cookie
 SE5 Source IP Address Changes During Session
@@ Line 134: / Line 144: @@
 SE6 Change Of User Agent Mid Session
-ACE1 Modifying URL Arguments Within A GET For Direct Object Access Attempts
+ACE1 Modifying URL Argument Within a GET for Direct Object Access Attempt
-ACE2 Modifying Parameters Within A POST For Direct Object Access Attempts
+ACE2 Modifying Parameter Within a POST for Direct Object Access Attempt
-ACE3 Force Browsing Attempts
+ACE3 Force Browsing Attempt
-ACE4 Evading Presentation Access Control Through Custom Posts
+ACE4 Evading Presentation Access Control Through Custom POST
 IE1 Cross Site Scripting Attempt
-IE2 Violations Of Implemented White Lists
+IE2 Violation of Implemented White Lists
-EE1 Double Encoded Characters
+IE3 Violation Of Implemented Black Lists
 EE2 Unexpected Encoding Used
-CIE1 Blacklist Inspection For Common SQL Injection Values
+CIE1 Blacklist Inspection for Common SQL Injection Values
-CIE2 Detect Abnormal Quantity Of Returned Records.
+CIE2 Detect Abnormal Quantity of Returned Records
-CIE3 Null Byte Character In File Request
+CIE3 Null Byte Character in File Request
-CIE4 Carriage Return Or Line Feed Character In File Request
+CIE4 Carriage Return or Line Feed Character In File Request
-FIO1 Detect Large Individual Files
+FIO1 Detect Large Individual File
-FIO2 Detect Large Number Of File Uploads
+FIO2 Detect Large Number of File Uploads
 '''Behavior Based Events'''<br>
-UT1 Irregular Use Of Application
+UT1 Irregular Use of Application
-UT2 Speed Of Application Use
+UT4 Frequency of Feature Use
-UT3 Frequency Of Site Use
+STE1 High Number of Logouts Across The Site
-UT4 Frequency Of Feature Use
+STE2 High Number of Logins Across The Site
-STE1 High Number Of Logouts Across The Site
+STE3 High Number of Same Transaction Across The Site
-STE2 High Number Of Logins Across The Site
+RP1 Suspicious or Disallowed User IP Address
-STE3 High Number Of Same Transaction Across The Site
+RP2 Suspicious External User Behavior
 ==== Media  ====
 November, 2009 -  AppSec DC - [http://www.owasp.org/images/0/06/Defend_Yourself-Integrating_Real_Time_Defenses_into_Online_Applications-Michael_Coates.pdf Defend Yourself: Integrating Real Time Defenses into Online Applications]

← Older revision		Revision as of 16:58, 28 June 2010
Line 39:		Line 39:

	==== Project Roadmap ====		==== Project Roadmap ====
		+
		+	'''July, 2010''' - Active ESAPI Integration Underway!

	'''November, 2009''' [http://www.owasp.org/images/0/06/Defend_Yourself-Integrating_Real_Time_Defenses_into_Online_Applications-Michael_Coates.pdf OWASP DC, November 2009]		'''November, 2009''' [http://www.owasp.org/images/0/06/Defend_Yourself-Integrating_Real_Time_Defenses_into_Online_Applications-Michael_Coates.pdf OWASP DC, November 2009]

@@ Line 57: / Line 57: @@
 ==== Detection Points  ====
 Below are the primary detection points defined within AppSensor. These are just the titles; the document contains descriptions, examples and considerations for implementing these detection points.
 '''Legend:'''

@@ Line 59: / Line 59: @@
 Below are the primary detection points defined within AppSensor. These are just the titles; the document contains descriptions, examples and considerations for implementing these detection points.
 '''Signature Based Events'''
@@ Line 150: / Line 173: @@
 STE3 High Number Of Same Transaction Across The Site