GSOC2017 Ideas - Revision history

Bernhard Mueller at 07:08, 8 February 2017

2017-02-08T07:08:15Z

Bernhard Mueller at 07:06, 8 February 2017

2017-02-08T07:06:31Z

Sushi2k at 02:15, 8 February 2017

2017-02-08T02:15:39Z

Spyros Gasteratos at 23:50, 5 February 2017

2017-02-05T23:50:33Z

Delta24: /* OWASP OWTF */

2017-02-05T16:16:07Z

‎OWASP OWTF

Delta24: /* OWASP OWTF */

2017-02-04T00:12:45Z

‎OWASP OWTF

Delta24: /* OWASP OWTF */

2017-02-04T00:12:21Z

‎OWASP OWTF

Delta24: /* OWASP OWTF */

2017-02-04T00:11:16Z

‎OWASP OWTF

Delta24: /* OWASP OWTF */

2017-02-04T00:10:36Z

‎OWASP OWTF

Delta24: /* OWASP OWTF */

2017-02-04T00:10:11Z

‎OWASP OWTF

@@ Line 174: / Line 174: @@
 * Browse through the MASVS and check the Reverse Engineering requirements (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x15-V8-Resiliency_Against_Reverse_Engineering_Requirements.md)
 * Check out these wok-in-progress sections in the MSTG and the "obfuscation metrics" project:
 https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05b-Reverse-Engineering-and-Tampering-Android.md
 https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Reverse-Engineering-and-Tampering-iOS.md
 https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05-Testing-Processes-and-Techniques.md#tampering-and-reverse-engineering
 https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05-Testing-Processes-and-Techniques.md#assessing-software-protections
 https://github.com/b-mueller/obfuscation-metrics
 '''Knowledge Prerequisites:'''

@@ Line 149: / Line 149: @@
-=== Creation of Obfuscated Android Apps  ===
+=== Write Mobile Crackmes and De-Obfuscation Guides  ===
 '''Brief Explanation:'''
-As part of the Hacking Playground also the "Resiliency and Reverse Engineering requirements" from the MASVS should be demonstrated. In order to do that several different obfuscation techniques should be applied when creating a production App. The obfuscated code should be analysed and ways should be shown to de-obfuscate the code.
+A key goal of the OWASP Mobile Testing Project is to build the ultimate learning resource and reference guide for mobile app reversers. As hands-on hacking is by far the best way to learn, we want to link most of the content to practical examples. We're therefore planning to add crackmes for Android and iOS to the GitHub repo that will then be used as examples throughout the guide. The goal is to collect enough resources for demonstrating the most important tools and techniques in our guide, plus additional crackmes for practicing.
-The requirements that are in scope can be found here: https://github.com/OWASP/owasp-masvs/blob/master/Document/0x15-V8-Resiliency_Against_Reverse_Engineering_Requirements.md
+In this project, the student creates multiple cracking exercises for Android and documents solutions to these exercises. The new crackmes developed in this project will be added to the existing list at:
 '''Expected Results:'''
@@ Line 161: / Line 169: @@
 * Several Apps that implemented different obfuscation techniques.
 * Evaluation of tools and techniques to de-obfuscate code.
 ''' Getting started: '''
 Here are a few suggestion on how to get started.
 * Browse through the MASVS and check the Reverse Engineering requirements (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x15-V8-Resiliency_Against_Reverse_Engineering_Requirements.md)
-* Read about Obfuscation techniques and best practices for Android to implement them.
+* Check out these wok-in-progress sections in the MSTG and the "obfuscation metrics" project:
 '''Knowledge Prerequisites:'''

← Older revision		Revision as of 02:15, 8 February 2017
Line 145:		Line 145:


−	'''Mentors:''' [mailto:sven.schleier@owasp.org Sven Schleier] - OWASP Mobile Security Testing Guide and Mobile Hacking Playground Project Leader	+	'''Mentors:''' [mailto:sven.schleier@owasp.org Sven Schleier] - OWASP Slack: @sushi2k - OWASP Mobile Security Testing Guide and Mobile Hacking Playground Project Leader
		+
		+
		+
		+	=== Creation of Obfuscated Android Apps ===
		+
		+	'''Brief Explanation:'''
		+
		+	As part of the Hacking Playground also the "Resiliency and Reverse Engineering requirements" from the MASVS should be demonstrated. In order to do that several different obfuscation techniques should be applied when creating a production App. The obfuscated code should be analysed and ways should be shown to de-obfuscate the code.
		+
		+	The requirements that are in scope can be found here: https://github.com/OWASP/owasp-masvs/blob/master/Document/0x15-V8-Resiliency_Against_Reverse_Engineering_Requirements.md
		+
		+	'''Expected Results:'''
		+
		+	* Several Apps that implemented different obfuscation techniques.
		+	* Evaluation of tools and techniques to de-obfuscate code.
		+
		+	As not all requirements can be implemented during the GSOC a subset of them will be defined with the student together.
		+
		+
		+	''' Getting started: '''
		+	Here are a few suggestion on how to get started.
		+	* Browse through the MASVS and check the Reverse Engineering requirements (https://github.com/OWASP/owasp-masvs/blob/master/Document/0x15-V8-Resiliency_Against_Reverse_Engineering_Requirements.md)
		+	* Read about Obfuscation techniques and best practices for Android to implement them.
		+
		+	'''Knowledge Prerequisites:'''
		+	General interest in Obfuscation techniques, Mobile and Security. Basic knowledge of Android and Java.
		+
		+	'''Mentors:''' [mailto:bernhard.mueller@owasp.org Bernhard Mueller] - OWASP Slack: @bernhardm - OWASP Mobile Security Testing Guide and MASVS Project Leader
		+

	== OWASP ZAP ==		== OWASP ZAP ==

← Older revision		Revision as of 23:50, 5 February 2017
Line 644:		Line 644:
	'''OWASP OWTF Mentors:'''		'''OWASP OWTF Mentors:'''
	Contact: [mailto:Abraham.Aranguren@owasp.org Abraham Aranguren][mailto:viyat.bhalodia@owasp.org Viyat Bhalodia][mailto:bharadwaj.machiraju@gmail.com Bharadwaj Machiraju] OWASP OWTF Project Leaders		Contact: [mailto:Abraham.Aranguren@owasp.org Abraham Aranguren][mailto:viyat.bhalodia@owasp.org Viyat Bhalodia][mailto:bharadwaj.machiraju@gmail.com Bharadwaj Machiraju] OWASP OWTF Project Leaders
		+
		+
		+	== OWASP Hackademic Challenges Project ==
		+
		+	[[OWASP Hackademic Challenges Project]] The OWASP Hackademic Challenges project helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controllable and safe environment.
		+
		+	=== New CMS ===
		+
		+	'''Brief Explanation:'''
		+
		+	The CMS part of the project is really old and has accumulated a significant amount of technical debt.
		+	In addition many design decisions are either outdated or could be improved.
		+	Therefore it may be a good idea to leverage the power of modern web frameworks to create a new CMS.
		+	The new cms can be written in python using Django.
		+
		+	'''Expected Results:'''
		+	* New cms with same functionality as the old one (3 types of users -- student, teacher, admin--, 3 types of resources -- article challenge, class--, ACL type permissions, CRUD operations on every resource/user, all functionality can be extended by Plugins.
		+	* REST endpoints in addition to classic ones
		+	* tests covering all routes implemented, also complete ACL unit tests, it would be embarassing if a cms by OWASP has rights vulnerabilities.
		+	* PEP 8 code
		+
		+	''' Note: '''
		+	This is a huge project, it is ok if the student implements a part of it. However whatever implemented must be up to spec.
		+	If you decide to take on this project contact us and we can agree on a list of routes.
		+	If you don't decide to take on this project contact us.
		+	Generally contact us, we like it when students have insightful questions and the community is active
		+
		+
		+	''' Getting Started: '''
		+	* Install and take a brief look around the old cms so you have an idea of the functionality needed
		+	* It's ok to scream in frustration
		+	* If you want to contribute to get a feeling of the platform a good idea would be lettuce tests for the current functionality (which won't change and you can port in the new cms eventually)
		+
		+	'''Knowledge Prerequisites:'''
		+	Python, Django, what REST is, the technologies used, some security knowledge would be nice.
		+
		+	'''Mentors:''' [mailto:spyros.gasteratos@owasp.org Spyros Gasteratos] - Hackademic Challenges Project Leaders
		+
		+	=== Course Type Challenge ===
		+
		+	'''Brief Explanation:'''
		+	We have a sandbox engine which allows for complex guided challenges to be implemented.
		+	We'd like to build a challenge that guides the user through a series of steps to an end goal and teaches more information on the subject matter on the way.
		+	This is a very open-ended project on purpose to allow creative student to come up with nice ideas.
		+	Bellow you will find some examples that we thought might be interesting.
		+
		+	Ideas on the project:
		+	* Purposefully vulnerable web page that guides the user via javascript tooltips and hints to exploiting it using ZAP. ( Bonus: using ZAP via the ZAP api). The challenge is solved when the the student submits the contents of a text file located on the disk (obtained by exploited an RCE)
		+
		+	* Reversing a provided binary to extract information by providing step by step instructions to reversing using any popular reversing tool (well, you can't use IDA so gdb should have to do). Challenge is solved when the keys are extracted from the binary and submitted. Bonus points if each binary donwloaded has different keys.
		+
		+	* Guide to exploiting the TOP10. (Using ZAP?)
		+
		+	* Defensive Type challenges -- Here's how to create a patch for this kind of vulnerability -- Challenge is solved when the unit tests are run and the vulnerability isn't there.
		+
		+	''' Getting started '''
		+	* Check popular javascript guide tools such as: (http://introjs.com/ and http://github.hubspot.com/shepherd/docs/welcome/ )
		+	* If you're more interested in system or non-web challenges check serverspec and definitely check quest (https://github.com/puppetlabs/quest)
		+	* If you think contributing is a good idea to make yourself familiar with the project you can either port one of the existing simpler 1-page challenges to a docker container and submit a pull request or write a guide on how to create such a challenge
		+
		+	'''Expected Results:'''
		+
		+	* One or more Course - style challenges provided either as a docker container or as a vagrant box.
		+	* Concrete documentation on how to build a challenge like this.
		+
		+	'''Knowledge Prerequisites:'''
		+	The technologies used.
		+
		+
		+	'''Mentors:''' [mailto:spyros.gasteratos@owasp.org Spyros Gasteratos] - Hackademic Challenges Project Leaders

@@ Line 514: / Line 514: @@
 == OWASP OWTF ==
-'''[https://github.com/owtf/owtf Offensive Web Testing Framework (OWTF)]''' is a project focused on penetration testing efficiency and alignment of security tests to security standards like the OWASP Testing Guide (v3 and v4), the OWASP Top 10, PTES and NIST. Most of the ideas given below focus on rewrite of some major components of OWTF to make it more modular.
+'''[https://github.com/owtf/owtf Offensive Web Testing Framework (OWTF)]''' is a project focused on penetration testing efficiency and alignment of security tests to security standards like the OWASP Testing Guide (v3 and v4), the OWASP Top 10, PTES and NIST. Most of the ideas below focus on rewrite of some major components of OWTF to make it more modular.
 === OWASP OWTF - MiTM proxy interception and replay capabilities ===
@@ Line 524: / Line 524: @@
 The current implementation of the MiTM proxy serves its purpose very well. Its fast but its not extensible. There are a number of good use cases for being extensible
-* can be to intercept the transactions
+* ability to intercept the transactions
-* modify on the fly or replay transactions
+* modify or replay transaction on the fly
 * add additional capabilities to the proxy (such as session marking/changing) without polluting the main proxy code
 Bonus:
-* Design and implement a proxy plugin (middleware?) architecture so that the plugins can be defined separately and the user can choose what plugins to include dynamically (from the web interface).
+* Design and implement a proxy plugin (middleware) architecture so that the plugins can be defined separately and the user can choose what plugins to include dynamically (from the web interface).
-* Replace the current requester object (based on urllib, urllib2) with one based on the new urllib3 with support for a real headless browser instance. The simple requester as of now which is good for sending HTTP requests. It will be great to also have a headless browser factory inside the requester. The typical flow when requested for an authenticated browser instance (using PhantomJS)
+* Replace the current Requester (based on urllib, urllib2) with a more robust Requester based on the new urllib3 with support for a real headless browser factory. The typical flow when requested for an authenticated browser instance (using PhantomJS)
-* The "Requester" module checks if there is any login parameters provided (i.e creds or script or whatever)
+* The "Requester" module checks if there is any login parameters provided (i.e form-based or script - look at https://github.com/owtf/login-sessions-plugin)
-* Create a browser instance and do the necessary login stuff
+* Create a browser instance and do the necessary login procedure
-* Handle the browser to whosoever asked for it
+* Handle the browser for the URI
 * When called to close the browser, do a clean logout and kill the browser instance.
@@ Line 583: / Line 583: @@
 Contact: [mailto:Abraham.Aranguren@owasp.org Abraham Aranguren][mailto:viyat.bhalodia@owasp.org Viyat Bhalodia][mailto:bharadwaj.machiraju@gmail.com Bharadwaj Machiraju] OWASP OWTF Project Leaders
-=== OWASP OWTF - Distributed plugin architecture ===
+=== OWASP OWTF - Distributed architecture ===
 To be updated soon!