GSoC2012 Ideas - Revision history

Abbas Naderi: Added WebGoat relatede projects, namely WebGoatPHP, WebGoat Workshop and WebGoat Contest

2012-04-04T16:00:35Z

Added WebGoat relatede projects, namely WebGoatPHP, WebGoat Workshop and WebGoat Contest

Rcbarnett at 17:37, 26 March 2012

2012-03-26T17:37:29Z

Jack Mannino at 14:00, 21 March 2012

2012-03-21T14:00:35Z

Conpap at 21:05, 18 March 2012

2012-03-18T21:05:53Z

Chris Schmidt at 22:07, 5 March 2012

2012-03-05T22:07:17Z

Fabio.e.cerullo: /* Project 005 - Mavenize the Swingset */

2012-03-04T09:01:37Z

‎Project 005 - Mavenize the Swingset

Fabio.e.cerullo: /* AppSensor */

2012-03-04T08:57:29Z

‎AppSensor

Fabio.e.cerullo: /* AppSensor */

2012-03-04T08:56:03Z

‎AppSensor

John Melton: fixing formatting of appsensor

2012-03-04T05:54:24Z

fixing formatting of appsensor

John Melton: adding appsensor ideas

2012-03-04T05:52:33Z

adding appsensor ideas

← Older revision		Revision as of 16:00, 4 April 2012
Line 492:		Line 492:

	'''Mentor:''' Chris Schmidt - ESAPI Project Leader		'''Mentor:''' Chris Schmidt - ESAPI Project Leader
		+
		+	=== WebGoat ===
		+	The OWASP WebGoat is an intentionally vulnerable web application in Java. It's purpose is to be educational and covers a wide variety of web vulnerabilities and attacks, plus hints and ideas on how to exploit them.
		+
		+	'''Website''' https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
		+
		+	'''Mailing List:''' https://lists.owasp.org/mailman/listinfo/owasp-webgoat
		+
		+	==== Project 001 - WebGoatPHP ====
		+
		+	'''Brief Explanation:'''
		+
		+	WebGoatPHP intends to deliver WebGoat to PHP/MySQL (and other SQLs) platform, which is embraces by numerous developers, and also introduce more recent and common attacks.
		+
		+	'''Expected Results:'''
		+
		+	WebGoatPHP will be a vulnerable application, which provides PHP (and any other web) developers to realize common web threats and security flaws.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	PHP, Subversion, Some TDD
		+
		+	'''Mentor:''' Abbas Naderi - WebGoatPHP Project Leader
		+
		+	==== Project 002 - WebGoat Workshop ====
		+
		+	'''Brief Explanation:'''
		+
		+	This part of WebGoat project intends to deliver workshop functionality to WebGoat, where an instructor could review participants progress and provide them with hints and opportunities, as a means to a successful web application security workshop.
		+
		+	'''Expected Results:'''
		+
		+	WebGoat would be used by numerous people around the globe to increase web application security awareness.
		+
		+	'''Knowledge Prerequisistes:'''
		+
		+	PHP, Subversion
		+
		+	'''Mentor:''' Abbas Naderi - WebGoatPHP Project Leader
		+
		+	==== Project 003 - WebGoat Contest ====
		+
		+	'''Brief Explanation:'''
		+
		+	Taking WebGoat to a new level, WebGoat Contest enables workshop/contest administrator to limit some access, creating a virtual contest environment for web application security, while having some control over the process of contestants.
		+	'''Expected Results:'''
		+
		+	This would encourage the community to add new challenges/scenarios/vulnerabilities to WebGoat so that more contests could be held. It also needs to be considerably Generic so that a one-time experience won't suffice.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	PHP, Subversion, TDD, MVC
		+
		+	'''Mentor:''' Abbas Naderi - WebGoatPHP Project Leader
		+

	=== Hackademic ===		=== Hackademic ===

← Older revision		Revision as of 17:37, 26 March 2012
Line 584:		Line 584:

	'''Mentor:''' Jack Mannino - OWASP Mobile Security Project Lead/GoatDroid Lead		'''Mentor:''' Jack Mannino - OWASP Mobile Security Project Lead/GoatDroid Lead
		+
		+	=== ModSecurity Core Rule Set ===
		+	The OWASP ModSecurity Core Rule Set (CRS) Project provides a base set of attack detection rules for the popular open source web application firewall (http://www.modsecurity.org/).
		+
		+	'''Website:''' https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
		+
		+	'''Mailing List:''' https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
		+
		+	==== Project 001 - Update the Lua port of the PHPIDS Converter Module ====
		+
		+	'''Brief explanation:'''
		+
		+	PHPIDS has an advanced normalization code section called Converter.php which applies counter-evasion methods to obscured attack payloads. We have an initial Lua script that mimics this functionality. We need to have it updated and tested.
		+
		+	'''Expected results:'''
		+
		+	The new Lua script will normalize all payloads in the same manner as the PHPIDS Converter.php code does. It will also employ the Centrifuge generic attack detection logic.
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Lua scripting (http://www.lua.org/) and PHP.
		+
		+	'''Mentor:''' Ryan Barnett - OWASP ModSecurity CRS Project Leader
		+
		+	==== Project 002 - Update the Lua Implementation of AppSensor Detection Points ====
		+
		+	'''Brief explanation:'''
		+
		+	We want to update the existing Lua scripts that implement the various AppSensor Detection Points - http://blog.spiderlabs.com/2011/08/implementing-appsensor-detection-points-in-modsecurity.html.
		+
		+	'''Expected results:'''
		+
		+	The new Lua script will implement more detection points to detect abnormal request attributes.
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Lua scripting (http://www.lua.org/).
		+
		+	'''Mentor:''' Ryan Barnett - OWASP ModSecurity CRS Project Leader
		+
		+	==== Project 003 - Lua Script to Detect Application Flow Anomalies ====
		+
		+	'''Brief explanation:'''
		+
		+	Need a Lua script that can track normal application flow paths (click-flows) for business logic transactions - such as transferring money from accounts. After profiling normal application path flows, we want to then be able to alert to anomalies. This type of logic can help to prevent Banking Trojan attacks.
		+
		+	'''Expected results:'''
		+
		+	The new Lua script will be able to alert on anomalous application flows.
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Lua scripting (http://www.lua.org/).
		+
		+	'''Mentor:''' Ryan Barnett - OWASP ModSecurity CRS Project Leader
		+
		+	==== Project 004 - Lua Script(s) to Identify User/System Trend Anomalies ====
		+
		+	'''Brief explanation:'''
		+
		+	Need Lua scripts to be able to track normal request velocities of user for resources and identify when they are abnormal. The goal of these scripts will be to identify brute force, DoS and CSRF worm propagations.
		+
		+	'''Expected results:'''
		+
		+	The new Lua scripts will monitor normal request usage ranges and alert on anomlies.
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Lua scripting (http://www.lua.org/).
		+
		+	'''Mentor:''' Ryan Barnett - OWASP ModSecurity CRS Project Leader

← Older revision		Revision as of 14:00, 21 March 2012
Line 547:		Line 547:

	'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader		'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
		+
		+	=== GoatDroid ===
		+	The OWASP GoatDroid Project pays homage to the OWASP WebGoat Project. It is a fully self-contained environment for learning more about vulnerabilities and security issues for the Android platform.
		+
		+	'''Website''' https://www.owasp.org/index.php/Projects/OWASP_GoatDroid_Project
		+
		+	==== Project 001 - Develop a Social Commerce Application ====
		+
		+	'''Brief Explanation:'''
		+
		+	The current applications (a location-based social networking app and a banking app) are currently standalone applications. A social commerce application will be used to glue these applications and APIs together in a way that will expose a broader attack surface.
		+
		+	'''Expected Results:'''
		+
		+	Build a mobile application (with holes) that integrates (with even more holes) with the existing applications for payments and sharing via social media. This will require both an Android app and a web service. The existing web service capabilities are implemented in Java using Jersey. While maintaining the same architecture is desirable, developing the web service in a different language or framework is fine as it will provide diversity.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	A solid understanding of Android and web services. Java expertise is desirable, but the ideal candidate can also be experienced with MonoDroid, PhoneGap, or any cross platform framework.
		+
		+	'''Mentor:''' Jack Mannino - OWASP Mobile Security Project Lead/GoatDroid Lead
		+
		+	==== Project 002 - Secure Forks of GoatDroid Apps ====
		+
		+	'''Brief Explanation:'''
		+
		+	Each GoatDroid application is intentionally built to be insecure. While the new lessons and solution guides demonstrate how to solve these problems, the applications themselves do not contain the actual fixes.
		+
		+	'''Expected Results:'''
		+
		+	Develop fixes for each security issue, and create forks of each application that have these fixes applied. These applications will then be included with future distributions of GoatDroid and will be heavily referenced through the solution guides.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	A solid understanding of Android and Java. The candidate should also have some exposure to Jersey and Swing.
		+
		+	'''Mentor:''' Jack Mannino - OWASP Mobile Security Project Lead/GoatDroid Lead

← Older revision		Revision as of 21:05, 18 March 2012
Line 492:		Line 492:

	'''Mentor:''' Chris Schmidt - ESAPI Project Leader		'''Mentor:''' Chris Schmidt - ESAPI Project Leader
		+
		+	=== Hackademic ===
		+	The OWASP Hackademic Challenges Project is an open source project that helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controllable and safe environment. The Hackademic Challenges implement realistic scenarios with known vulnerabilities in a safe, controllable environment. Users can attempt to discover and exploit these vulnerabilities in order to learn important concepts of information security through the attacker's perspective.
		+
		+	'''Website''' https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project
		+
		+	'''Mailing List:''' https://lists.owasp.org/mailman/listinfo/owasp-hackademic-challenges
		+
		+	==== Project 001 - Hackademic Challenges Standardization ====
		+
		+	'''Brief Explanation:'''
		+
		+	The current challenges have been implemented in a rather simple and ad-hoc way by the initial project team so that they work best with the existing joomla front-end. Since then other contributors have expressed interest to contribute new challenges, but also use these challenges with different front-ends.
		+
		+	'''Expected Results:'''
		+
		+	A standard for challenges. The purpose of this standard will be two-fold: Firstly, anyone wishing to submit a challenge will have specific instructions and submitted challenges will be easily checked, audited and added to the platform. Secondly, submitted challenges should be usable in multiple platforms (e.g. joomla, wordpress, drupal, moodle, etc.) with minor adjustments. In addition all relevant documentation (teacher's guide etc.) should be standardized as well.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	HTML, PHP
		+
		+	'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
		+
		+	==== Project 002 - Hackademic Challenges Frontend ====
		+
		+	'''Brief Explanation:'''
		+
		+	Currently the OWASP Hackademic Challenges are based on a Joomla frontend and a MySQL backend that is used for score-keeping and storing user information. This interface needs to be further developed in order to facilitate teacher-student interaction (possibly provide real-time interaction functionality) and even student-student interaction.
		+
		+	'''Expected Results:'''
		+
		+	New, possibly custom, frontend for the challenges that can be easily installed and used.
		+
		+	'''Knowledge Prerequisistes:'''
		+
		+	HTML, PHP
		+
		+	'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
		+
		+	==== Project 003 - Develop new challenges ====
		+
		+	'''Brief Explanation:'''
		+
		+	The challenges that have been implemented so far include: web application challenges covering several vulnerabilities included in the OWASP Top 10, cryptographic challenges, entire virtual machines including several vulnerabilities. New challenges need to be created in order to cover a broader set of vulnerabilities.
		+
		+	'''Expected Results:'''
		+
		+	New challenges
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	Comfortable in PHP, HTML and possibly Java. Good understanding of Application Security and related vulnerabilities.
		+
		+	'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader

← Older revision		Revision as of 22:07, 5 March 2012
Line 405:		Line 405:

	'''Mentor:''' John Melton - OWASP AppSensor Development Leader		'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	=== ESAPI ===
		+	ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.
		+
		+	'''Website''' http://www.esapi.org
		+
		+	'''Mailing List:''' https://lists.owasp.org/mailman/listinfo/esapi-dev
		+
		+	==== Project 001 - Port ESAPI 2.0.x to ESAPI-PHP ====
		+
		+	'''Brief Explanation:'''
		+
		+	The ESAPI-PHP Project has become outdated and needs to be brought up-to-date with the latest ESAPI 2.0 specification.
		+
		+	'''Expected Results:'''
		+
		+	PHP-Library with ESAPI 2.x functionality.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	ESAPI 2.0.x is written in Java, so an understanding of the Java programming language is required as well as proficiency in PHP. Additionally, a basic understanding of application security would be desireable.
		+
		+	'''Mentor:''' Chris Schmidt - ESAPI Project Leader
		+
		+	==== Project 002 - Resolve Bugs for ESAPI 2.1.0 Roadmap ====
		+
		+	'''Brief Explanation:'''
		+
		+	There are several outstanding issues in the ESAPI Bugtracker (http://code.google.com/p/owasp-esapi-java/issues/list) that need to be addressed for the 2.1.0 release.
		+
		+	'''Expected Results:'''
		+
		+	Patches and unit tests to resolve the outstanding ESAPI issues.
		+
		+	'''Knowledge Prerequisistes:'''
		+
		+	Comfortable working in Java, writing unit tests using JUnit and creating patch files using svn.
		+
		+	'''Mentor:''' Chris Schmidt - ESAPI Project Leader / Kevin Wall - ESAPI Java Development Leader
		+
		+	==== Project 003 - Develop Struts2 Components ====
		+
		+	'''Brief Explanation:'''
		+
		+	Struts2 is one of the most widely used Java MVC frameworks, users of ESAPI are regularly looking for pluggable components that they can drop into their application to utilize ESAPI within the context of their application framework. The goal of this task is to create a set of pluggable components that integrate ESAPI into Struts2 to utilize ESAPI Encoders, Validation, and Intrusion Detection with the least amount of manual work and configuration.
		+
		+	'''Expected Results:'''
		+
		+	A standalone project that uses ESAPI Components in a Struts2 add-on.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	A solid understanding of Java and Apache Struts, comfort developing unit tests in JUnit and functional tests using Selenium as well as maintaining a Maven build.
		+
		+	'''Mentor:''' Chris Schmidt - ESAPI Project Leader
		+
		+	==== Project 004 - JSR-303 Bean Validation Provider ====
		+
		+	'''Brief Explanation'''
		+
		+	JSR-303 is a huge step forward in the way that validation is performed. There are currently 2 implementations of the JSR-303 specification - Hibernate-Validator and Apache BVal. Both of these libraries have demonstrated a lack of security driven validation and focused on using Constraints for business validation purposes. There are also key steps missing in the implementations, most notably - canonicalization of data prior to validation. The goal of this task will be to create a proof of concept implementation of the JSR-303 specification that passes all tests in the Java Compatibility Kit and utilizes the ESAPI Validators to implement constraints.
		+
		+	'''Expected Results:'''
		+
		+	A proof of concept implementation of the JSR-303 specification as a standalone JAR
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	Comfortable in Java, especially utilizing advanced JDK5+ features such as Annotations and writing custom annotation processors.
		+
		+	'''Mentor:''' Chris Schmidt - ESAPI Project Leader
		+
		+	==== Project 005 - Mobile Service Provider ====
		+
		+	'''Brief Explanation:'''
		+
		+	The mobile platform continues to grow exponentially and there has been very little movement of exposing security functionality to mobile applications. Creation of a mobile service platform that exposes security controls to mobile applications would make great strides towards providing mobile application developers with the means to write more secure code on mobile clients.
		+
		+	'''Expected Results:'''
		+
		+	A WebService container (Jersey or SOAP) that exposes key controls (output encoding, input validation, secure logging, security policy, access control, authentication) to clients using a simple interface.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	Familiarity with Java and Apache-WS or Jersey. An understanding of the mobile platform would also be extremely useful.
		+
		+	'''Mentor:''' Chris Schmidt - ESAPI Project Leader

← Older revision		Revision as of 09:01, 4 March 2012
Line 226:		Line 226:

	Good knowledge of Java, and Maven are required.		Good knowledge of Java, and Maven are required.
		+
		+	'''Mentor:''' Fabio Cerullo - OWASP ESAPI Swingset Interactive Project Leader
		+
		+	====Project 006 - New Lessons ====
		+
		+	'''Brief explanation:'''
		+
		+	Develop new coding lessons to learn the ESAPI Libraries.
		+
		+	'''Expected results:'''
		+
		+	A new set of interactive coding lessons for students to use.
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Good knowledge of Java, ESAPI, HTML and the Eclipse framework are required.

	'''Mentor:''' Fabio Cerullo - OWASP ESAPI Swingset Interactive Project Leader		'''Mentor:''' Fabio Cerullo - OWASP ESAPI Swingset Interactive Project Leader

← Older revision		Revision as of 08:57, 4 March 2012
Line 274:		Line 274:
	The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into an existing application. Current efforts are underway to create the AppSensor tool which can be utilized by any existing application interested in adding detection and response capabilities.		The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into an existing application. Current efforts are underway to create the AppSensor tool which can be utilized by any existing application interested in adding detection and response capabilities.

		+	'''Website:''' https://www.owasp.org/index.php/OWASP_AppSensor_Project
		+
		+	'''Mailing List:''' https://lists.owasp.org/mailman/listinfo/owasp-appsensor-project

	==== Project 001 - SOAP web service server implementation ====		==== Project 001 - SOAP web service server implementation ====

← Older revision		Revision as of 08:56, 4 March 2012
Line 272:		Line 272:

	=== AppSensor ===		=== AppSensor ===
		+	The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into an existing application. Current efforts are underway to create the AppSensor tool which can be utilized by any existing application interested in adding detection and response capabilities.
		+

	==== Project 001 - SOAP web service server implementation ====		==== Project 001 - SOAP web service server implementation ====

@@ Line 274: / Line 274: @@
 ==== Project 001 - SOAP web service server implementation ====
 '''Brief explanation:'''
 AppSensor is implementing a new service based architecture for the next version. This project would involve implementing a SOAP based web service (based on the WS-I Basic Profile standard) as a front-end to the AppSensor processing engine.
 '''Expected results:'''
 A new SOAP based web service would be produced which provides a front-end to the existing processing core built into AppSensor.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, some knowledge of SOAP-based web services (particularly the WS-I Basic Profile standard) would be useful, but not essential. Finally, basic knowledge of application security would be very helpful.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader
 ==== Project 002 - REST web service server implementation ====
 '''Brief explanation:'''
 AppSensor is implementing a new service based architecture for the next version. This project would involve implementing a REST based web service as a front-end to the AppSensor processing engine.
 '''Expected results:'''
 A new REST based web service would be produced which provides a front-end to the existing processing core built into AppSensor.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, some knowledge of REST-based web services would be useful, but not essential. Finally, basic knowledge of application security would be very helpful.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader
 ==== Project 003 - SOAP/REST web service client implementation ====
 '''Brief explanation:'''
 AppSensor is implementing a new service based architecture for the next version. This project would involve implementing SOAP and REST based web service clients in various languages to communicate to a back-end server that represents the AppSensor core engine.
 '''Expected results:'''
 New SOAP and REST based web service clients would be produced which communicate to a back-end server that represents the AppSensor core engine.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, and the initial client will be for Java, so a good knowledge of this language is recommended. Proficiency in one or more of the following languages would also be beneficial: C#, PHP, Python, Ruby. Additionally, some knowledge of REST and SOAP based web services would be useful, but not essential. Finally, basic knowledge of application security would be very helpful.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader
 ==== Project 004 - Detection Point Implementation Expansion ====
 '''Brief explanation:'''
 AppSensor has documentation outlining around 50 different detection points. We currently have an existing implementation that supports a small handful (5-7) of those. Implementing additional detection points would increase the value of the project.
 '''Expected results:'''
 Implementations of existing detection points would be produced. This could be done in any number of languages.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, and the initial client will be for Java, so a good knowledge of this language is recommended. Proficiency in one or more of the following languages would also be beneficial: C#, PHP, Python, Ruby. Finally, basic knowledge of application security would be very helpful.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader
 ==== Project 005 - Implement new configuration file format ====
 '''Brief explanation:'''
 AppSensor currently uses a properties file format for configuration. A new XML file format is planned. Moving to an XML format would simplify the configuration and make it easier to extend.
 '''Expected results:'''
 A new implementation of the configuration file would be created. An XML file format would be created, along with the code to process that file format, as well as an XSD to validate the file.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, a basic understanding of XML and XSD would be useful, though not required.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader
 ==== Project 006 - Trend Monitoring ====
 '''Brief explanation:'''
 Several of the detection point concepts for AppSensor revolve around the idea of trend monitoring within an application. There is a trivial implementation currently that provides very little utility. An enhanced trend monitoring capability would allow for the implementation of more detection points and expand the capabilities of AppSensor.
 '''Expected results:'''
 A new implementation of the trend monitoring module would be implemented.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, basic knowledge of application security would be very helpful.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader
 ==== Project 007 - Reporting ====
 '''Brief explanation:'''
 AppSensor currently has very weak reporting capabilities. Enhanced reporting would provide users with better insight into the health of the applications being protected by AppSensor
 '''Expected results:'''
 New APIs for reporting would be implemented as SOAP and/or REST based web services. Additionally, a reference implementation of a reporting client UI would be developed.
 '''Knowledge Prerequisite:'''
 AppSensor is written in Java, and the initial client will be for Java, so a good knowledge of this language is recommended. Some knowledge of REST and SOAP based web services would also be useful, but not essential. Additionally, some experience in a modern UI development framework would be beneficial, presumably an RIA style framework. Finally, basic knowledge of application security would be very helpful.
 '''Mentor:''' John Melton - OWASP AppSensor Development Leader

← Older revision		Revision as of 05:52, 4 March 2012
Line 269:		Line 269:

	'''Mentor:''' Arshan Dabirsiaghi - OWASP AntiSamy Project Leader		'''Mentor:''' Arshan Dabirsiaghi - OWASP AntiSamy Project Leader
		+
		+
		+	=== AppSensor ===
		+
		+	==== Project 001 - SOAP web service server implementation ====
		+	'''Brief explanation:'''
		+	AppSensor is implementing a new service based architecture for the next version. This project would involve implementing a SOAP based web service (based on the WS-I Basic Profile standard) as a front-end to the AppSensor processing engine.
		+	'''Expected results:'''
		+	A new SOAP based web service would be produced which provides a front-end to the existing processing core built into AppSensor.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, some knowledge of SOAP-based web services (particularly the WS-I Basic Profile standard) would be useful, but not essential. Finally, basic knowledge of application security would be very helpful.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	==== Project 002 - REST web service server implementation ====
		+	'''Brief explanation:'''
		+	AppSensor is implementing a new service based architecture for the next version. This project would involve implementing a REST based web service as a front-end to the AppSensor processing engine.
		+	'''Expected results:'''
		+	A new REST based web service would be produced which provides a front-end to the existing processing core built into AppSensor.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, some knowledge of REST-based web services would be useful, but not essential. Finally, basic knowledge of application security would be very helpful.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	==== Project 003 - SOAP/REST web service client implementation ====
		+	'''Brief explanation:'''
		+	AppSensor is implementing a new service based architecture for the next version. This project would involve implementing SOAP and REST based web service clients in various languages to communicate to a back-end server that represents the AppSensor core engine.
		+	'''Expected results:'''
		+	New SOAP and REST based web service clients would be produced which communicate to a back-end server that represents the AppSensor core engine.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, and the initial client will be for Java, so a good knowledge of this language is recommended. Proficiency in one or more of the following languages would also be beneficial: C#, PHP, Python, Ruby. Additionally, some knowledge of REST and SOAP based web services would be useful, but not essential. Finally, basic knowledge of application security would be very helpful.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	==== Project 004 - Detection Point Implementation Expansion ====
		+	'''Brief explanation:'''
		+	AppSensor has documentation outlining around 50 different detection points. We currently have an existing implementation that supports a small handful (5-7) of those. Implementing additional detection points would increase the value of the project.
		+	'''Expected results:'''
		+	Implementations of existing detection points would be produced. This could be done in any number of languages.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, and the initial client will be for Java, so a good knowledge of this language is recommended. Proficiency in one or more of the following languages would also be beneficial: C#, PHP, Python, Ruby. Finally, basic knowledge of application security would be very helpful.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	==== Project 005 - Implement new configuration file format ====
		+	'''Brief explanation:'''
		+	AppSensor currently uses a properties file format for configuration. A new XML file format is planned. Moving to an XML format would simplify the configuration and make it easier to extend.
		+	'''Expected results:'''
		+	A new implementation of the configuration file would be created. An XML file format would be created, along with the code to process that file format, as well as an XSD to validate the file.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, a basic understanding of XML and XSD would be useful, though not required.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	==== Project 006 - Trend Monitoring ====
		+	'''Brief explanation:'''
		+	Several of the detection point concepts for AppSensor revolve around the idea of trend monitoring within an application. There is a trivial implementation currently that provides very little utility. An enhanced trend monitoring capability would allow for the implementation of more detection points and expand the capabilities of AppSensor.
		+	'''Expected results:'''
		+	A new implementation of the trend monitoring module would be implemented.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, so a good knowledge of this language is recommended. Additionally, basic knowledge of application security would be very helpful.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader
		+
		+	==== Project 007 - Reporting ====
		+	'''Brief explanation:'''
		+	AppSensor currently has very weak reporting capabilities. Enhanced reporting would provide users with better insight into the health of the applications being protected by AppSensor
		+	'''Expected results:'''
		+	New APIs for reporting would be implemented as SOAP and/or REST based web services. Additionally, a reference implementation of a reporting client UI would be developed.
		+	'''Knowledge Prerequisite:'''
		+	AppSensor is written in Java, and the initial client will be for Java, so a good knowledge of this language is recommended. Some knowledge of REST and SOAP based web services would also be useful, but not essential. Additionally, some experience in a modern UI development framework would be beneficial, presumably an RIA style framework. Finally, basic knowledge of application security would be very helpful.
		+	'''Mentor:''' John Melton - OWASP AppSensor Development Leader