GSoC2013 Ideas - Revision history

Kevin W. Wall: Add a few ESAPI projects for GSoC 2013.

2013-05-01T04:29:03Z

Add a few ESAPI projects for GSoC 2013.

Rcbarnett: /* OWASP ModSecurity CRS - Implement libinjection Code */

2013-04-26T19:08:02Z

‎OWASP ModSecurity CRS - Implement libinjection Code

Johanna Curiel at 10:12, 26 April 2013

2013-04-26T10:12:51Z

Johanna Curiel at 10:11, 26 April 2013

2013-04-26T10:11:36Z

Islam Azeddine Mennouchi at 14:21, 25 April 2013

2013-04-25T14:21:08Z

Spyros Gasteratos at 11:30, 25 April 2013

2013-04-25T11:30:17Z

Breno Silva at 14:04, 22 April 2013

2013-04-22T14:04:10Z

Abraham Aranguren at 16:15, 19 April 2013

2013-04-19T16:15:16Z

Islam Azeddine Mennouchi at 16:15, 18 April 2013

2013-04-18T16:15:23Z

Jcmax: addition of 2 project proposals

2013-04-17T15:33:55Z

addition of 2 project proposals

← Older revision		Revision as of 04:29, 1 May 2013
Line 828:		Line 828:

	'''Mentor:''' [[User:jcmax \|Juan Carlos Calderon]]		'''Mentor:''' [[User:jcmax \|Juan Carlos Calderon]]
		+
		+
		+	=== ESAPI ===
		+	ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.
		+
		+	'''Website''' http://www.esapi.org/
		+
		+	'''Mailing List:''' https://lists.owasp.org/mailman/listinfo/esapi-dev
		+
		+	==== Project 001 - Port ESAPI 2.0.x (Java) to ESAPI .NET ====
		+
		+	'''Brief Explanation:'''
		+
		+	The ESAPI .NET Projects has become outdated and need to be brought up-to-date with the latest ESAPI 2.0 specification.
		+
		+	'''Expected Results:'''
		+
		+	ESAPI .NET with ESAPI 2.x functionality.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	ESAPI 2.0.x is written in Java, so an understanding of the Java programming language is required as well as proficiency in .NET/C#. Additionally, a basic understanding of application security would be desirable.
		+
		+	'''Website''' http://code.google.com/p/owasp-esapi-dotnet/
		+
		+	'''Mentor:''' Kevin Wall - ESAPI Java Project Leader
		+
		+	==== Project 002 - Resolve Bugs for ESAPI 2.1.0 Roadmap ====
		+
		+	'''Brief Explanation:'''
		+
		+	There are several outstanding issues in the ESAPI Bugtracker (http://code.google.com/p/owasp-esapi-java/issues/list) that need to be addressed for the 2.1.0 release.
		+
		+	'''Expected Results:'''
		+
		+	Patches and unit tests to resolve the outstanding ESAPI issues.
		+
		+	'''Knowledge Prerequisistes:'''
		+
		+	Comfortable working in Java, writing unit tests using JUnit and creating patch files using svn.
		+
		+	'''Website''' http://code.google.com/p/owasp-esapi-java/issues/list
		+
		+	'''Mentor:''' Kevin Wall - ESAPI Java Project Leader

← Older revision		Revision as of 19:08, 26 April 2013
Line 412:		Line 412:

	This new version allow organizations to run ModSecurity/OWASP ModSecurity CRS in Java web servers.		This new version allow organizations to run ModSecurity/OWASP ModSecurity CRS in Java web servers.
−
−	~~'''Knowledge Prerequisite:'''~~
−
−	~~C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.~~
−
−	~~'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''~~
−
−	~~=== OWASP ModSecurity CRS - Implement libinjection Code ===~~
−
−	~~'''Brief explanation:''' https://www.modsecurity.org/tracker/browse/MODSEC-327~~
−
−	~~libinjection (https://github.com/client9/libinjection) is a C library that detects SQLi attacks in user input. It is designed to be embedded in existing or new applications:~~
−
−	*Fast > 100k inspections per second
−	*No memory allocation
−	*No threads
−	*Stable memory usage (approximately 500 bytes on stack)
−	*500 lines of C code (plus a few kiobytes of data)
−
−	~~It is based on lexical analysis of SQL and SQLi attempts and does not use regular expressions.~~
−
−	~~'''Expected results:'''~~
−
−	~~The new C code in ModSecurity will allow us to add new SQL Injection detection methods to the OWASP ModSecurity CRS.~~

	'''Knowledge Prerequisite:'''		'''Knowledge Prerequisite:'''

@@ Line 199: / Line 199: @@
 *Be able to Generate reports from the application using the BIRT report engine API.
 *Creation of prototype reports regarding the results output of the Sessions & attacks such as: Alerts, History, Search etc.
-*A new user interface for generating(design/configure) reports which is easy to use and provides the user with a wide range of options using the designer API
+*A new user interface for generating(design/configure) reports which is easy to use and provides the user with a wide range of options using the BIRT designer API
 *Analysis report of the pros-and cons of using BIRT within OWASP ZAP as reporting tool

@@ Line 197: / Line 197: @@
 '''Expected results:'''
 *Be able to Generate reports from the application using the BIRT report engine API.
 *Creation of prototype reports regarding the results output of the Sessions & attacks such as: Alerts, History, Search etc.
-*A new user interface for generating reports which is easy to use and provides the user with a wide range of options.
+*A new user interface for generating(design/configure) reports which is easy to use and provides the user with a wide range of options using the designer API
 The code should be:

@@ Line 305: / Line 305: @@
 A ZAP add-on to help the user in the process of identifying vulnerabilities in his CMS with a :
 * Numeration of the version of the CMS
 * Numeration of Plugins and Components in the CMS

@@ Line 765: / Line 765: @@
-'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
+'''Mentors:''' Konstantinos Papapanagiotou, Spyros Gasteratos - Hackademic Challenges Project Leaders
 === OWASP Hackademic Challenges - Source Code testing environment ===
@@ Line 786: / Line 785: @@
-'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
+'''Mentors:''' Konstantinos Papapanagiotou, Spyros Gasteratos - Hackademic Challenges Project Leaders
 === OWASP Hackademic Challenges - CMS improvements ===
@@ Line 829: / Line 828: @@
-'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
+'''Mentors:''' Konstantinos Papapanagiotou, Spyros Gasteratos - Hackademic Challenges Project Leaders
 ===OWASP ESAPI/Java WAF - Release level===

@@ Line 400: / Line 400: @@
 C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
-'''Mentor: Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
+'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
 === OWASP ModSecurity CRS - Port to Java ===
@@ Line 416: / Line 416: @@
 C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
-'''Mentor: Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
+'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
 === OWASP ModSecurity CRS - Implement libinjection Code ===
@@ Line 440: / Line 440: @@
 C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
-'''Mentor: Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
+'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
 === OWASP ModSecurity CRS - Implement DoS Prevention Code ===
@@ Line 456: / Line 456: @@
 C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
-'''Mentor: Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
+'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
 === OWASP ModSecurity CRS - Create a Positive Learning/Profile Engine ===
@@ Line 472: / Line 472: @@
 C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
-'''Mentor: Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
+'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
 === OWASP ModSecurity CRS - Create an Engine to Detect Application Flow Anomalies ===
@@ Line 488: / Line 488: @@
 C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
-'''Mentor: Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
+'''Mentor: Breno Silva and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''

← Older revision		Revision as of 16:15, 19 April 2013
Line 683:		Line 683:

	As OWASP OWTF grows it makes sense to build custom unit tests to automatically re-test that functionality has not been broken. In this project we would like to create a unit testing framework so that creating OWASP OWTF unit tests is as simple as possible. The goal of this project is to create the Unit Test Framework and as many unit tests as possible to verify OWASP OWTF functionality.		As OWASP OWTF grows it makes sense to build custom unit tests to automatically re-test that functionality has not been broken. In this project we would like to create a unit testing framework so that creating OWASP OWTF unit tests is as simple as possible. The goal of this project is to create the Unit Test Framework and as many unit tests as possible to verify OWASP OWTF functionality.
		+
		+	The Unit Test Framework should be able to:
		+	* Define test categories: For example, "all plugins", "web plugins", "aux plugins", "test framework core", etc. (please see [http://www.slideshare.net/abrahamaranguren/introducing-owasp-owtf-workshop-brucon-2012 this presentation] for more background)
		+	* Allow to regression test isolated plugins (i.e. "only test _this_ plugin")
		+	* Allow to regression test by test categories (i.e. "test only web plugins")
		+	* Allow to regression test everything (i.e. plugins + framework core: "test all")
		+	* Produce meaningful statistics and easy to navigate logs to identify which tests failed and ideally also hints on how to potentially fix the problem where possible
		+	* Allow for easy creation of _new_ unit tests specific to OWASP OWTF
		+	* Allow for easy modification and maintenance of _existing_ unit tests specific to OWASP OWTF
		+	* Perform well so that we can run as many tests as possible in a given period of time
		+	* Potentially leverage the python unittest library: [http://docs.python.org/2/library/unittest.html http://docs.python.org/2/library/unittest.html]

← Older revision		Revision as of 16:15, 18 April 2013
Line 292:		Line 292:

	'''Mentor: Simon Bennetts - OWASP ZAP Project Leader'''		'''Mentor: Simon Bennetts - OWASP ZAP Project Leader'''
		+
		+	===OWASP ZAP: CMS Scanner ===
		+
		+	'''Brief explanation:'''
		+	A Content Management System (CMS) is a computer program that allows publishing, editing and modifying content as well as maintenance from a central interface. Such systems of content management provide procedures to manage workflow in a collaborative environment. These procedures can be manual steps or an automated cascade.
		+
		+	The first content management system (CMS) was announced at the end of the 1990s. This CMS was designed to simplify the complex task of writing numerous versions of code and to make the website development process more flexible. CMS platforms allow users to centralize data editing, publishing and modification on a single back-end interface. CMS platforms are often used as blog software.
		+	in this project we are going to build a ZAP extension for CMS scanning (with enhanced search methdes)
		+
		+
		+	'''Expected results:'''
		+
		+	A ZAP add-on to help the user in the process of identifying vulnerabilities in his CMS with a :
		+	* Numeration of the version of the CMS
		+	* Numeration of Plugins and Components in the CMS
		+	* Enumerating different Vulns. in the core, plugins or templates
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	ZAP is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential.
		+
		+	'''Mentor: Mennouchi Islam Azeddine'''
		+

← Older revision		Revision as of 15:33, 17 April 2013
Line 796:		Line 796:

	'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader		'''Mentor:''' Konstantinos Papapanagiotou - Hackademic Challenges Project Leader
		+
		+	===OWASP ESAPI/Java WAF - Release level===
		+	'''Description:'''
		+	[[OWASP_WAF_Project]] is an embedded WAF based on [[The_ESAPI_Web_Application_Firewall_(ESAPI_WAF)]] Web Application Firewall. Unlike other open source solutions. JAVA WAF works as a java filter and thus integrates with protected application in an natural way. Also, since the WAF is embedded into the application it "travels" with it, this is, migrating a protected application to another environment does not imply reinstallation, reconfiguration or any additional effort that might render the application unprotected at any time after WAF is initially configured.
		+
		+	'''Expected Results:''' ESAPI WAF is beta level and provides good protection as it is. However, some synchronization issues identified, lack of compatibility with any other OWASP tools and massive lack of documentation, made it hard to use. Final result of the project will be a production/release level WAF with massive Unit testing of all functionality, ModSecurity log format, user friendly documentation (including a user guide, examples of protection using WebGoat or Swingset) and proven stability by doing basic performance testing.
		+
		+	'''Knowledge prerequisite:''' Java Web and Java Filter programming, JUnit unit testing. Filter programming is simple so it is not really a prerequisite as could be learned in short time. It is desirable to be familiar with Request and response Wrappers, and mod-security logs.
		+
		+	'''Mentor:''' [[User:jcmax \|Juan Carlos Calderon]]
		+
		+	===OWASP Classic ASP ESAPI rewrite===
		+	'''Description:'''
		+	[[Classic_ASP_Security_Project]] is a port of the famous ESAPI for Java. In particular, Classic ASP version works with ASP.NET port by using Interop. However interop technology is not stable and has many issues like many requirements to work properly, non understandable error messages, unexpected errors and dependencies to third party libraries. Also ASP.NET version of ESAPI is not release level.
		+
		+	25 years later there are still millions of applications on the wild as proven by the massive automated Sql injections targeting Classic ASP pages in later years. An effective solution that does not require complete rewriting of applications is still required.
		+
		+	'''Expected Results:''' A new ESAPI for classic ASP applications that will be based on good old COM+ components or .NET HTTP Modules. This inital version should provide protection against most pervasive issues and thus will include functionality for input validation, output encoding, basic encryption, file and DB based authentication/authorization. If time is left additional ESAPI functionality might be also included. An installation Guide and a comparative of functionality with Java ESAPI. Proper Unit testing for all functionality. No user manual as Java version documentation will be used for that purpose.
		+
		+	'''Knowledge prerequisite:''' Classic ASP, either COM+ (Visual Basic or any C++ COM framework) or ASP.NET HTTP Modules programming. NUnit unit testing. HTTP Module programming is simple so it is not really a prerequisite as could be learned in short time. Experience with JAVA ESAPI is a plus.
		+
		+	'''Mentor:''' [[User:jcmax \|Juan Carlos Calderon]]