GSoC2014 Ideas - Revision history

Rcbarnett at 14:42, 5 March 2014

2014-03-05T14:42:22Z

Rafael Gil Larios at 04:51, 5 March 2014

2014-03-05T04:51:13Z

Rcbarnett at 14:37, 4 March 2014

2014-03-04T14:37:20Z

Abraham Aranguren at 12:39, 3 March 2014

2014-03-03T12:39:20Z

Abraham Aranguren at 19:43, 28 February 2014

2014-02-28T19:43:40Z

Abraham Aranguren at 19:36, 28 February 2014

2014-02-28T19:36:17Z

Abraham Aranguren at 19:34, 28 February 2014

2014-02-28T19:34:44Z

Abraham Aranguren at 19:32, 28 February 2014

2014-02-28T19:32:36Z

Abraham Aranguren at 19:31, 28 February 2014

2014-02-28T19:31:38Z

Abraham Aranguren at 18:57, 28 February 2014

2014-02-28T18:57:21Z

@@ Line 1: / Line 1: @@
-==OWASP Project Requests==
+=OWASP Project Requests=
 === OWASP Hackademic Challenges - New challenges and Improvements to the existing ones ===
@@ Line 123: / Line 124: @@
 '''Mentors:''' Konstantinos Papapanagiotou, Spyros Gasteratos - Hackademic Challenges Project Leaders
 ===OWASP WebGoatPHP===
 '''Description:'''
@@ Line 136: / Line 138: @@
 '''Mentor:''' [[User:Abbas Naderi|Abbas Naderi]]
 ===OWASP CSRF Guard===
 '''Description:''' [[Cross-Site_Request_Forgery_(CSRF)|CSRF]] is a complicated yet very effective web attack. The most important thing about CSRF is that it's hard to properly defend against it, specially when it comes to Web 2 and AJAX. We have had discussions on means of mitigating CSRF for years at OWASP, and are now ready to develop libraries for it. Many of the key ideas of this library can be found at [http://www.cs.sunysb.edu/~rpelizzi/jcsrf.pdf].
@@ Line 146: / Line 149: @@
 ===OWASP PHP Security Project===
@@ Line 159: / Line 163: @@
 '''Mentor:''' [[User:Abbas Naderi|Abbas Naderi]], Rahul Chaudhary , Johanna Curiel
 ===OWASP RBAC Project===
 '''Description:''' ''For the last 6 years, improper access control has been the issue behind two of the Top Ten lists''.
@@ Line 180: / Line 185: @@
 === OWASP OWTF - Flexible plugin mappings ===
@@ Line 712: / Line 718: @@
 ===OWASP PCI TOOLKIT===
 [[File:Pci-toolkit-items-small.gif]]<br> OWASP PCI toolkit is an Open Source project built using Google Engine App, that will help organizations scope the PCI-DSS requirements for their System Components. The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards.
@@ Line 738: / Line 745: @@
 === OWASP iGoat ===
@@ Line 761: / Line 769: @@
 === [https://www.owasp.org/index.php/ZAP OWASP ZAP] - Advanced access control testing ===
@@ Line 884: / Line 893: @@
 === [https://www.owasp.org/index.php/ESAPI OWASP ESAPI] 2.x - Security Configuration ===
@@ Line 908: / Line 918: @@
 === [https://www.owasp.org/index.php/OWASP_SeraphimDroid_Project OWASP Seraphimdroid Project] ===
@@ Line 925: / Line 936: @@
 === [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity Core Rule Set (CRS)] - ModSecurity Ruby API ===
 '''Brief explanation:'''
@@ Line 1,029: / Line 1,041: @@
 '''Mentor: Felipe Zimmerle Costa and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
 === [https://www.owasp.org/index.php/OWASP_Bywaf_Project OWASP ByWaf (CRS)] - PEP-8 compliant ===

← Older revision		Revision as of 04:51, 5 March 2014
Line 1,028:		Line 1,028:

	'''Mentor: Felipe Zimmerle Costa and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''		'''Mentor: Felipe Zimmerle Costa and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
		+
		+	=== [https://www.owasp.org/index.php/OWASP_Bywaf_Project OWASP ByWaf (CRS)] - PEP-8 compliant ===
		+
		+	'''Brief explanation:'''
		+
		+	Need someone who make our code more pep-8 compliant.
		+
		+	'''Expected results:'''
		+
		+	Get our code with the most common accepted Python convention.
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Advanced level in Python
		+
		+	Knowlage in PEP-8
		+
		+
		+	'''Mentor: Roey Katz and Rafael Gil - OWASP Bywaf Project Leader'''
		+
		+
		+	=== [https://www.owasp.org/index.php/OWASP_Bywaf_Project OWASP ByWaf (CRS)] - Plug-in maker ===
		+
		+	'''Brief explanation:'''
		+
		+	Making some plug-ins for penetration testing, all of them with bywaf's template.
		+
		+	'''Expected results:'''
		+
		+	The following plug-ins are expected:
		+
		+	SQL Injection
		+
		+	Cross Site Scripting
		+
		+	Directory Traversal
		+
		+	WebDav detector
		+
		+	Put detector
		+
		+	Default pages (IIS and Apache)
		+
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Python
		+	OWASP TOP TEN
		+	HTTP and HTML
		+
		+	'''Mentor: Roey Katz and Rafael Gil- OWASP Bywaf Project Leader'''

@@ Line 924: / Line 924: @@
 '''Mentor: [https://www.owasp.org/index.php/User:Nikola_Milosevic Nikola Milosevic] - OWASP Seraphimdroid Project Leader'''
 === OWASP ModSecurity Core Rule Set (CRS) - Create "Sniffer-Mode" ===
 '''Brief explanation:'''
@@ Line 944: / Line 979: @@
-=== OWASP ModSecurity Core Rule Set (CRS) - Implement DoS Prevention Code ===
+=== [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity Core Rule Set (CRS)] - Implement DoS Prevention Code ===
 '''Brief explanation:''' https://github.com/SpiderLabs/ModSecurity/issues/416
@@ Line 960: / Line 995: @@
 '''Mentor: Felipe Zimmerle Costa and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
-=== OWASP ModSecurity Core Rule Set (CRS) - Create a Positive Learning/Profile Engine ===
+=== [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity Core Rule Set (CRS)] - Create a Positive Learning/Profile Engine ===
 '''Brief explanation:''' See this academic/research paper for ideas of the type of learning we are looking for - http://www.cs.ucsb.edu/~vigna/publications/2003_kruegel_vigna_ccs03.pdf
@@ Line 976: / Line 1,011: @@
 '''Mentor: Felipe Zimmerle Costa and Ryan Barnett - OWASP ModSecurity Core Rule Set Project Leader'''
-=== OWASP ModSecurity Core Rule Set (CRS) - Create an Engine to Detect Application Flow Anomalies ===
+=== [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity Core Rule Set (CRS)] - Create an Engine to Detect Application Flow Anomalies ===
 '''Brief explanation:'''

← Older revision		Revision as of 12:39, 3 March 2014
Line 710:		Line 710:

	'''Mentor: Abraham Aranguren - OWASP OWTF Project Leader - Contact: name.surname@owasp.org'''		'''Mentor: Abraham Aranguren - OWASP OWTF Project Leader - Contact: name.surname@owasp.org'''
−
−
−
−
−	~~=== OWASP OWTF - SQL database ===~~
−
−	~~'''Brief explanation:'''~~
−
−	~~OWASP OWTF scans may take a large amount of disk space due to saving information in text files, we would like to add an option to use a SQL database, probably using the sqlalchemy python library.~~
−	* Keep the current text file format as an option
−	* Add a database storage option using the sqlalchemy library
−
−
−	~~For background on OWASP OWTF please see: [https://www.owasp.org/index.php/OWASP_OWTF https://www.owasp.org/index.php/OWASP_OWTF]~~
−
−	~~'''Expected results:'''~~
−
−	* '''IMPORTANT: [http://legacy.python.org/dev/peps/pep-0008/ PEP-8 compliant code] in all modified code and surrounding areas.'''
−	* '''IMPORTANT: [https://github.com/7a/owtf/wiki/Contributor%27s-README OWTF contributor README compliant code]'''
−	* Reliability: Both with the sql database option and the text file options.
−	* Test cases
−	* Good documentation
−
−
−	~~'''Knowledge Prerequisite:'''~~
−
−	~~Python, sqlalchemy experience would be beneficial for this~~
−
−
−	~~'''Mentor: Abraham Aranguren - OWASP OWTF Project Leader - Contact: name.surname@owasp.org'''~~
−
−
−

← Older revision		Revision as of 19:43, 28 February 2014
Line 682:		Line 682:


−	'''IMPORTANT WARNING: This project is considered to be < 2 weeks of effort BUT can be proposed to complement ANOTHER OWTF idea, last weeks of GSoC seems the best moment to start this'''	+	'''IMPORTANT WARNING: This project is considered to be < 2 weeks of effort BUT can be proposed to complement ANOTHER OWTF idea, the last few weeks of GSoC seems the best moment to start this'''

@@ Line 304: / Line 304: @@
 '''LEGAL CLARIFICATION (Just in case!)''':
-The passive online scanner, simply makes OWTF passive testing '''through third party websites''' more accessible to anybody, however it is the user that must 1) click the link manually + 2) do something bad with that afterwards. Therefore this passive online scanner does not do anything illegal [http://www.slideshare.net/abrahamaranguren/legal-and-efficient-web-app-testing-without-permission More information about why this is not illegal here] (recommended reading!)
+The passive online scanner, simply makes OWTF passive testing '''through third party websites''' more accessible to anybody, however it is the user that must 1) click the link manually + 2) do something bad with that afterwards + 3) doing 1 + 2 WITHOUT permission :). Therefore this passive online scanner does not do anything illegal [http://www.slideshare.net/abrahamaranguren/legal-and-efficient-web-app-testing-without-permission More information about why this is not illegal here] (recommended reading!)
 The thought here is to have a script that does something like:

@@ Line 338: / Line 338: @@
 '''Expected results:'''
 * High performance
 * Reliability
@@ Line 430: / Line 432: @@
 '''Expected results:'''
 * High performance
 * Reliability
@@ Line 500: / Line 504: @@
 '''Expected results:'''
 * High performance
 * Reliability
@@ Line 553: / Line 559: @@
 '''Expected results:'''
 * High performance
 * Reliability
@@ Line 600: / Line 608: @@
 '''Expected results:'''
 * High performance
 * Reliability
@@ Line 654: / Line 664: @@
 '''Expected results:'''
 * Performant and automated regression testing
 * Unit tests for a wide coverage of OWASP OWTF, ideally leveraging the Unit Test Framework where possible
@@ Line 685: / Line 697: @@
 '''Expected results:'''
 * Performant and reliable OWASP OWTF execution on multiple python versions, in particular the latest python version (i.e. 3.3.x) as well as the previous 2.6.5-2.7.3 range.
 * Test cases
@@ Line 713: / Line 727: @@
 '''Expected results:'''
 * Reliability: Both with the sql database option and the text file options.
 * Test cases

@@ Line 234: / Line 234: @@
 '''Expected results:'''
-* [http://legacy.python.org/dev/peps/pep-0008/ PEP-8 compliant code]
+* '''IMPORTANT: [http://legacy.python.org/dev/peps/pep-0008/ PEP-8 compliant code] in all modified code and surrounding areas.'''
-* [https://github.com/7a/owtf/wiki/Contributor%27s-README OWTF contributor README compliant code]
+* '''IMPORTANT: [https://github.com/7a/owtf/wiki/Contributor%27s-README OWTF contributor README compliant code]'''
 * High performance
 * Reliability

← Older revision		Revision as of 18:57, 28 February 2014
Line 668:		Line 668:


−	'''IMPORTANT WARNING: This project is considered to be < 2 weeks of effort BUT can be proposed to complement ANOTHER OWTF idea, ~~end~~ of GSoC seems the best moment to start this'''	+	'''IMPORTANT WARNING: This project is considered to be < 2 weeks of effort BUT can be proposed to complement ANOTHER OWTF idea, last weeks of GSoC seems the best moment to start this'''