Guia Tabla de Contenido - Revision history

Benfellows: /* Policy Frameworks */ - two quick translations

2008-02-21T23:05:58Z

‎Policy Frameworks: - two quick translations

Wichers: /* Authorization */

2007-01-26T21:43:20Z

‎Authorization

Wichers: /* Cryptography */

2007-01-26T20:54:07Z

‎Cryptography

Fzipi: /* ¿Qué son las aplicaciones web? */

2006-09-02T18:51:33Z

‎¿Qué son las aplicaciones web?

Fzipi: /* Authentication */

2006-09-02T18:33:52Z

‎Authentication

Fzipi: /* What are web applications? */

2006-09-02T18:27:48Z

‎What are web applications?

Fedevela paysett: /* Acerca del Open Web Application Security Project */

2006-08-17T12:43:51Z

‎Acerca del Open Web Application Security Project

Fedevela paysett: Begin translation

2006-08-17T12:34:20Z

Begin translation

New page

=[[Guía Portada|Portada]]=
#Dedicación
#Derechos de autor y licencia
#Editores
#Autores y críticos
#Historia de revisiones
=[[Acerca del Open Web Application Security Project]]=
#Estructura y licenciamiento
#Participación y pertenencia
#Proyectos
=[[Guía Introducción| Introducción]]=
#Desarrollando aplicaciones seguras
#Mejoras en esta edición
#Como usar la guía
#Actualizaciones y errata
#Agradecimientos
=[[What are web applications?]]=
#Technologies
#First generation – CGI
#Filters
#Scripting
#Web application frameworks – J
#Small to medium scale applications
#Large scale applications
#View
#Controller
#Model
#Conclusion
=[[Policy Frameworks]]=
#Organizational commitment to security
#OWASP’s Place at the Framework table
#Development Methodology
#Coding Standards
#Source Code Control
#Summary
=[[Secure Coding Principles]]=
#Asset Classification
#About attackers
#Core pillars of information security
#Security Architecture
#Security Principles
=[[Threat Risk Modeling]]=
#Threat Risk Modeling
#Performing threat risk modeling using the Microsoft Threat Modeling Process
#Alternative Threat Modeling Systems
#Trike
#AS/NZS
#CVSS
#OCTAVE
#Conclusion
#Further Reading
=[[Handling E-Commerce Payments]]=
#Objectives
#Compliance and Laws
#PCI Compliance
#Handling Credit Cards
#Further Reading
=[[Phishing]]=
#What is phishing?
#User Education
#Make it easy for your users to report scams
#Communicating with customers via e-mail
#Never ask your customers for their secrets
#Fix all your XSS issues
#Do not use pop-ups
#Don’t be framed
#Move your application one link away from your front page
#Enforce local referrers for images and other resources
#Keep the address bar, use SSL, do not use IP addresses
#Don’t be the source of identity theft
#Implement safe-guards within your application
#Monitor unusual account activity
#Get the phishing target servers offline pronto
#Take control of the fraudulent domain name
#Work with law enforcement
#When an attack happens
#Further Reading
=[[Web Services]]=
#Securing Web Services
#Communication security
#Passing credentials
#Ensuring message freshness
#Protecting message integrity
#Protecting message confidentiality
#Access control
#Audit
#Web Services Security Hierarchy
#SOAP
#WS-Security Standard
#WS-Security Building Blocks
#Communication Protection Mechanisms
#Access Control Mechanisms
#Forming Web Service Chains
#Available Implementations
#Problems
#Further Reading
=[[Ajax and Other "Rich" Interface Technologies]]=
#Objective
#Platforms Affected
#Architecture
#Access control: Authentication and Authorization
#Silent transactional authorization
#Untrusted or absent session data
#State management
#Tamper resistance
#Privacy
#Proxy Façade
#SOAP Injection Attacks
#XMLRPC Injection Attacks
#DOM Injection Attacks
#XML Injection Attacks
#JSON (Javascript Object Notation) Injection Attacks
#Encoding safety
#Auditing
#Error Handling
#Accessibility
#Further Reading
=[[Authentication]]=
#Objective
#Environments Affected
#Relevant COBIT Topics
#Best Practices
#Common web authentication techniques
#Strong Authentication
#Federated Authentication
#Client side authentication controls
#Positive Authentication
#Multiple Key Lookups
#Referer Checks
#Browser remembers passwords
#Default accounts
#Choice of usernames
#Change passwords
#Short passwords
#Weak password controls
#Reversible password encryption
#Automated password resets
#Brute Force
#Remember Me
#Idle Timeouts
#Logout
#Account Expiry
#Self registration
#CAPTCHA
#Further Reading
#Authentication
=[[Authorization]]=
#Objectives
#Environments Affected
#Relevant COBIT Topics
#Best Practices
#Best Practices in Action
#Principle of least privilege
#Centralized authorization routines
#Authorization matrix
#Controlling access to protected resources
#Protecting access to static resources
#Reauthorization for high value activities or after idle out
#Time based authorization
#Be cautious of custom authorization controls
#Never implement client-side authorization tokens
#Further Reading
=[[Session Management]]=
#Objective
#Environments Affected
#Relevant COBIT Topics
#Description
#Best practices
#Exposed Session Variables
#Page and Form Tokens
#Weak Session Cryptographic Algorithms
#Session Token Entropy
#Session Time-out
#Regeneration of Session Tokens
#Session Forging/Brute-Forcing Detection and/or Lockout
#Session Token Capture and Session Hijacking
#Session Tokens on Logout
#Session Validation Attacks
#PHP
#Sessions
#Further Reading
#Session Management
=[[Data Validation]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#Description
#Definitions
#Where to include integrity checks
#Where to include validation
#Where to include business rule validation
#Data Validation Strategies
#Prevent parameter tampering
#Hidden fields
#ASP.NET Viewstate
#URL encoding
#HTML encoding
#Encoded strings
#Data Validation and Interpreter Injection
#Delimiter and special characters
#Further Reading
=[[Interpreter Injection]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#User Agent Injection
#HTTP Response Splitting
#SQL Injection
#ORM Injection
#LDAP Injection
#XML Injection
#Code Injection
#Further Reading
#SQL-injection
#Code Injection
#Command injection
=[[Canoncalization, locale and Unicode]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#Description
#Unicode
#http://www.ietf.org/rfc/rfc#
#Input Formats
#Locale assertion
#Double (or n-) encoding
# HTTP Request Smuggling
# Further Reading
=[[Error Handling, Auditing and Logging]]=
#Objective
#Environments Affected
#Relevant COBIT Topics
#Description
#Best practices
#Error Handling
#Detailed error messages
#Logging
#Noise
#Cover Tracks
#False Alarms
#Destruction
#Audit Trails
#Further Reading
#Error Handling and Logging
=[[File System]]=
#Objective
#Environments Affected
#Relevant COBIT Topics
#Description
#Best Practices
#Defacement
#Path traversal
#Insecure permissions
#Insecure Indexing
#Unmapped files
#Temporary files
#PHP
#Includes and Remote files
#File upload
#Old, unreferenced files
#Second Order Injection
#Further Reading
#File System
=[[Distributed Computing]]=
#Objective
#Environments Affected
#Relevant COBIT Topics
#Best Practices
#Race conditions
#Distributed synchronization
#Further Reading
=[[Buffer Overflows]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#Description
#General Prevention Techniques
#Stack Overflow
#Heap Overflow
#Format String
#Unicode Overflow
#Integer Overflow
#Further reading
=[[Administrative Interface]]=
#Objective
#Environments Affected
#Relevant COBIT Topics
#Best practices
#Administrators are not users
#Authentication for high value systems
#Further Reading
=[[Cryptography]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#Description
#Cryptographic Functions
#Cryptographic Algorithms
#Algorithm Selection
#Key Storage
#Insecure transmission of secrets
#Reversible Authentication Tokens
#Safe UUID generation
#Summary
#Further Reading
#Cryptography
=[[Configuration]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#Best Practices
#Default passwords
#Secure connection strings
#Secure network transmission
#Encrypted data
#PHP Configuration
#Global variables
#register_globals
#Database security
#Further Reading
#ColdFusion Components (CFCs)
#Configuration
=[[Software Quality Assurance]]=
#Objective
#Platforms Affected
#Best practices
#Process
#Metrics
#Testing Activities
=[[Deployment]]=
#Objective
#Platforms Affected
#Best Practices
#Release Management
#Secure delivery of code
#Code signing
#Permissions are set to least privilege
#Automated packaging
#Automated deployment
#Automated removal
#No backup or old files
#Unnecessary features are off by default
#Setup log files are clean
#No default accounts
#Easter eggs
#Malicious software
#Further Reading
=[[Maintenance]]=
#Objective
#Platforms Affected
#Relevant COBIT Topics
#Best Practices
#Security Incident Response
#Fix Security Issues Correctly
#Update Notifications
#Regularly check permissions
#Further Reading
#Maintenance
=[[GNU Free Documentation License]]=
#PREAMBLE
#APPLICABILITY AND DEFINITIONS
#VERBATIM COPYING
#COPYING IN QUANTITY
#MODIFICATIONS
#COMBINING DOCUMENTS
#COLLECTIONS OF DOCUMENTS
#AGGREGATION WITH INDEPENDENT WORKS
#TRANSLATION
#TERMINATION
#FUTURE REVISIONS OF THIS LICENSE
=Reference=
[[Category:OWASP_Guide_Project]]

@@ Line 22: / Line 22: @@
 #Scripting
 #Web application frameworks – J
-#Aplicaciones de mediana y gran escala
+#Aplicaciones de pequeña y mediana escala
 #Aplicaciones de gran escala
 #Vista

@@ Line 29: / Line 29: @@
 #Conclusiones
-=[[Policy Frameworks]]=
+=[[Armazón de Reglas]]=
 #Organizational commitment to security
-#OWASP’s Place at the Framework table
+#Lugar de OWASP al mesa de Armazónes
 #Development Methodology
 #Coding Standards
 #Source Code Control
 #Summary
 =[[Secure Coding Principles]]=
 #Asset Classification

@@ Line 148: / Line 148: @@
 #Authentication
-=[[Authorization]]=
+=[[Guide to Authorization]]=
 #Objectives
 #Environments Affected
@@ Line 164: / Line 164: @@
 #Never implement client-side authorization tokens
 #Further Reading
 =[[Session Management]]=
 #Objective

@@ Line 293: / Line 293: @@
 #Authentication for high value systems
 #Further Reading
-=[[Cryptography]]=
+=[[Guide to Cryptography]]=
 #Objective
 #Platforms Affected
@@ Line 308: / Line 308: @@
 #Further Reading
 #Cryptography
 =[[Configuration]]=
 #Objective

@@ Line 118: / Line 118: @@
 #Accessibility
 #Further Reading
-=[[Authentication]]=
+=[[Autenticación]]=
-#Objective
+#Objetivo
-#Environments Affected
+#Entornos afectados
 #Relevant COBIT Topics
 #Best Practices
-#Common web authentication techniques
+#Técnicas comunes de autenticación web
-#Strong Authentication
+#Autenticación fuerte
 #Federated Authentication
-#Client side authentication controls
+#Controles de autenticación del lado del cliente
-#Positive Authentication
+#Autenticación positiva
-#Multiple Key Lookups
+#Búsquedas en claves múltiples
-#Referer Checks
+#Verificaciión del Referer
-#Browser remembers passwords
+#Guardando la clave en el navegador
-#Default accounts
+#Cuentas por defecto
-#Choice of usernames
+#Elección de nombres de usuario
-#Change passwords
+#Cambiar las claves
-#Short passwords
+#Claves cortas
-#Weak password controls
+#Controles de claves débiles
-#Reversible password encryption
+#Encriptación reversible de claves
 #Automated password resets
-#Brute Force
+#Fuerza Bruta
-#Remember Me
+#Recordarme
 #Idle Timeouts
 #Logout
-#Account Expiry
+#Expiración de cuentas
-#Self registration
+#Autoregistro
 #CAPTCHA
 #Further Reading
 #Authentication
 =[[Authorization]]=
 #Objectives

@@ Line 16: / Line 16: @@
 #Actualizaciones y errata
 #Agradecimientos
-=[[What are web applications?]]=
+=[[¿Qué son las aplicaciones web?]]=
-#Technologies
+#Tecnologías
-#First generation – CGI
+#La primera generación – CGI
-#Filters
+#Filtros
 #Scripting
 #Web application frameworks – J
-#Small to medium scale applications
+#Aplicaciones de mediana y gran escala
-#Large scale applications
+#Aplicaciones de gran escala
-#View
+#Vista
-#Controller
+#Controlador
-#Model
+#Modelo
-#Conclusion
+#Conclusiones
 =[[Policy Frameworks]]=
 #Organizational commitment to security

@@ Line 7: / Line 7: @@
 =[[Acerca del Open Web Application Security Project]]=
 #Estructura y licenciamiento
-#Participaci&oacute;n y pertenencia
+#Participaci&oacute;n y afiliaci&oacute;n
 #Proyectos
 =[[Gu&iacute;a Introducci&oacute;n| Introducci&oacute;n]]=
 #Desarrollando aplicaciones seguras