Netherlands Previous Events 2009 - Revision history

Favroom at 10:57, 28 January 2010

2010-01-28T10:57:15Z

Favroom at 10:52, 28 January 2010

2010-01-28T10:52:16Z

Favroom at 10:49, 28 January 2010

2010-01-28T10:49:54Z

Favroom at 10:48, 28 January 2010

2010-01-28T10:48:58Z

Favroom at 10:42, 28 January 2010

2010-01-28T10:42:35Z

Martinknobloch at 08:56, 28 January 2010

2010-01-28T08:56:59Z

Favroom at 20:32, 15 January 2010

2010-01-15T20:32:08Z

Favroom at 20:29, 15 January 2010

2010-01-15T20:29:39Z

Show changes

Favroom at 20:23, 15 January 2010

2010-01-15T20:23:01Z

Show changes

Martinknobloch at 22:36, 11 January 2010

2010-01-11T22:36:24Z

← Older revision		Revision as of 10:57, 28 January 2010
Line 268:		Line 268:

	Great stuff as you can see! We hope to see you on our next Chapter meeting...		Great stuff as you can see! We hope to see you on our next Chapter meeting...
		+	<br> <br>
		+
		+	----

	=== Meeting minutes September 24th 2009 ===		=== Meeting minutes September 24th 2009 ===

@@ Line 261: / Line 261: @@
 === Meeting minutes December 10th 2009<br>  ===
-At December 10th 2009, the Dutch OWASP chapter met in Doorn. The sponsor of the evening was ps_testware. The subject of the evening was Secure Development. There were 4 speakers planned, but only one showed up. Other were sick or were having travel difficulties. Due to bad weather and extremely long traffic jams, only 8 attendees joined us in two great presentations.<br>
+At December 10th 2009, the Dutch OWASP chapter met in Doorn. The sponsor of the evening was ps_testware. The subject of the evening was Secure Software Development. There were 4 speakers planned, but only one showed up. The others were sick or having travel difficulties. Due to bad weather and extremely long traffic jams, only 8 attendees joined us in two great presentations.<br>
 Adar Weidman presented his research on Regular Expressions Denial of Service. The presentation can be downloaden from [http://www.owasp.org/images/3/38/20091210_VAC-REGEX_DOS-Adar_Weidman.pdf here].
@@ Line 267: / Line 267: @@
 Martin Knobloch filled in the slot that was left and talked about several OWASP&nbsp;projects.
-Great stuff as you can see! We hope to see you on our next Chapter meeting
+Great stuff as you can see! We hope to see you on our next Chapter meeting...
 === Meeting minutes September 24th 2009  ===

@@ Line 263: / Line 263: @@
 At December 10th 2009, the Dutch OWASP chapter met in Doorn. The sponsor of the evening was ps_testware. The subject of the evening was Secure Development. There were 4 speakers planned, but only one showed up. Other were sick or were having travel difficulties. Due to bad weather and extremely long traffic jams, only 8 attendees joined us in two great presentations.<br>
-Adar Weidman presented his research on Regular Expressions Denial of Service. The presentation can be downloaden from [[20091210_VAC-REGEX_DOS-Adar_Weidman.pdf|here]].
+Adar Weidman presented his research on Regular Expressions Denial of Service. The presentation can be downloaden from [http://www.owasp.org/images/3/38/20091210_VAC-REGEX_DOS-Adar_Weidman.pdf here].
 Martin Knobloch filled in the slot that was left and talked about several OWASP&nbsp;projects.

@@ Line 259: / Line 259: @@
 ==== Chapter Meeting Minutes  ====
-=== Meeting minutes December 10th 2009<br> ===
+=== Meeting minutes December 10th 2009<br>  ===
 At December 10th 2009, the Dutch OWASP chapter met in Doorn. The sponsor of the evening was ps_testware. The subject of the evening was Secure Development. There were 4 speakers planned, but only one showed up. Other were sick or were having travel difficulties. Due to bad weather and extremely long traffic jams, only 8 attendees joined us in two great presentations.<br>
-Adar Weidman presented his research on Regular Expressions Denial of Service. The presentation can be downloaden from here.
+Adar Weidman presented his research on Regular Expressions Denial of Service. The presentation can be downloaden from [[20091210_VAC-REGEX_DOS-Adar_Weidman.pdf|here]].
 Martin Knobloch filled in the slot that was left and talked about several OWASP&nbsp;projects.
 Great stuff as you can see! We hope to see you on our next Chapter meeting

← Older revision		Revision as of 10:42, 28 January 2010
Line 258:		Line 258:

	==== Chapter Meeting Minutes ====		==== Chapter Meeting Minutes ====
		+
		+	=== Meeting minutes December 10th 2009<br> ===
		+
		+	At December 10th 2009, the Dutch OWASP chapter met in Doorn. The sponsor of the evening was ps_testware. The subject of the evening was Secure Development. There were 4 speakers planned, but only one showed up. Other were sick or were having travel difficulties. Due to bad weather and extremely long traffic jams, only 8 attendees joined us in two great presentations.<br>
		+
		+	Adar Weidman presented his research on Regular Expressions Denial of Service. The presentation can be downloaden from here.
		+
		+	Martin Knobloch filled in the slot that was left and talked about several OWASP projects.
		+
		+	Great stuff as you can see! We hope to see you on our next Chapter meeting

	=== Meeting minutes September 24th 2009 ===		=== Meeting minutes September 24th 2009 ===

← Older revision		Revision as of 08:56, 28 January 2010
Line 106:		Line 106:

	'''20. 00 – 20.30 VAC REGEX Denial of Service Attacks''' '''(Adar Weidman, Senior Developer Checkmarx Ltd.)'''<br>		'''20. 00 – 20.30 VAC REGEX Denial of Service Attacks''' '''(Adar Weidman, Senior Developer Checkmarx Ltd.)'''<br>
		+	([[Media:20091210_VAC-REGEX_DOS-Adar_Weidman.pdf]])

	This presentation explores the Regular Expression Denial of Service (ReDoS) attack and how it be used in order to implement new and old attacks. ReDoS is commonly known as a “bug” in systems, but the presentation will show how serious it is and how using this technique, various applications can be “ReDoSed”. These include, among others, Web Application, WAFs, IDS, AV, Web Servers, Client-side browsers (including cellular devices), and Database.<br>		This presentation explores the Regular Expression Denial of Service (ReDoS) attack and how it be used in order to implement new and old attacks. ReDoS is commonly known as a “bug” in systems, but the presentation will show how serious it is and how using this technique, various applications can be “ReDoSed”. These include, among others, Web Application, WAFs, IDS, AV, Web Servers, Client-side browsers (including cellular devices), and Database.<br>

@@ Line 179: / Line 179: @@
 '''21.00 – 21:30 Discussion, questions and social networking'''<br>
 === Meeting Schedule May 28th 2009: AppSec Europe 2009  ===
@@ Line 252: / Line 254: @@
 Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.
 The flyer of this meeting: [[Media:Owasp_NL_april2009.pdf]]
 === Meeting minutes September 24th 2009  ===
@@ Line 274: / Line 275: @@
 ----
   __NOTOC__ <headertabs />

@@ Line 69: / Line 69: @@
 <br>
-== Meeting Schedule December 10th 2009: Secure Software Development, Testing, Deployment and Methodologies<br>  ==
+== OWASP NL Chapter Meetings 2009 ==
 '''Summary:''' The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions.<br>
@@ Line 114: / Line 115: @@
 '''21.00 – 21:30 Discussion, questions and social networking'''
+----
+=== Meeting minutes September 24th 2009 ===
 At September 24th 2009, the Dutch OWASP chapter met in Eindhoven. The sponsor of the evening was Madison Gurkha. The subject of the evening was Unautorized Access. There were 4 speakers and 21 attendees.<br/>
@@ Line 136: / Line 136: @@
 To improve the quality and progress of this project, contributors are needed on all areas. Therefore everybody is encouraged to take a look at the project Wiki and invited to help make the (virtual) world a better and safer place!<br/>
 <br/>
+----
-== Meeting Schedule September 24th 2009: Unautorized Access<br>  ==
+=== Meeting Schedule September 24th 2009: Unautorized Access<br>  ===
 '''Summary:''' The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions.<br>
@@ Line 191: / Line 191: @@
 ----
-== Meeting minutes May 28th 2009  ==
+=== Meeting minutes May 28th 2009  ===
 At May 28th, the Dutch OWASP chapter came together at the ASR building in Amersfoort. The main topic of the evening was AppSec 2009. There were 2 speakers and approximately 20 attendees.<br> <br> There was no sponsor talk or general announcement so after a very short welcome talk by Bert the evening started.<br> <br> '''First presentation:''' AppSec 2009 by Sebastien Deleersnyder. <br> The first presentation of the evening was a recap of AppSec 2009 in Poland. The conference was a big success with around 170 attendees. The meeting preceded the 2009 edition of Confidence [http://2009.confidence.org.pl/] resulting in a week of security presentations and workshops. All AppSec presentations and many movies, pictures, and other material can be found on the AppSec wiki [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2009_-_Poland] but a few items are worth mentioning in specific. First of all OWASP is growing and changing. These changes include a simplification of the membership fees, the introduction of a 'code of ethics', and a general review of all 120 projects. Other highlights are the project ASVS, which has reached an international standard status and updated versions of WebGoat and LabRat.<br> Lastly besides a Wiki and a LinkedIn group, OWASP is now also active on Twitter [http://twitter.com/owasp] &amp; [http://twitter.com/owasp_nl] and has two overview pages with all video [http://www.owasp.org/index.php/Category:OWASP_Video] and audio materials [http://www.owasp.org/index.php/OWASP_Podcast].<br> Feel free to use all the materials (as long as you abide by the new code of ethics off course) and visit the OWASP websites frequently for updates&nbsp;!<br> <br> '''Second presentation:''' VAC Cross-Site Request Forgery by Niels Teusink. <br> After succesfull VAC's about SQL injection and Cross-site scripting, the topic of this evening's VAC was Cross-site Request Forgery, also known as CSRF. CSRF is probably one of the least understood vulnerabilities, but can have tremendous consequences when succesfully exploited. In essence it is an attack that misuses the victim's autorisations with malicious scripts. CSRF attacks can also be easily combined with other attack, like e.g. XSS, making them even more dangerous. <br> Despite the name suggests, these attacks do not have to be on different websites (domains). With the continuing trend to combine multiple functionalities in a single application, so-called onsite request forgeries are becoming more and more frequent. Contrary to XSS and SQL injection, CSRF can not be blocked by input validation. In order to prevent these kind of attacks, an application has to able to verify the authenticity of a request. This can be achieved by several methods like using a unique identifier for a session or each request or requiring additional user input like a CAPTCHA or a one-time token. <br> <br> '''Open Discussion''' <br> The evening was closed with an open discussion about how to improve knowledge sharing among the OWASP members. Many interesting discussions start during the drinks after the presentations on the OWASP evenings, discussions that sadly often are stopped prematurly due to time restraints.<br> As an addition on the quarterly presentation evenings, the Dutch chapter decided to also start mini-meetings and the OWASP cafe.<br> Mini-meetings will not be planned on beforehand, but instead will be planned when a topic is proposed and enough attendees have stated an interest in the topic. The attendees will have to select a location themselves but can request a donation from the OWASP for drinks and snacks. Topics discussed at the mini-meeting will have to be listed in minutes so other members can also profit from this knowledge exchange.<br> The OWASP cafe will be planned each first thursday of the month on a location that will be listed on the OWASP Dutch chapter site. The rules are simple: the evening starts at a certain time, ends at a certain time and will be filled with drinks, snacks, and nerd/hacker/geek humor and discussions in between.<br> Check the website frequently for the location of the next mini-meeting and OWASP cafe&nbsp;!<br> <br>
-== Meeting Schedule May 28th 2009: AppSec Europe 2009  ==
+----
 '''Summary''' The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees.
@@ Line 231: / Line 232: @@
+----
-== Meeting minutes April 9th 2009  ==
+=== Meeting minutes April 9th 2009  ===
 At April 9th, the Dutch OWASP chapter came together at the office of Sogeti in Vianen. The main topic of the evening was "knowing your enemy". There were 3 speakers and approximately 50 attendees.<br> <br> The sponsor of the evening started with a small welcome and an overview of their internal security program named PASS. After some small announcements from the OWASP the evening started.<br> <br> '''First presentation:''' Modern information gathering; how to abuse search engines by Dave van Stein.<br> The first presentation of the evening was about using search engines and crawlers to gain detailed information about webservers and websites. Ill configured webservers allow search engine crawlers to collect much information about a system, information that is stored and can be retrieved with search engines. Many websites and tools make use of this mechanism and, combined with DNS and WHOIS information, are able to provide detailed or sensitive information like usernames, vulnerabilities, present files or network topology about a system without targeting it directly.<br> Restricting crawlers to access a system can act as a first line of defence and reduce exposure and risks.<br> <br> '''Second presentation:''' VAC Cross-site scripting by Martin Visser. <br> The second VAC on an OWASP meeting was about Cross-site scripting also known as XSS. XSS vulnerabilities are often misunderstood and underestimated but facts show that XSS vulnerability abusing attacks are nowadys the fastest growing and most widespread type of exploit. In short XSS vulnerabilities allow for user input to be executed when containing javascript or HTML code. When combined with other vulnerabilities the possibilities of these attacks are vitually limitless.<br> The only way to prevent these attacks is to sanitize all input and output fields, but this can be more difficult than it appears to be. Simply blacklisting fragments like &lt;script&gt; is not sufficient due to the possibility of recursivity (e.g. &lt;scr&lt;script&gt;ipt&gt;) and encoding (e.g. URL encoding:&nbsp;%3C%73%63%72%69%70%74%3E). Using multiple layers of filters on various places is the only way to assure enough protection against these types of attacks.<br> <br> '''Third presentation:''' Beveiligingsaspecten van webapplicatie-ontwikkeling by Wouter van Kuipers. <br> The third presentation of the evening was about the efficiency of a source code analyer for php based websites. Approximately 33% of all websites use php and this can be explained by the low learning curve and ease of use of the language. Due to the low learning curve many php developers have little experience with programming and almost no awareness regading security resulting in many unsecure websites. Source code analysis can help preventing many security issues, but their usage does have some limitations. Firstly the scan on itself takes only a few minutes, but analysing the results requires much longer and depends greatly on how familiar the analyser is with the scanned source code. Second these analysers produce many flase positives, making analysis even more time consuming. Lastly not all vulnerabilities are detected with the same efficiency. Especially vulnerabilities that are dependent on the application logic like injection or XSS are not always efficiently detected.<br> Concluding, like all tools, a source code analyser can be a powerful tool, but one has to be aware of its limitations. These tools can provide results very fast, but when used on unfamiliar code the analysis can be very time consuming. <br>
-== Meeting Schedule December 2nd 2009: BeNeLux OWASP Day 2009<br>  ==
+----
 Follow this link for more information: [[BeNeLux OWASP Day 2009]]
@@ Line 242: / Line 244: @@
 [[Image:BeNeLux Day 2009 poster v1.png|200px]]
+----
-== Meeting Schedule 9th April Knowing Your Enemy  ==
+=== Meeting Schedule 9th April Knowing Your Enemy  ===
 '''Summary''' The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions.