OWASP Faux Bank Project - Revision history

Johanna Curiel at 00:38, 3 March 2015

2015-03-03T00:38:22Z

Davie elliott: /* The Vulnerabilities */

2014-11-08T15:35:17Z

‎The Vulnerabilities

Davie elliott: /* Road Map and Getting Involved */

2014-11-08T15:32:27Z

‎Road Map and Getting Involved

Davie elliott at 15:31, 8 November 2014

2014-11-08T15:31:23Z

Davie elliott at 21:23, 10 September 2014

2014-09-10T21:23:14Z

Davie elliott at 19:15, 9 July 2014

2014-07-09T19:15:11Z

Davie elliott at 22:09, 7 July 2014

2014-07-07T22:09:31Z

Davie elliott at 22:02, 7 July 2014

2014-07-07T22:02:19Z

Davie elliott at 22:01, 7 July 2014

2014-07-07T22:01:47Z

Davie elliott at 21:49, 7 July 2014

2014-07-07T21:49:23Z

@@ Line 1: / Line 1: @@
 =Main=
-<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
+<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File:Incubator_big.jpg|link=OWASP_Project_Stages#tab=Incubator_Projects]]</div>
 [[File:Owaspfauxbanklogo-big.png]]

@@ Line 36: / Line 36: @@
 ;[http://www.thatcoderguy.co.uk/2014/06/17/hacking-websites-part-4-sql-injection-attack/ Hacking Websites – Part 4: SQL Injection Attack]
 ;[http://www.thatcoderguy.co.uk/2014/07/01/hacking-websites-part-5-missing-function-level-access-control/ Hacking Websites – Part 5: Missing Function Level Access Control]
+;[http://www.thatcoderguy.co.uk/2014/09/16/hacking-websites-part-6-unvalidated-redirects-and-forwards/ Hacking Websites – Part 6: Unvalidated Redirects and Forwards]
 =Road Map and Getting Involved=

@@ Line 43: / Line 43: @@
 The immediate road map for the classic ASP Version is as follows:
-;A10 – Unvalidated Redirects and Forwards - 30th September
+;A9 - Using Components with Known Vulnerabilities
-;A9 - Using Components with Known Vulnerabilities - 14th October
+;A6 – Sensitive Data Exposure
-;A6 – Sensitive Data Exposure - 28th October
+;A5 – Security Misconfiguration
-;A5 – Security Misconfiguration - 11th November
+;A4 – Insecure Direct Object References
 The PHP version is looking to be completed in 2015, and the .Net version will then follow.

@@ Line 17: / Line 17: @@
 [mailto:davie.elliott@owasp.org Davie Elliott]
-I am a web developer with 9 years commercial experience, currently in a Technical Director position for a small website company. I have an avid interest in security; network and web application development, and have written numerous pieces security software and also trained developers on how to write secure code. I have my own website: [http://www.thatcoderguy.co.uk www.thatcoderguy.co.uk] which also hosts my bi-weekly blog where I write about security and web development.
+I am a web developer with 11 years commercial experience, currently in a Technical Director position for a small website company. I have an avid interest in security; network and web application development, and have written numerous pieces security software and also trained developers on how to write secure code. I have my own website: [http://www.thatcoderguy.co.uk www.thatcoderguy.co.uk] which also hosts my bi-weekly blog where I write about security and web development.
 == Licensing ==

@@ Line 43: / Line 43: @@
 The immediate road map for the classic ASP Version is as follows:
-;A10 – Unvalidated Redirects and Forwards - 22nd July
+;A10 – Unvalidated Redirects and Forwards - 30th September
-;A9 - Using Components with Known Vulnerabilities - 5th August
+;A9 - Using Components with Known Vulnerabilities - 14th October
-;A6 – Sensitive Data Exposure - 19th August
+;A6 – Sensitive Data Exposure - 28th October
-;A5 – Security Misconfiguration - 2nd September
+;A5 – Security Misconfiguration - 11th November
-;A4 – Insecure Direct Object References - 16th September
+;A4 – Insecure Direct Object References - 25th November
-The PHP version is looking to be completed by October 30th, and the .Net version is looking to be completed by December.
+The PHP version is looking to be completed in 2015, and the .Net version will then follow.
-If you'd like to get involved, why not [mailto:davie.elliott@owaps.org contact me], or if you'd like to write the PHP or .Net versions (which haven't been started yet), why not just create a fork on GitHub and create your own version and upload it.
+If you'd like to get involved, why not [mailto:davie.elliott@owasp.org contact me], or if you'd like to write the PHP or .Net versions (which haven't been started yet), why not just create a fork on GitHub and create your own version and upload it.
 =Project About=

@@ Line 15: / Line 15: @@
 == Project Leader ==
-[mailto:davie.elliott@owaps.org Davie Elliott]
+[mailto:davie.elliott@owasp.org Davie Elliott]
 I am a web developer with 9 years commercial experience, currently in a Technical Director position for a small website company. I have an avid interest in security; network and web application development, and have written numerous pieces security software and also trained developers on how to write secure code. I have my own website: [http://www.thatcoderguy.co.uk www.thatcoderguy.co.uk] which also hosts my bi-weekly blog where I write about security and web development.

← Older revision		Revision as of 22:09, 7 July 2014
Line 40:		Line 40:
	=Road Map and Getting Involved=		=Road Map and Getting Involved=

		+	As of 7th July, there are 5 vulnerabilities implemented in the Classic ASP version of OWASP Faux Bank.

		+	The immediate road map for the classic ASP Version is as follows:
		+	;A10 – Unvalidated Redirects and Forwards - 22nd July
		+	;A9 - Using Components with Known Vulnerabilities - 5th August
		+	;A6 – Sensitive Data Exposure - 19th August
		+	;A5 – Security Misconfiguration - 2nd September
		+	;A4 – Insecure Direct Object References - 16th September

		+	The PHP version is looking to be completed by October 30th, and the .Net version is looking to be completed by December.
		+
		+	If you'd like to get involved, why not [mailto:davie.elliott@owaps.org contact me], or if you'd like to write the PHP or .Net versions (which haven't been started yet), why not just create a fork on GitHub and create your own version and upload it.

	=Project About=		=Project About=

@@ Line 31: / Line 31: @@
 For the moment, the first 5 vulnerabilities can be read about on my blog:
-[http://www.thatcoderguy.co.uk/2014/05/13/is-your-web-application-secure-part-1-cross-site-request-forgery/ Is your web application secure? – Part 1: Cross Site Request Forgery]
+;[http://www.thatcoderguy.co.uk/2014/05/13/is-your-web-application-secure-part-1-cross-site-request-forgery/ Is your web application secure? – Part 1: Cross Site Request Forgery]
-[http://www.thatcoderguy.co.uk/2014/05/20/hacking-websites-part-2-cross-site-scripting/ Hacking Websites – Part 2: Cross Site Scripting]
+;[http://www.thatcoderguy.co.uk/2014/05/20/hacking-websites-part-2-cross-site-scripting/ Hacking Websites – Part 2: Cross Site Scripting]
-[http://www.thatcoderguy.co.uk/2014/05/27/hacking-websites-part-3-broken-authentication-session-management/ Hacking Websites – Part 3: Broken Authentication and Session Management]
+;[http://www.thatcoderguy.co.uk/2014/05/27/hacking-websites-part-3-broken-authentication-session-management/ Hacking Websites – Part 3: Broken Authentication and Session Management]
-[http://www.thatcoderguy.co.uk/2014/06/17/hacking-websites-part-4-sql-injection-attack/ Hacking Websites – Part 4: SQL Injection Attack]
+;[http://www.thatcoderguy.co.uk/2014/06/17/hacking-websites-part-4-sql-injection-attack/ Hacking Websites – Part 4: SQL Injection Attack]
-[http://www.thatcoderguy.co.uk/2014/07/01/hacking-websites-part-5-missing-function-level-access-control/ Hacking Websites – Part 5: Missing Function Level Access Control]
+;[http://www.thatcoderguy.co.uk/2014/07/01/hacking-websites-part-5-missing-function-level-access-control/ Hacking Websites – Part 5: Missing Function Level Access Control]

← Older revision		Revision as of 22:01, 7 July 2014
Line 28:		Line 28:
	=The Vulnerabilities=		=The Vulnerabilities=

		+	This section will be properly fleshed out.
		+	For the moment, the first 5 vulnerabilities can be read about on my blog:

		+	[http://www.thatcoderguy.co.uk/2014/05/13/is-your-web-application-secure-part-1-cross-site-request-forgery/ Is your web application secure? – Part 1: Cross Site Request Forgery]
		+	[http://www.thatcoderguy.co.uk/2014/05/20/hacking-websites-part-2-cross-site-scripting/ Hacking Websites – Part 2: Cross Site Scripting]
		+	[http://www.thatcoderguy.co.uk/2014/05/27/hacking-websites-part-3-broken-authentication-session-management/ Hacking Websites – Part 3: Broken Authentication and Session Management]
		+	[http://www.thatcoderguy.co.uk/2014/06/17/hacking-websites-part-4-sql-injection-attack/ Hacking Websites – Part 4: SQL Injection Attack]
		+	[http://www.thatcoderguy.co.uk/2014/07/01/hacking-websites-part-5-missing-function-level-access-control/ Hacking Websites – Part 5: Missing Function Level Access Control]