OWASP H2H Tool Project - Revision history

Nicopoirier: /* FAQs */

2015-09-11T21:51:58Z

‎FAQs

2015-09-09T21:50:49Z

‎Description

2015-09-09T21:50:34Z

‎Description

2015-09-09T21:50:20Z

‎Description

2015-09-09T21:49:39Z

‎Project Leader

2015-09-09T21:49:00Z

‎Description

2015-09-09T21:47:35Z

2015-09-09T21:46:46Z

2015-08-04T19:48:26Z

‎Road Map and Getting Involved

2015-08-04T19:46:35Z

‎OWASP Tool Project Template

← Older revision		Revision as of 21:51, 11 September 2015
Line 99:		Line 99:
	Fork our repository [https://github.com/highway-to-urhell/highway-to-urhell Github] and Pull request !		Fork our repository [https://github.com/highway-to-urhell/highway-to-urhell Github] and Pull request !

		+	== Installation
		+
		+	For core : https://github.com/highway-to-urhell/highway-to-urhell/blob/master/README.md
		+
		+	For Web-Project : https://github.com/highway-to-urhell/highway-to-urhell-web/wiki

	= Acknowledgements =		= Acknowledgements =

@@ Line 24: / Line 24: @@
 H2H is a java agent which realizes several tasks :
-/ H2H scan the entire application and all frameworks to list all endpoints. Here is the list of components analyzed by H2H ([https://github.com/highway-to-urhell/highway-to-urhell#h2h---java-jvm framework])
+* H2H scan the entire application and all frameworks to list all endpoints. Here is the list of components analyzed by H2H ([https://github.com/highway-to-urhell/highway-to-urhell#h2h---java-jvm framework])
-/ It is possible to activate a sensor in H2H that monitore each endpoint. For example, this monitoring allows during a Pentest to know if  all scenarios have all been through all endpoints.
+* It is possible to activate a sensor in H2H that monitore each endpoint. For example, this monitoring allows during a Pentest to know if  all scenarios have all been through all endpoints.
-/ It is possible to activate a sensor in H2H that monitore each endpoint's performance
+* It is possible to activate a sensor in H2H that monitore each endpoint's performance
 Visualization of entry points can be done via a new url added by H2H or by the application H2H-Web [https://github.com/highway-to-urhell/highway-to-urhell-web Vizualisation Project]

@@ Line 26: / Line 26: @@
 / H2H scan the entire application and all frameworks to list all endpoints. Here is the list of components analyzed by H2H ([https://github.com/highway-to-urhell/highway-to-urhell#h2h---java-jvm framework])
-/ It is possible to activate a ... in H2H that monitore each endpoint. For example, this monitoring allows during a Pentest to know if  all scenarios have all been through all endpoints.
+/ It is possible to activate a sensor in H2H that monitore each endpoint. For example, this monitoring allows during a Pentest to know if  all scenarios have all been through all endpoints.
-/ It is possible to activate a ... in H2H that monitore each endpoint's performance
+/ It is possible to activate a sensor in H2H that monitore each endpoint's performance
 Visualization of entry points can be done via a new url added by H2H or by the application H2H-Web [https://github.com/highway-to-urhell/highway-to-urhell-web Vizualisation Project]

@@ Line 22: / Line 22: @@
 ==Description==
 <span >
-H2H is a java ... which realizes several tasks :
+H2H is a java agent which realizes several tasks :
 / H2H scan the entire application and all frameworks to list all endpoints. Here is the list of components analyzed by H2H ([https://github.com/highway-to-urhell/highway-to-urhell#h2h---java-jvm framework])

@@ Line 63: / Line 63: @@
 == Project Leader ==
-Damien Kerbart
+Damien Kerbart <br/>
-Jean-Louis Boudart
+Jean-Louis Boudart<br/>
-Guillaume Dufour
+Guillaume Dufour<br/>
-Nicolas Poirier
+Nicolas Poirier<br/>
 ==Classifications==

@@ Line 31: / Line 31: @@
 Visualization of entry points can be done via a new url added by H2H or by the application H2H-Web [https://github.com/highway-to-urhell/highway-to-urhell-web Vizualisation Project]
 </span>
 ==Licensing==

@@ Line 8: / Line 8: @@
 ==OWASP H2H Tool Project ==
-<span style="color:#ff0000">
+<span >
 H2H is an opensource project allowing to detect all entry points of web applications developped in Java. Entry point and EndPoint are defined and explained in these articles :
 https://digitalguardian.com/resources/data-security-knowledge-base/endpoint-detection-and-response-edr and Gartner http://www.gartner.com/technology/reprints.do?id=1-26F1285&ct=141223&st=sb.
@@ Line 21: / Line 21: @@
 ==Description==
-<span style="color:#ff0000">
+<span >
 H2H is a java ... which realizes several tasks :
@@ Line 35: / Line 35: @@
 ==Licensing==
-<span style="color:#ff0000">
+<span >
 H2H is a open source project with licence Apache 2.
 </span>
@@ Line 44: / Line 44: @@
 == Project Resources ==
-<span style="color:#ff0000">
+<span>
 </span>
@@ Line 89: / Line 89: @@
 <!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
-<span style="color:#ff0000">
+<span>
 	Coming soon
 </span>

← Older revision		Revision as of 19:48, 4 August 2015
Line 130:		Line 130:

	= Road Map and Getting Involved =		= Road Map and Getting Involved =
		+	To realize this tool, we have focused on our prefered technology Java and the famous framework Spring, Struts, Jsf, Jax-rs. Indeed we have analyzed all the framework to detect all uri exposed by the application. For example, if a developer creates a backdoor with Spring framework webservice "http://server:port/webservice/yeah/it/s/a/backdoor" it's difficult to find this uri, you must analyse the code and the dependency. H2H is an agent who finds all entries and displays. You can check our platform demo http://62.210.222.197:8180/h2hell-web/ here.
		+
		+	Today we have tested our solution at many customers and the results are convincing. We are fan of open-source solutions and we would like to have your opinion on H2H. I think, but i could be wrong, that it's a small tool but an interesting solution for OWASP.
		+
		+	The project is composed of 2 sub-projects : the core : https://github.com/highway-to-urhell/highway-to-urhell : Agent for Java project and the web https://github.com/highway-to-urhell/highway-to-urhell-web : interface for user-friendly.
		+

	<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->		<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->

@@ Line 10: / Line 10: @@
 </span>
-==OWASP Tool Project Template==
+==OWASP H2H Tool Project Template==
 <span style="color:#ff0000">
 	This section should include an overview of what the project is, why the project was started, and what security issue is being addressed by the project deliverable. Some readers may be discouraged from looking further at the project if they do not understand the significance of the security concern that is being addressed, so provide enough context so the average reader will continue on with reading the description. You shouldn't assume the reader will understand the objective by providing security terminology, e.g. this project builds cryptographic algorithms, but should also endeavor to explain what they are used for.