OWASP OVAL Content Project - Revision history

Kait Disney-Leugers at 19:03, 23 April 2014

2014-04-23T19:03:40Z

Gaurav Kumar at 10:56, 26 December 2011

2011-12-26T10:56:13Z

Gaurav Kumar at 10:46, 26 December 2011

2011-12-26T10:46:02Z

Gaurav Kumar at 19:36, 8 December 2011

2011-12-08T19:36:48Z

Gaurav Kumar at 19:35, 8 December 2011

2011-12-08T19:35:07Z

Gaurav Kumar at 19:27, 8 December 2011

2011-12-08T19:27:35Z

Gaurav Kumar at 18:54, 8 December 2011

2011-12-08T18:54:30Z

Gaurav Kumar at 06:05, 8 December 2011

2011-12-08T06:05:03Z

Gaurav Kumar at 00:00, 4 October 2011

2011-10-04T00:00:39Z

Gaurav Kumar at 23:55, 3 October 2011

2011-10-03T23:55:42Z

← Older revision		Revision as of 19:03, 23 April 2014
Line 1:		Line 1:
		+	{\|
		+	\|-
		+	! width="700" align="center" \| <br>
		+	! width="500" align="center" \| <br>
		+	\|-
		+	\| align="right" \| [[Image:OWASP Inactive Banner.jpg\|800px\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]]
		+	\| align="right" \|
		+
		+	\|}
		+
	==== Main ====		==== Main ====

@@ Line 13: / Line 13: @@
 '''PHP OVAL definitions''' can be downloaded from [http://owasp-oval.googlecode.com/files/php.xml here]
-Please note that these are designed to work on PHP Module loaded by Apache2 web server running on Linux OS
+<pre style="color:blue">
 Details on these definitions can be found [https://docs.google.com/spreadsheet/pub?hl=en_US&key=0AhyObjO7VTMDdHlxbHFrN2VUdHp1NWZUQ0sxNGZOb1E&hl=en_US&gid=0 here]

@@ Line 9: / Line 9: @@
 <br>
-PHP Related Security Definitions.
+==== PHP Security Settings<br>  ====
-Below is a sample OVAL definition file which detects if Apache web server is running
+'''PHP OVAL definitions''' can be downloaded from [http://owasp-oval.googlecode.com/files/php.xml here]
-----
+Please note that these are designed to work on PHP Module loaded by Apache2 web server running on Linux OS
-&lt;?xml version ="1.0" encoding="utf-8"?&gt; &lt;oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris solaris-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd"&gt;
+Details on these definitions can be found [https://docs.google.com/spreadsheet/pub?hl=en_US&key=0AhyObjO7VTMDdHlxbHFrN2VUdHp1NWZUQ0sxNGZOb1E&hl=en_US&gid=0 here]
 <br>
 ----
 <br>

@@ Line 67: / Line 67: @@
 ! scope="col" | OVAL Definition
 |-
-| [[1]]
+| 1
 | register_globals
 | <span class="Apple-tab-span" style="white-space:pre">	</span>Off
@@ Line 73: / Line 73: @@
 | TBD
 |-
-| [[2]]
+| 2
 | magic_quotes_gpc
 | <span class="Apple-tab-span" style="white-space:pre">	</span>On
@@ Line 79: / Line 79: @@
 | TBD
 |-
-| [[3]]
+| 3
 | expose_php
 | <span class="Apple-tab-span" style="white-space:pre">	</span>Off

@@ Line 58: / Line 58: @@
 ==== PHP Security Settings<br>  ====
 {| width="200" border="1" cellpadding="1" cellspacing="1"
 |-
 ! scope="col" | No
 ! scope="col" | Setting
 ! scope="col" | Recommended Value
 ! scope="col" | Description
 ! scope="col" | OVAL Definition
 |-
-| 1
+| [[1]]
 | register_globals
 | <span class="Apple-tab-span" style="white-space:pre">	</span>Off
 | http://www.php.net/manual/en/security.globals.php
 | TBD
 |-
-| 2
+| [[2]]
 | magic_quotes_gpc
 | <span class="Apple-tab-span" style="white-space:pre">	</span>On
 | http://us3.php.net/manual/en/security.magicquotes.whynot.php
 | TBD
 |}
+<br>
 <br>

@@ Line 14: / Line 14: @@
 ----
- <generator>
+&lt;?xml version ="1.0" encoding="utf-8"?&gt; &lt;oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris solaris-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd"&gt;
-  <tests>
+ &lt;generator&gt;
-    <process58_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.owasp.oval:tst:1" version="1" comment="Apache2 running" check_existence="at_least_one_exists" check="at least one">
+ &lt;oval:product_name&gt;OWASP OVAL Content Project&lt;/oval:product_name&gt;
-      <object object_ref="oval:org.owasp.oval:obj:1"/>
+ &lt;oval:schema_version&gt;5.10&lt;/oval:schema_version&gt;
-    </process58_test>
+ &lt;oval:timestamp&gt;2011-12-07T11:18:10.417-04:00&lt;/oval:timestamp&gt;
-  </tests>
+ &lt;/generator&gt;
-   <objects>
+   &lt;tests&gt;
-    <process58_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.owasp.oval:obj:1" version="1">
+ &lt;process58_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.owasp.oval:tst:1" version="1" comment="Apache2 running" check_existence="at_least_one_exists" check="at least one"&gt;
-      <command_line operation="pattern match">.*apache2 .*</command_line>
+ &lt;object object_ref="oval:org.owasp.oval:obj:1"/&gt;
-      <pid datatype="int" operation="greater than">0</pid>
+ &lt;/process58_test&gt;
-    </process58_object>
+ &lt;/tests&gt;
 ----
-<br>
+{| width="200" border="1" cellpadding="1" cellspacing="1"
 ==== Project About  ====

← Older revision		Revision as of 18:54, 8 December 2011
Line 59:		Line 59:

	<br>		<br>
		+
		+	==== PHP Security Settings ====
		+
		+

	==== Project About ====		==== Project About ====

@@ Line 7: / Line 7: @@
 ----
-ASP.NET Web.Config
+<br>
 <br>

@@ Line 1: / Line 1: @@
 ==== Main  ====
 This project’s goal is to create standardized assesment documents (in OVAL XML format) for various application platforms such as .NET, Java, PHP etc. For example, there are several settings like Web.Config file which impacts security of ASP.NET web application. Likewise, PHP.INI has several security related settings. By creating OVAL definitions for these checks, it will enable any OVAL compatible tool (including the free OVAL Interpreter) to perform these checks.
 ==== Project About  ====