OWASP Testing Guide v2 Review Panel - Revision history

Mmeucci at 10:35, 14 December 2006

2006-12-14T10:35:25Z

Mmeucci at 10:24, 14 December 2006

2006-12-14T10:24:06Z

EoinKeary at 09:57, 14 December 2006

2006-12-14T09:57:37Z

EoinKeary at 09:45, 14 December 2006

2006-12-14T09:45:39Z

EoinKeary at 11:38, 6 December 2006

2006-12-06T11:38:13Z

Mmeucci at 22:58, 5 December 2006

2006-12-05T22:58:38Z

Jekist at 18:07, 1 December 2006

2006-12-01T18:07:40Z

Jekist at 17:49, 1 December 2006

2006-12-01T17:49:38Z

Jekist at 17:45, 1 December 2006

2006-12-01T17:45:32Z

Mmeucci at 23:25, 29 November 2006

2006-11-29T23:25:53Z

@@ Line 137: / Line 137: @@
 ** 4.6.2.4 SQL Server testing (100%) Reviewed by MM. Reviewed by AR.
 ** 4.6.3 LDAP Injection (100%) Reviewed by MM added wp and tools
-** 4.6.4 ORM Injection (100%) '''TD (not enough informations)'''
+** 4.6.4 ORM Injection (100%) Reviwed by MM.
 ** 4.6.5 XML Injection (90%->100%) Reviwed and updated by MM.
 ** 4.6.6 SSI Injection (95%->100%) Reviewed by MM
@@ Line 195: / Line 195: @@
 ----
 * '''Appendix A: Testing Tools -->Review and updated by Meucci'''
-article of 1: need a paragraph to describe each OWASP tool
+ok
 ----
 * '''Appendix B: Suggested Reading -->...'''
-article of 1: need to update it
+ok
 ----
 * '''Appendix C: Fuzz Vectors --> Stefano Di Paola, Subere '''
-ok. Some other fuzz vectors could be added. <br>
+ok.
 How about every author to add his specific fuzz vector section?<br>
 [Meucci] Good idea. I think that we have not to write a brief description of each fuzz vectors (this is an appendix).

@@ Line 73: / Line 73: @@
 ** (Reviewed by JK). For Blackbox testing examples specific to IIS, refer to http://www.nextgenss.com/papers/iisrconfig.pdf. I think we should add an automated testing section, and reference tools such as Nikto, Wikto, and others.
 ** Reviewed by EK. '''Not typical guide structure -> (MM: I've changed the structure)'''
 ** ''Sample/known files and directories'': might be good to refer to http://www.owasp.org/index.php/Old_file_testing_AoC ??
 ** ''Logging'': Timestamp is also important
@@ Line 111: / Line 110: @@
 ----
 * '''4.6 Data Validation Testing --> Meucci'''
-articles reviewed (3 are at 0%)
+articles reviewed
 '''[OK]'''
 ** 4.6 Data Validation Testing : Reviewed by EK
@@ Line 121: / Line 120: @@
 *** It should be stressed that the main reason to perform data validation is to prevent application faults, i.e. unexpected behavior, that is violation of (security) requirements. Regardless of the categories of vulnerabilities listed, an application should (actually must!) verify all input against: type, length, range or domain validity. "Bad" input may not cause any of the listed vulnerabilities yet cause the application to misbehave, if it is not checked (possibly causing DoS or violating data integrity or confidentiality).
 *** (Bregolin) end
-** 4.6.1 Cross site scripting: Reviewed by EK (Reformatted it slightly with wiki tags). '''Not completed'''
+** 4.6.1 Cross site scripting: Reviewed by EK (Reformatted it slightly with wiki tags). '''Completed and reviewed by MM)
 *** Reviewed by SDP. Some thought about content structure:
 ***:As it is a testing guide, any other information about how to sanitize input should be referenced to Owasp Data Validation Project (no redundancy). Approach in testing section could be more schematic.
@@ Line 133: / Line 132: @@
 *** Not sure about "inferential" injection definition in "Description of Issue"
 *** Added some reference to Oracle. Corrected English.
-** 4.6.2.1 Stored procedure injection (40%) '''TD (not enough informations)'''
+** 4.6.2.1 Stored procedure injection (40%) '''Merged in Testing SQL Injection section, MM'''
-**4.6.2.2 Oracle testing (0%) '''TD (not enough informations)'''
+**4.6.2.2 Oracle testing (100%)
 ** 4.6.2.3 MySQL testing (100%) Reviewed by MM
-** 4.6.2.4 SQL Server testing (95%) Reviewed by MM. Reviewed by AR.
+** 4.6.2.4 SQL Server testing (100%) Reviewed by MM. Reviewed by AR.
-** 4.6.3 LDAP Injection (90%) Reviewed by MM added wp and tools
+** 4.6.3 LDAP Injection (100%) Reviewed by MM added wp and tools
 ** 4.6.4 ORM Injection (100%) '''TD (not enough informations)'''
-** 4.6.5 XML Injection (90%) Reviwed and updated by MM. '''WP and tools?'''
+** 4.6.5 XML Injection (90%->100%) Reviwed and updated by MM.
 ** 4.6.6 SSI Injection (95%->100%) Reviewed by MM
-** 4.6.7 XPath Injection (80%) Reviewed by MM. '''Gray box section is to complete?'''
+** 4.6.7 XPath Injection (80%) Reviewed by MM.
 ** 4.6.8 IMAP/SMTP Injection (95%->100%)Reviewed by MM
-** 4.6.9 Code Injection (70%) Reviewed by MM. '''Not completed'''
+** 4.6.9 Code Injection (100%) Reviewed by MM.
-** 4.6.10 OS Commanding (70%) Reviewed by MM + added an example. '''Not completed'''
+** 4.6.10 OS Commanding (100%) Reviewed by MM + added an example
 ** 4.6.11 Buffer overflow Testing (100%) Reviewed by MM. '''Note: these tests are not usual web app tests'''
 *** (Bregolin) The point is that these are not black box tests, so where they are now they are misplaced
@@ Line 150: / Line 149: @@
 ** 4.6.11.2 Stack overflow (100%)Reviewed by MM
 ** 4.6.11.3 Format string (100%)Reviewed by MM
-** 4.6.12 Incubated vulnerability testing (95%) Reviewed by MM, whitepapers?
+** 4.6.12 Incubated vulnerability testing (95%) Reviewed by MM
 ----

@@ Line 189: / Line 189: @@
 We have to write about it.
 ** 5.1 How to value the real risk -> Reviewed by EK (Great!!)
-** 5.2 How to write the report of the testing - > Reviewed by EK
+** 5.2 How to write the report of the testing - > Reviewed by EK (Great also).

@@ Line 188: / Line 188: @@
 * '''5. Writing Reports: value the real risk'''
 We have to write about it.
-O of 3 articles to be reviewed.
+** 5.1 How to value the real risk -> Reviewed by EK (Great!!)
 ----

@@ Line 69: / Line 69: @@
 ** Reviewed + updated(EK). '''(Reviewed by MM: changed the structure)'''<BR>
 * '''DB Listener Testing''':
-** '''Incomplete'''<BR>
+** '''Complete + reviewed'''<BR>
 * '''Application configuration management testing''':
 ** (Reviewed by JK). For Blackbox testing examples specific to IIS, refer to http://www.nextgenss.com/papers/iisrconfig.pdf. I think we should add an automated testing section, and reference tools such as Nikto, Wikto, and others.

@@ Line 2: / Line 2: @@
-Update: 24th November, 23.00 (GMT+1)<br>
+Update: 4th December, 23.00 (GMT+1)<br>
 <nowiki>
@@ Line 187: / Line 187: @@
 ----
 * '''5. Writing Reports: value the real risk'''
-We have to write about it. I consider it not yet finished.
+We have to write about it.
 O of 3 articles to be reviewed.

@@ Line 54: / Line 54: @@
 of 10 articles reviewed -> <BR>
 * '''Testing Web Application Fingerprint''' -added new article
-(Reviewed by JK) - Corrected the English in the "Brief Summary" section. Added "Description of the Issue". In the Black-Box testing section, is it necessary to show all of the different web server versions? This information is just repeated from the referenced whitepaper. If we are going to do that, should we also include output from newer versions, such as IIS 6.0, Apache 1.3.37, Apache 2.x, etc.?
+** (Reviewed by JK) - Corrected the English in the "Brief Summary" section. Added "Description of the Issue". In the Black-Box testing section, is it necessary to show all of the different web server versions? This information is just repeated from the referenced whitepaper. If we are going to do that, should we also include output from newer versions, such as IIS 6.0, Apache 1.3.37, Apache 2.x, etc.?
 * '''Application Discovery''':
 ** Reviewed + updated(EK) (Maybe we should include HTTP methods for application descovery, such as HTTP HEAD command?)<BR>