OWASP Testing Guide v4 Table of Contents - Revision history

Tony Hsu HsiangChih: 4.10.4 Testing for Weak Encryption (OTG-CRYPST-004)

2017-05-08T00:54:01Z

4.10.4 Testing for Weak Encryption (OTG-CRYPST-004)

Tony Hsu HsiangChih at 00:53, 8 May 2017

2017-05-08T00:53:18Z

Tony Hsu HsiangChih: /* 4. Web Application Security Testing */

2017-05-04T09:22:57Z

‎4. Web Application Security Testing

Mmeucci at 09:37, 16 February 2017

2017-02-16T09:37:40Z

Raul Siles: Fixed current link to the OTG v4 guide

2016-11-09T14:16:43Z

Fixed current link to the OTG v4 guide

Daniel.schulz: Added missing links

2016-06-14T21:28:39Z

Added missing links

Daniel.schulz: Added missing links

2016-06-14T21:19:46Z

Added missing links

Daniel.schulz: Added missing internal links

2016-06-14T21:12:32Z

Added missing internal links

Tony Hsu HsiangChih: /* 4. Web Application Security Testing */

2016-04-10T00:28:03Z

‎4. Web Application Security Testing

Tony Hsu HsiangChih: /* 4. Web Application Security Testing */

2016-04-09T14:00:52Z

‎4. Web Application Security Testing

← Older revision		Revision as of 00:54, 8 May 2017
Line 262:		Line 262:
	[[Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)\|4.10.3 Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)]]		[[Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)\|4.10.3 Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)]]

−	[[Testing for Weak Encryption (OTG-CRYPST-004)\|4.10.~~4Testing~~ for Weak Encryption (OTG-CRYPST-004)]]	+	[[Testing for Weak Encryption (OTG-CRYPST-004)\|4.10.4 Testing for Weak Encryption (OTG-CRYPST-004)]]

← Older revision		Revision as of 00:53, 8 May 2017
Line 261:		Line 261:

	[[Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)\|4.10.3 Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)]]		[[Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)\|4.10.3 Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)]]
		+
		+	[[Testing for Weak Encryption (OTG-CRYPST-004)\|4.10.4Testing for Weak Encryption (OTG-CRYPST-004)]]

@@ Line 11: / Line 11: @@
 '''Testing Guide Wiki last Updated: April 2016'''
-[[ OWTGv4 Contributors list|'''Contributors List]]
+[[ OWTGv4 Contributors list|'''Contributors List''']]
 ----
@@ Line 71: / Line 71: @@
 '''[[Penetration testing methodologies |3.8 Penetration Testing Methodologies]]'''
-==[[Web Application Penetration Testing |4. Web Application Security Testing ]]==
+==[[Web Application Penetration Testing |4. Web Application Security Testing]]==
 [[Testing: Introduction and objectives|'''4.1 Introduction and Objectives''']]
@@ Line 80: / Line 80: @@
 [[Testing Information Gathering|'''4.2 Information Gathering ''']]
-[[Conduct_search_engine_discovery/reconnaissance_for_information_leakage_(OTG-INFO-001) |4.2.1 Conduct Search Engine Discovery and Reconnaissance for Information Leakage (OTG-INFO-001) ]]
+[[Conduct_search_engine_discovery/reconnaissance_for_information_leakage_(OTG-INFO-001) |4.2.1 Conduct Search Engine Discovery and Reconnaissance for Information Leakage (OTG-INFO-001)]]
-[[Fingerprint Web Server (OTG-INFO-002)|4.2.2 Fingerprint Web Server (OTG-INFO-002) ]]
+[[Fingerprint Web Server (OTG-INFO-002)|4.2.2 Fingerprint Web Server (OTG-INFO-002)]]
-[[Review_Webserver_Metafiles_for_Information_Leakage_(OTG-INFO-003) |4.2.3 Review Webserver Metafiles for Information Leakage (OTG-INFO-003) ]]
+[[Review_Webserver_Metafiles_for_Information_Leakage_(OTG-INFO-003) |4.2.3 Review Webserver Metafiles for Information Leakage (OTG-INFO-003)]]
-[[Enumerate Applications on Webserver (OTG-INFO-004) |4.2.4 Enumerate Applications on Webserver (OTG-INFO-004) ]]
+[[Enumerate Applications on Webserver (OTG-INFO-004) |4.2.4 Enumerate Applications on Webserver (OTG-INFO-004)]]
-[[Review_webpage_comments_and_metadata_for_information_leakage_(OTG-INFO-005) |4.2.5 Review Webpage Comments and Metadata for Information Leakage (OTG-INFO-005) ]]
+[[Review_webpage_comments_and_metadata_for_information_leakage_(OTG-INFO-005) |4.2.5 Review Webpage Comments and Metadata for Information Leakage (OTG-INFO-005)]]
-[[Identify_application_entry_points_(OTG-INFO-006) |4.2.6 Identify application entry points (OTG-INFO-006) ]]
+[[Identify_application_entry_points_(OTG-INFO-006) |4.2.6 Identify application entry points (OTG-INFO-006)]]
 [[Map_execution_paths_through_application_(OTG-INFO-007) |4.2.7 Map execution paths through application (OTG-INFO-007)]]
-[[Fingerprint_Web_Application_Framework_(OTG-INFO-008) |4.2.8 Fingerprint Web Application Framework (OTG-INFO-008) ]]
+[[Fingerprint_Web_Application_Framework_(OTG-INFO-008) |4.2.8 Fingerprint Web Application Framework (OTG-INFO-008)]]
-[[Fingerprint_Web_Application_(OTG-INFO-009) |4.2.9 Fingerprint Web Application (OTG-INFO-009) ]]
+[[Fingerprint_Web_Application_(OTG-INFO-009) |4.2.9 Fingerprint Web Application (OTG-INFO-009)]]
-[[Map_Application_Architecture_(OTG-INFO-010) |4.2.10 Map Application Architecture (OTG-INFO-010) ]]
+[[Map_Application_Architecture_(OTG-INFO-010) |4.2.10 Map Application Architecture (OTG-INFO-010)]]
 [[Testing for configuration management|'''4.3 Configuration and Deployment Management Testing ''']]
-[[Test Network/Infrastructure Configuration (OTG-CONFIG-001)|4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001) ]]
+[[Test Network/Infrastructure Configuration (OTG-CONFIG-001)|4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)]]
-[[Test Application Platform Configuration (OTG-CONFIG-002)|4.3.2 Test Application Platform Configuration (OTG-CONFIG-002) ]]
+[[Test Application Platform Configuration (OTG-CONFIG-002)|4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)]]
-[[Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)|4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003) ]]
+[[Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)|4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)]]
-[[Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)|4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004) ]]
+[[Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)|4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)]]
-[[Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)|4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005) ]]
+[[Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)|4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)]]
-[[Test HTTP Methods (OTG-CONFIG-006)|4.3.6 Test HTTP Methods (OTG-CONFIG-006) ]]
+[[Test HTTP Methods (OTG-CONFIG-006)|4.3.6 Test HTTP Methods (OTG-CONFIG-006)]]
-[[Test HTTP Strict Transport Security (OTG-CONFIG-007)|4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007) ]]
+[[Test HTTP Strict Transport Security (OTG-CONFIG-007)|4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)]]
-[[Test RIA cross domain policy (OTG-CONFIG-008)|4.3.8 Test RIA cross domain policy (OTG-CONFIG-008) ]]
+[[Test RIA cross domain policy (OTG-CONFIG-008)|4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)]]
@@ Line 128: / Line 130: @@
 [[Test Account Provisioning Process (OTG-IDENT-003)|4.4.3 Test Account Provisioning Process (OTG-IDENT-003)]]
-[[Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004)|4.4.4 Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004) ]]
+[[Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004)|4.4.4 Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004)]]
 [[Testing for Weak or unenforced username policy (OTG-IDENT-005)| 4.4.5 Testing for Weak or unenforced username policy (OTG-IDENT-005)]]
@@ Line 194: / Line 196: @@
 [[Testing for HTTP Verb Tampering (OTG-INPVAL-003)|4.8.3 Testing for HTTP Verb Tampering (OTG-INPVAL-003)]]
-[[Testing for HTTP Parameter pollution (OTG-INPVAL-004)|4.8.4 Testing for HTTP Parameter pollution (OTG-INPVAL-004) ]]
+[[Testing for HTTP Parameter pollution (OTG-INPVAL-004)|4.8.4 Testing for HTTP Parameter pollution (OTG-INPVAL-004)]]
 [[Testing for SQL Injection (OTG-INPVAL-005)| 4.8.5 Testing for SQL Injection (OTG-INPVAL-005)]]
@@ Line 204: / Line 206: @@
 [[Testing for SQL Server|4.8.5.3 SQL Server Testing]]
-[[OWASP_Backend_Security_Project_Testing_PostgreSQL|4.8.5.4 Testing PostgreSQL (from OWASP BSP) ]]
+[[OWASP_Backend_Security_Project_Testing_PostgreSQL|4.8.5.4 Testing PostgreSQL (from OWASP BSP)]]
 [[Testing for MS Access |4.8.5.5 MS Access Testing]]
@@ Line 240: / Line 242: @@
 [[Testing for Incubated Vulnerability (OTG-INPVAL-015)|4.8.15 Testing for incubated vulnerabilities (OTG-INPVAL-015)]]
-[[Testing for HTTP Splitting/Smuggling  (OTG-INPVAL-016)|4.8.16 Testing for HTTP Splitting/Smuggling  (OTG-INPVAL-016) ]]
+[[Testing for HTTP Splitting/Smuggling  (OTG-INPVAL-016)|4.8.16 Testing for HTTP Splitting/Smuggling  (OTG-INPVAL-016)]]
-[[Testing for HTTP Incoming requests  (OTG-INPVAL-017)|4.8.17 Testing for HTTP Incoming Requests  (OTG-INPVAL-017) ]]
+[[Testing for HTTP Incoming requests  (OTG-INPVAL-017)|4.8.17 Testing for HTTP Incoming Requests  (OTG-INPVAL-017)]]
@@ Line 354: / Line 356: @@
 ----
 [[Category:OWASP Testing Project]]
 [[Category:Popular]]

← Older revision		Revision as of 09:37, 16 February 2017
Line 308:		Line 308:
	[[Test Local Storage (OTG-CLIENT-012)\|4.12.12 Test Local Storage (OTG-CLIENT-012)]]		[[Test Local Storage (OTG-CLIENT-012)\|4.12.12 Test Local Storage (OTG-CLIENT-012)]]

−
−	~~[[Mobile Web service Testing\|'''4.13 Mobile Web service Testing''']]<br>~~
−
−
−	~~[[Cloud Service Testing\|'''4.14 Cloud Service Testing''']]<br>~~
−
−	~~[[Denial of Service Testing\|'''4.15 Testing For HTTP DOS Attack''']]<br>~~

	==[[Reporting \|5. Reporting]]==		==[[Reporting \|5. Reporting]]==

@@ Line 4: / Line 4: @@
 '''This is the FINAL table of content of the New Testing Guide v4.'''<br>
-<br>You can download the Guide [https://www.owasp.org/images/5/52/OWASP_Testing_Guide_v4.pdf here] <br>
+<br>You can download the Guide [https://www.owasp.org/images/1/19/OTGv4.pdf here] <br>
 Back to the OWASP Testing Guide Project:

@@ Line 55: / Line 55: @@
 ==[[The OWASP Testing Framework|3. The OWASP Testing Framework]]==
-'''3.1. Overview'''
+'''[[The_OWASP_Testing_Framework#Overview|3.1 Overview]]'''
-'''3.2. Phase 1: Before Development Begins'''
+'''[[The_OWASP_Testing_Framework#Phase_1:_Before_Development_Begins|3.2 Phase 1: Before Development Begins]]'''
-'''3.3. Phase 2: During Definition and Design'''
+'''[[The_OWASP_Testing_Framework#Phase_2:_During_Definition_and_Design|3.3 Phase 2: During Definition and Design]]'''
-'''3.4. Phase 3: During Development'''
+'''[[The_OWASP_Testing_Framework#Phase_3:_During_Development|3.4 Phase 3: During Development]]'''
-'''3.5. Phase 4: During Deployment'''
+'''[[The_OWASP_Testing_Framework#Phase_4:_During_Deployment|3.5 Phase 4: During Deployment]]'''
-'''3.6. Phase 5: Maintenance and Operations'''
+'''[[The_OWASP_Testing_Framework#Phase_5:_Maintenance_and_Operations|3.6 Phase 5: Maintenance and Operations]]'''
-'''3.7. A Typical SDLC Testing Workflow '''
+'''[[The_OWASP_Testing_Framework#A_Typical_SDLC_Testing_Workflow|3.7 A Typical SDLC Testing Workflow]]'''
-[[Penetration testing methodologies |3.8 Penetration Testing Methodologies]]
+'''[[Penetration testing methodologies |3.8 Penetration Testing Methodologies]]'''
 ==[[Web Application Penetration Testing |4. Web Application Security Testing ]]==

@@ Line 37: / Line 37: @@
 '''[[Testing Guide Introduction#Testing_Techniques_Explained|2.3 Testing Techniques Explained]]'''
-'''[[Testing Guide Introduction#Deriving_Security_Test_Requirements|2.4 Deriving Security Test Requirements]]'''
+'''[[Testing Guide Introduction#Manual_Inspections_.26_Reviews|2.4 Manual Inspections & Reviews]]'''
-'''[[Testing Guide Introduction#Security_Tests_Integrated_in_Development_and_Testing_Workflows|2.5 Security Tests Integrated in Development and Testing Workflows]]'''
+'''[[Testing Guide Introduction#Threat_Modeling|2.5 Threat Modeling]]'''
-'''[[Testing Guide Introduction#Security_Test_Data_Analysis_and_Reporting|2.6 Security Test Data Analysis and Reporting]]'''
+'''[[Testing Guide Introduction#Source_Code_Review|2.6 Source Code Review]]'''
 ==[[The OWASP Testing Framework|3. The OWASP Testing Framework]]==

@@ Line 31: / Line 31: @@
 ==[[Testing Guide Introduction|2. Introduction]]==
-'''2.1 The OWASP Testing Project'''
+'''[[Testing Guide Introduction#The_OWASP_Testing Project|2.1 The OWASP Testing Project]]'''
-'''2.2 Principles of Testing'''
+'''[[Testing Guide Introduction#Principles_of_Testing|2.2 Principles of Testing]]'''
-'''2.3 Testing Techniques Explained'''
+'''[[Testing Guide Introduction#Testing_Techniques_Explained|2.3 Testing Techniques Explained]]'''
-'''2.4 Deriving Security Test Requirements'''
+'''[[Testing Guide Introduction#Deriving_Security_Test_Requirements|2.4 Deriving Security Test Requirements]]'''
-'''2.5 Security Tests Integrated in Development and Testing Workflows'''
+'''[[Testing Guide Introduction#Security_Tests_Integrated_in_Development_and_Testing_Workflows|2.5 Security Tests Integrated in Development and Testing Workflows]]'''
 ==[[The OWASP Testing Framework|3. The OWASP Testing Framework]]==

← Older revision		Revision as of 00:28, 10 April 2016
Line 304:		Line 304:

	[[Cloud Service Testing\|'''4.14 Cloud Service Testing''']]<br>		[[Cloud Service Testing\|'''4.14 Cloud Service Testing''']]<br>
		+
		+	[[Denial of Service Testing\|'''4.15 Testing For HTTP DOS Attack''']]<br>

	==[[Reporting \|5. Reporting]]==		==[[Reporting \|5. Reporting]]==

← Older revision		Revision as of 14:00, 9 April 2016
Line 232:		Line 232:

	[[Testing for HTTP Splitting/Smuggling (OTG-INPVAL-016)\|4.8.16 Testing for HTTP Splitting/Smuggling (OTG-INPVAL-016) ]]		[[Testing for HTTP Splitting/Smuggling (OTG-INPVAL-016)\|4.8.16 Testing for HTTP Splitting/Smuggling (OTG-INPVAL-016) ]]
		+
		+	[[Testing for HTTP Incoming requests (OTG-INPVAL-017)\|4.8.17 Testing for HTTP Incoming Requests (OTG-INPVAL-017) ]]