OWASP Testing Project v3 Review Roadmap - Revision history

KirstenS at 00:11, 16 December 2008

2008-12-16T00:11:05Z

2008-12-16T00:07:30Z

2008-12-16T00:02:54Z

2008-09-19T23:08:58Z

2008-09-19T22:54:12Z

2008-09-19T22:31:38Z

2008-09-19T21:15:30Z

2008-09-17T23:12:01Z

2008-09-17T20:36:59Z

2008-09-17T20:24:14Z

@@ Line 26: / Line 26: @@
 *** There are mentioning of "attackers" but I think they are fine.
 *** The subsection on Memory leaks is not complete.
-** Section 4.11 [[Testing for AJAX]]
+** Section 4.11 [[Testing for AJAX  (OWASP-AJ-002)|Testing for AJAX]]
 *** The subsection "Intercepting and Debugging JS code with Browsers" is very difficult to understand. I tried to fix it, but I'm afraid what I have might not reflect what the original author wanted to express.

@@ Line 23: / Line 23: @@
 *** ``TO UPDATE WITH V3 controls`` is still in the article. Has it been updated to v3? '''(Mat: I'm updating it, thanks)'''
 * Chapter 4
-** Section 4.11 [[Testing for AJAX Vulnerabilities]]
+** Section 4.11 [[Testing for AJAX Vulnerabilities (OWASP-AJ-001)|Testing for AJAX Vulnerabilities]]
 *** There are mentioning of "attackers" but I think they are fine.
 *** The subsection on Memory leaks is not complete.

@@ Line 32: / Line 32: @@
 * Chapter 4
 ** Section 4.10
-*** Subsection [[Testing for WS Replay]] Gray box testing and examples gives incomplete sample code. I believe the call to GetSessionIDMac() missed four parameters. In this same part, using SSL helps in preventing replay attack but it doesnt prevent replay attack by itself. In this same subection, the images show identifiable real Internet address in Hungary, should them be masked off?
+*** Subsection [[Testing for WS Replay   (OWASP-WS-007)|Testing for WS Replay]] Gray box testing and examples gives incomplete sample code. I believe the call to GetSessionIDMac() missed four parameters. In this same part, using SSL helps in preventing replay attack but it doesnt prevent replay attack by itself. In this same subection, the images show identifiable real Internet address in Hungary, should them be masked off?
 Sep 04, 2008

← Older revision		Revision as of 23:08, 19 September 2008
Line 236:		Line 236:
	* Changed "HTTP" to "the HTTP"		* Changed "HTTP" to "the HTTP"
	Questions: (Mat will answer it)<br>		Questions: (Mat will answer it)<br>
		+	4.10.1 WS Information Gathering
		+
		+	4.10.2 Testing WSDL
		+	* I made several grammar and spelling changes to the paragraph on WSDigger and it's use. The last sentence on use appeared to be incomplete. I attempted to complete it. Please review.

← Older revision		Revision as of 22:54, 19 September 2008
Line 215:		Line 215:
	4.8.15 Testing for incubated vulnerabilities		4.8.15 Testing for incubated vulnerabilities

		+	4.9 Testing for Denial of Service
		+
		+	(new: F.Mavituna - 100%) 4.9.1 Testing for SQL Wildcard Attacks
		+
		+	4.9.2 Testing for DoS Locking Customer Accounts
		+
		+	4.9.3 Testing for DoS Buffer Overflows
		+
		+	4.9.4 Testing for DoS User Specified Object Allocation
		+
		+	4.9.5 Testing for User Input as a Loop Counter
		+
		+	4.9.6 Testing for Writing User Provided Data to Disk
		+
		+	4.9.7 Testing for DoS Failure to Release Resources
		+
		+	4.9.8 Testing for Storing too Much Data in Session
		+
		+	4.10 Web Services Testing
		+	* Changed "HTTP" to "the HTTP"
	Questions: (Mat will answer it)<br>		Questions: (Mat will answer it)<br>

@@ Line 126: / Line 126: @@
 .2.4 Testing for Web Application Fingerprint<br>
 .2.5 Application Discovery<br>
-<br><br>
+<br>
 September, 2008<br>
 .3.7 Infrastructure and Application Admin Interfaces<br>
@@ Line 192: / Line 191: @@
 .8.6 Testing for LDAP Injection
 * Changed "LDAP three" to "LDAP tree"
 Questions: (Mat will answer it)<br>

@@ Line 186: / Line 186: @@
 .8.5.2 MySQL Testing
   <br>
 Questions: (Mat will answer it)<br>

@@ Line 176: / Line 176: @@
 <br>
 .8 Data Validation Testing <br>
-.8.1 Testing for Reflected Cross Site Scripting
+.8.1 Testing for Reflected Cross Site Scripting  <br>
-.8.2 Testing for Stored Cross Site Scripting
+.8.2 Testing for Stored Cross Site Scripting <br>
-.8.3 Testing for DOM based Cross Site Scripting
+.8.3 Testing for DOM based Cross Site Scripting <br>
-* Section feels incomplete.  The content appears to end abruptly.  The author mentions source code review for Black and Greybox testing.  While this is the likely test process It would be nice to include a tool-based test if one exists for those of us who are not coders and have only rudimentary experience with code.
+* Section feels incomplete.  The content appears to end abruptly.  The author mentions source code review for Black and Greybox testing.  While this is the likely test process It would be nice to include a tool-based test if one exists for those of us who are not coders and have only rudimentary experience with code.  <br>
-.8.4 Testing for Cross Site Flashing
+.8.4 Testing for Cross Site Flashing  <br>
-* Grammar changes (singular to plural and vica versa, capitalization.
+* Grammar changes (singular to plural and vica versa, capitalization. <br>
-.8.5 Testing for SQL Injection
+.8.5 Testing for SQL Injection  <br>
+.8.5.1 Oracle Testing  <br>
 Questions: (Mat will answer it)<br>

@@ Line 168: / Line 168: @@
 .7.4 Testing for Exposed Session Variables <br>
 *  Changed A first person reference to third person reference ( "My... I would expect" to "When the authenticaion... The user..")<br>
 Questions: (Mat will answer it)<br>