Project Information:template Access Control Rules Tester Project - Revision history

Petand at 15:31, 25 July 2011

2011-07-25T15:31:26Z

Petand at 15:30, 25 July 2011

2011-07-25T15:30:44Z

Petand at 15:29, 25 July 2011

2011-07-25T15:29:56Z

Petand at 15:27, 25 July 2011

2011-07-25T15:27:32Z

Petand at 15:26, 25 July 2011

2011-07-25T15:26:24Z

Paulo Coimbra at 18:25, 4 February 2009

2009-02-04T18:25:12Z

Paulo Coimbra at 14:14, 29 January 2009

2009-01-29T14:14:23Z

Paulo Coimbra at 15:19, 26 January 2009

2009-01-26T15:19:33Z

Paulo Coimbra at 14:27, 26 January 2009

2009-01-26T14:27:24Z

Paulo Coimbra at 14:25, 26 January 2009

2009-01-26T14:25:45Z

@@ Line 9: / Line 9: @@
   | colspan="7" style="width:85%; background:#cccccc" align="left"| Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
 This project proposes a novel approach to black-box web application testing, which utilizes a use-case graph. The graph contains classes of actions within the web application and their dependencies. By traversing the graph and applying differential analysis at each step of the traversal, it is possible to improve the accuracy of the method. This idea was implemented in the tool AcCoRuTe (Access Control Rules Tester).
   |-
   | style="width:15%; background:#7B8ABD" align="center"|'''Key Project Information'''

@@ Line 7: / Line 7: @@
   |-
   | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description'''
-  | Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
+  | colspan="7" style="width:85%; background:#cccccc" align="left"| Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
 This project proposes a novel approach to black-box web application testing, which utilizes a use-case graph. The graph contains classes of actions within the web application and their dependencies. By traversing the graph and applying differential analysis at each step of the traversal, it is possible to improve the accuracy of the method. This idea was implemented in the tool AcCoRuTe (Access Control Rules Tester).
   | colspan="6" style="width:85%; background:#cccccc" align="left"|

@@ Line 6: / Line 6: @@
   | colspan="7" style="width:85%; background:#cccccc" align="left"|<font color="black">'''OWASP Access Control Rules Tester Project'''
   |-
-  | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description''' | Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
+  | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description'''
 This project proposes a novel approach to black-box web application testing, which utilizes a use-case graph. The graph contains classes of actions within the web application and their dependencies. By traversing the graph and applying differential analysis at each step of the traversal, it is possible to improve the accuracy of the method. This idea was implemented in the tool AcCoRuTe (Access Control Rules Tester).
   | colspan="6" style="width:85%; background:#cccccc" align="left"|

@@ Line 6: / Line 6: @@
   | colspan="7" style="width:85%; background:#cccccc" align="left"|<font color="black">'''OWASP Access Control Rules Tester Project'''
   |-
-  | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description''' Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
+  | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description''' | Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
 This project proposes a novel approach to black-box web application testing, which utilizes a use-case graph. The graph contains classes of actions within the web application and their dependencies. By traversing the graph and applying differential analysis at each step of the traversal, it is possible to improve the accuracy of the method. This idea was implemented in the tool AcCoRuTe (Access Control Rules Tester).
   | colspan="6" style="width:85%; background:#cccccc" align="left"|
@@ Line 30: / Line 30: @@
 Version 1.1
 ----------------------------------------
-[http://accorute.googlecode.com/files/syssec2011-slides.pdf PPT Presentation from the 1st SysSec Workshop (an updated method presented)]
+[http://accorute.googlecode.com/files/syssec2011-slides.pdf PPT Presentation from the 1st SysSec Workshop (an updated method presented)]<br>
-[http://accorute.googlecode.com/files/syssec2011-slides.pdf A paper from the 1st SysSec Workshop with an updated method described]
+[http://accorute.googlecode.com/files/syssec2011-slides.pdf A paper from the 1st SysSec Workshop with an updated method described]<br>
-[http://code.google.com/p/accorute/source/checkout A new codebase can be checked out here]
+[http://code.google.com/p/accorute/source/checkout A new codebase can be checked out here]<br>
 Version 1.0

@@ Line 6: / Line 6: @@
   | colspan="7" style="width:85%; background:#cccccc" align="left"|<font color="black">'''OWASP Access Control Rules Tester Project'''
   |-
-  | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description'''
+  | style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description''' Often web applications contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. It is known that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach.
-  | colspan="6" style="width:85%; background:#cccccc" align="left"|I believe that web application business logic vulnerabilities will be under increasing attention in near future. Although input validation vulnerabilities (XSS, SQLI) are in overwhelming majority nowadays, many automated approaches have emerged that deal with them. On the contrary, there are no known approaches (and methodologies for security experts) to classify or even detect business logic vulnerabilities. Besides, business logic flaws usually expose web application to great risks (according to OWASP Testing Guide). The proposal is to make an attempt to create a systematic approach that addresses business logic vulnerabilities. To begin with, access control flaws are surveyed.
+This project proposes a novel approach to black-box web application testing, which utilizes a use-case graph. The graph contains classes of actions within the web application and their dependencies. By traversing the graph and applying differential analysis at each step of the traversal, it is possible to improve the accuracy of the method. This idea was implemented in the tool AcCoRuTe (Access Control Rules Tester).
   |-
   | style="width:15%; background:#7B8ABD" align="center"|'''Key Project Information'''
   | style="width:14%; background:#cccccc" align="center"|Project Leader<br>[[User:Petand|'''Andrew Petukhov''']]
-  | style="width:15%; background:#cccccc" align="center"|Project Contributors<br>(if applicable)
+  | style="width:15%; background:#cccccc" align="center"|Project Contributors<br>George Noseevich
   | style="width:10%; background:#cccccc" align="center"|Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-access-control-rules-tester-project '''Subscribe here''']<br>[mailto:owasp-access-control-rules-tester-project@lists.owasp.org '''Use here''']
   | style="width:17%; background:#cccccc" align="center"|License<br>[http://www.gnu.org/licenses/old-licenses/gpl-2.0.html '''GNU General Public License v2''']
@@ Line 26: / Line 28: @@
 '''[[:Category:OWASP_Project_Assessment#Beta_Quality_Tool_Criteria|Beta Quality]]'''<br>[[:Access Control Rules Tester Project - Assessment Frame|Please see here for complete information.]]
   | style="width:42%; background:#cccccc" align="center"|
-[http://accorute.googlecode.com/files/OWASP_EU_Summit_2008_AcCoRuTe.ppt PPT Presentation]<br>[http://accorute.googlecode.com/files/BusinessLogicVulnerabilities.pdf What are business logic vulnerabilities? - An attempt to define their scope]<br>[http://accorute.googlecode.com/files/AcCoRuTe.pdf AcCoRuTe approach described]<br>[http://code.google.com/p/accorute/ Google Code Project page]<br>[http://accorute.googlecode.com/files/AcCoRuTe-1.0.0.zip AcCoRuTe version 1.0.0 binaries]<br>[http://accorute.googlecode.com/files/AcCoRuTe-1.0.0-userguide.pdf AcCoRuTe User Guide]
+Version 1.1
   | style="width:29%; background:#cccccc" align="center"|
 If any, add link here
   |}
 ----

@@ Line 13: / Line 13: @@
   | style="width:15%; background:#cccccc" align="center"|Project Contributors<br>(if applicable)
   | style="width:10%; background:#cccccc" align="center"|Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-access-control-rules-tester-project '''Subscribe here''']<br>[mailto:owasp-access-control-rules-tester-project@lists.owasp.org '''Use here''']
-  | style="width:17%; background:#cccccc" align="center"|License<br>[http://creativecommons.org/licenses/by-sa/3.0/ '''Creative Commons Attribution Share Alike 3.0''']
+  | style="width:17%; background:#cccccc" align="center"|License<br>[http://www.gnu.org/licenses/old-licenses/gpl-2.0.html '''GNU General Public License v2''']
   | style="width:14%; background:#cccccc" align="center"|Project Type<br>[[:Category:OWASP_Project#Beta_Status_Projects|'''Tool''']]
   | style="width:15%; background:#cccccc" align="center"|Sponsors<br>[[OWASP Summer of Code 2008|'''OWASP SoC 08''']]

@@ Line 1: / Line 1: @@
 {| style="width:100%" border="0" align="center"
   ! colspan="8" align="center" style="background:#4058A0; color:white"|<font color="white">'''PROJECT IDENTIFICATION'''
@@ Line 34: / Line 35: @@
 If any, add link here
   |}
 ----