Testing Checklist - Revision history

Andrew Muller at 12:10, 8 August 2014

2014-08-08T12:10:27Z

Andrew Muller: Edit Business Logic and Client Side headings

2014-08-05T15:24:25Z

Edit Business Logic and Client Side headings

Jane O'Connor: Added Andrew's changes.

2014-08-01T18:19:03Z

Added Andrew's changes.

Jane O'Connor: Removed reference to logging section. Final edit.

2014-05-13T09:21:42Z

Removed reference to logging section. Final edit.

Davide Danelon at 17:41, 4 March 2014

2014-03-04T17:41:53Z

Show changes

Dan Vasile at 14:57, 16 January 2014

2014-01-16T14:57:39Z

Show changes

Glenn 'devalias' Grant: Converted 'Information Gathering' to use wiki table style (initial)

2013-09-17T23:41:32Z

Converted 'Information Gathering' to use wiki table style (initial)

Mmeucci at 14:41, 9 October 2012

2012-10-09T14:41:12Z

Mmeucci at 08:44, 23 March 2009

2009-03-23T08:44:59Z

KirstenS at 15:39, 14 December 2008

2008-12-14T15:39:26Z

@@ Line 24: / Line 24: @@
 | 4.2.6||OTG-INFO-006||Identify application entry points
 |-
-| 4.2.7||OTG-INFO-008||Map execution paths through application
+| 4.2.7||OTG-INFO-007||Map execution paths through application
 |-
-| 4.2.8||OTG-INFO-009||Fingerprint Web Application Framework
+| 4.2.8||OTG-INFO-008||Fingerprint Web Application Framework
 |-
-| 4.2.9||OTG-INFO-010||Fingerprint Web Application
+| 4.2.9||OTG-INFO-009||Fingerprint Web Application
 |-
-| 4.2.10||OTG-INFO-011||Map Application Architecture
+| 4.2.10||OTG-INFO-010||Map Application Architecture
 |-
 | ||||
@@ Line 48: / Line 48: @@
 | 4.3.6||OTG-CONFIG-006||Test HTTP Methods
 |-
-| 4.3.7||OTG-CONFIG-009||Test HTTP Strict Transport Security
+| 4.3.7||OTG-CONFIG-007||Test HTTP Strict Transport Security
 |-
-| 4.3.8||OTG-CONFIG-011||Test RIA cross domain policy
+| 4.3.8||OTG-CONFIG-008||Test RIA cross domain policy
 |-
 | ||||
@@ Line 98: / Line 98: @@
 | 4.6||||'''Authorization Testing'''
 |-
-| 4.6.1||OTG-AUTHZ-002||Testing Directory traversal/file include
+| 4.6.1||OTG-AUTHZ-001||Testing Directory traversal/file include
 |-
-| 4.6.2||OTG-AUTHZ-003||Testing for bypassing authorization schema
+| 4.6.2||OTG-AUTHZ-002||Testing for bypassing authorization schema
 |-
-| 4.6.3||OTG-AUTHZ-004||Testing for Privilege Escalation
+| 4.6.3||OTG-AUTHZ-003||Testing for Privilege Escalation
 |-
-| 4.6.4||OTG-AUTHZ-005||Testing for Insecure Direct Object References
+| 4.6.4||OTG-AUTHZ-004||Testing for Insecure Direct Object References
 |-
 | ||||
@@ Line 112: / Line 112: @@
 | 4.7.1||OTG-SESS-001 ||Testing for Bypassing Session Management Schema
 |-
-| 4.7.2||OTG-SESS-002||Testing for Cookies attributes
+| 4.7.2||OTG-SESS-002 ||Testing for Cookies attributes
 |-
-| 4.7.3||OTG-SESS-003||Testing for Session Fixation
+| 4.7.3||OTG-SESS-003 ||Testing for Session Fixation
 |-
-| 4.7.4||OTG-SESS-004||Testing for Exposed Session Variables
+| 4.7.4||OTG-SESS-004 ||Testing for Exposed Session Variables
 |-
-| 4.7.5||OTG-SESS-005||Testing for Cross Site Request Forgery
+| 4.7.5||OTG-SESS-005 ||Testing for Cross Site Request Forgery
 |-
-| 4.7.6||OTG-SESS-007 ||Testing for logout functionality
+| 4.7.6||OTG-SESS-006 ||Testing for logout functionality
 |-
-| 4.7.7||OTG-SESS-008||Test Session Timeout
+| 4.7.7||OTG-SESS-007 ||Test Session Timeout
 |-
-| 4.7.8||OTG-SESS-010||Testing for Session puzzling
+| 4.7.8||OTG-SESS-008 ||Testing for Session puzzling
 |-
 | ||||
@@ Line 138: / Line 138: @@
 | 4.8.4||OTG-INPVAL-004||Testing for HTTP Parameter pollution
 |-
-| 4.8.5||OTG-INPVAL-006||Testing for SQL Injection
+| 4.8.5||OTG-INPVAL-005||Testing for SQL Injection
 |-
 | 4.8.5.1||||Oracle Testing
@@ Line 152: / Line 152: @@
 | 4.8.5.6||||Testing for NoSQL injection
 |-
-| 4.8.6||OTG-INPVAL-007||Testing for LDAP Injection
+| 4.8.6||OTG-INPVAL-006||Testing for LDAP Injection
 |-
-| 4.8.7||OTG-INPVAL-008||Testing for ORM Injection
+| 4.8.7||OTG-INPVAL-007||Testing for ORM Injection
 |-
-| 4.8.8||OTG-INPVAL-009||Testing for XML Injection
+| 4.8.8||OTG-INPVAL-008||Testing for XML Injection
 |-
-| 4.8.9||OTG-INPVAL-010||Testing for SSI Injection
+| 4.8.9||OTG-INPVAL-009||Testing for SSI Injection
 |-
-| 4.8.10||OTG-INPVAL-011||Testing for XPath Injection
+| 4.8.10||OTG-INPVAL-010||Testing for XPath Injection
 |-
-| 4.8.11||OTG-INPVAL-012||IMAP/SMTP Injection
+| 4.8.11||OTG-INPVAL-011||IMAP/SMTP Injection
 |-
-| 4.8.12||OTG-INPVAL-013||Testing for Code Injection
+| 4.8.12||OTG-INPVAL-012||Testing for Code Injection
 |-
 | 4.8.12.1||||Testing for Local File Inclusion
@@ Line 170: / Line 170: @@
 | 4.8.12.2||||Testing for Remote File Inclusion
 |-
-| 4.8.13||OTG-INPVAL-014||Testing for Command Injection
+| 4.8.13||OTG-INPVAL-013||Testing for Command Injection
 |-
-| 4.8.14||OTG-INPVAL-015||Testing for Buffer overflow
+| 4.8.14||OTG-INPVAL-014||Testing for Buffer overflow
 |-
 | 4.8.14.1||||Testing for Heap overflow
@@ Line 180: / Line 180: @@
 | 4.8.14.3||||Testing for Format string
 |-
-| 4.8.15||OTG-INPVAL-016||Testing for incubated vulnerabilities
+| 4.8.15||OTG-INPVAL-015||Testing for incubated vulnerabilities
 |-
-| 4.8.16||OTG-INPVAL-017||Testing for HTTP Splitting/Smuggling
+| 4.8.16||OTG-INPVAL-016||Testing for HTTP Splitting/Smuggling
 |-
 | ||||
@@ Line 198: / Line 198: @@
 | 4.10.1||OTG-CRYPST-001||Testing for Weak SSL/TSL Ciphers,  Insufficient Transport Layer Protection
 |-
-| 4.10.2||OTG-CRYPST-003||Testing for Padding Oracle
+| 4.10.2||OTG-CRYPST-002||Testing for Padding Oracle
 |-
-| 4.10.3||OTG-CRYPST-007||Testing for Sensitive information sent via unencrypted channels
+| 4.10.3||OTG-CRYPST-003||Testing for Sensitive information sent via unencrypted channels
 |-
 | ||||

@@ Line 204: / Line 204: @@
 | ||||
 |-
-| 4.11||OWASP-BL-001||'''Business Logic Testing'''
+| 4.11|| ||'''Business Logic Testing'''
 |-
 | 4.11.1||OTG-BUSLOGIC-001||Test Business Logic Data Validation
@@ Line 230: / Line 230: @@
 | 4.12.1||OTG-CLIENT-001||Testing for DOM based Cross Site Scripting
 |-
-| 4.12.2||OTG-CS-002||Testing for JavaScript Execution
+| 4.12.2||OTG-CLIENT-002||Testing for JavaScript Execution
 |-
-| 4.12.3||OTG-CS-003||Testing for HTML Injection
+| 4.12.3||OTG-CLIENT-003||Testing for HTML Injection
 |-
-| 4.12.4||OTG-CS-004 ||Testing for Client Side URL Redirect
+| 4.12.4||OTG-CLIENT-004 ||Testing for Client Side URL Redirect
 |-
-| 4.12.5||OTG-CS-005||Testing for CSS Injection
+| 4.12.5||OTG-CLIENT-005||Testing for CSS Injection
 |-
-| 4.12.6||OTG-CS-006||Testing for Client Side Resource Manipulation
+| 4.12.6||OTG-CLIENT-006||Testing for Client Side Resource Manipulation
 |-
 | 4.12.7||OTG-CLIENT-007||Test Cross Origin Resource Sharing

@@ Line 30: / Line 30: @@
 | 4.2.9||OTG-INFO-010||Fingerprint Web Application
 |-
-| 4.2.10||OTG-INFO-011||Map Network and Application Architecture
+| 4.2.10||OTG-INFO-011||Map Application Architecture
 |-
 | ||||
@@ Line 230: / Line 230: @@
 | 4.12.1||OTG-CLIENT-001||Testing for DOM based Cross Site Scripting
 |-
-| 4.12.2||OWASP-CS-002||Testing for JavaScript Execution
+| 4.12.2||OTG-CS-002||Testing for JavaScript Execution
 |-
-| 4.12.3||OWASP-CS-003||Testing for HTML Injection
+| 4.12.3||OTG-CS-003||Testing for HTML Injection
 |-
-| 4.12.4||OWASP-CS-004 ||Testing for Client Side URL Redirect
+| 4.12.4||OTG-CS-004 ||Testing for Client Side URL Redirect
 |-
-| 4.12.5||OWASP-CS-005||Testing for CSS Injection
+| 4.12.5||OTG-CS-005||Testing for CSS Injection
 |-
-| 4.12.6||OWASP-CS-006||Testing for Client Side Resource Manipulation
+| 4.12.6||OTG-CS-006||Testing for Client Side Resource Manipulation
 |-
 | 4.12.7||OTG-CLIENT-007||Test Cross Origin Resource Sharing

@@ Line 194: / Line 194: @@
 | ||||
 |-
-| 4.1||||'''Cryptography'''
+| 4.10||||'''Cryptography'''
 |-
 | 4.10.1||OTG-CRYPST-001||Testing for Weak SSL/TSL Ciphers,  Insufficient Transport Layer Protection
@@ Line 204: / Line 204: @@
 | ||||
 |-
-| 4.11||||'''Logging'''
+| 4.11||OWASP-BL-001||'''Business Logic Testing'''
 |-
-| 4.11.1||OTG-LOG-001||Test time synchronisation
+| 4.11.1||OTG-BUSLOGIC-001||Test Business Logic Data Validation
 |-
-| 4.11.2||OTG-LOG-002||Test user-viewable log of authentication events
+| 4.11.2||OTG-BUSLOGIC-002||Test Ability to Forge Requests
 |-
-| ||||
+| 4.11.3||OTG-BUSLOGIC-003||Test Integrity Checks
 |-
-| 4.12.4||OTG-BUSLOGIC-004||Test for Process Timing
+| 4.11.4||OTG-BUSLOGIC-004||Test for Process Timing
 |-
-| 4.12.5||OTG-BUSLOGIC-005||Test Number of Times a Function Can be Used Limits
+| 4.11.5||OTG-BUSLOGIC-005||Test Number of Times a Function Can be Used Limits
 |-
-| 4.12.6||OTG-BUSLOGIC-006||Testing for the Circumvention of Work Flows
+| 4.11.6||OTG-BUSLOGIC-006||Testing for the Circumvention of Work Flows
 |-
-| 4.12.7||OTG-BUSLOGIC-007||Test Defenses Against Application Mis-use
+| 4.11.7||OTG-BUSLOGIC-007||Test Defenses Against Application Mis-use
 |-
-| 4.12.8||OTG-BUSLOGIC-008||Test Upload of Unexpected File Types
+| 4.11.8||OTG-BUSLOGIC-008||Test Upload of Unexpected File Types
 |-
-| 4.12.9||OTG-BUSLOGIC-009||Test Upload of Malicious Files
+| 4.11.9||OTG-BUSLOGIC-009||Test Upload of Malicious Files
 |-
 | ||||
 |-
-| 4.15||||'''Client Side Testing'''
+| 4.12||||'''Client Side Testing'''
 |-
-| 4.15.1||OTG-CLIENT-001||Testing for DOM based Cross Site Scripting
+| 4.12.1||OTG-CLIENT-001||Testing for DOM based Cross Site Scripting
 |-
-| 4.15.2||OWASP-CS-002||Testing for JavaScript Execution
+| 4.12.2||OWASP-CS-002||Testing for JavaScript Execution
 |-
-| 4.15.3||OWASP-CS-003||Testing for HTML Injection
+| 4.12.3||OWASP-CS-003||Testing for HTML Injection
 |-
-| 4.15.4||OWASP-CS-004 ||Testing for Client Side URL Redirect
+| 4.12.4||OWASP-CS-004 ||Testing for Client Side URL Redirect
 |-
-| 4.15.5||OWASP-CS-005||Testing for CSS Injection
+| 4.12.5||OWASP-CS-005||Testing for CSS Injection
 |-
-| 4.15.6||OWASP-CS-006||Testing for Client Side Resource Manipulation
+| 4.12.6||OWASP-CS-006||Testing for Client Side Resource Manipulation
 |-
-| 4.15.7||OTG-CLIENT-007||Test Cross Origin Resource Sharing
+| 4.12.7||OTG-CLIENT-007||Test Cross Origin Resource Sharing
 |-
-| 4.15.8||OTG-CLIENT-008||Testing for Cross Site Flashing
+| 4.12.8||OTG-CLIENT-008||Testing for Cross Site Flashing
 |-
-| 4.15.9||OTG-CLIENT-009||Testing for Clickjacking
+| 4.12.9||OTG-CLIENT-009||Testing for Clickjacking
 |-
-| 4.15.10||OTG-CLIENT-010||Testing WebSockets
+| 4.12.10||OTG-CLIENT-010||Testing WebSockets
 |-
-| 4.15.11||OTG-CLIENT-011||Test Web Messaging
+| 4.12.11||OTG-CLIENT-011||Test Web Messaging
 |-
-| 4.15.12||OTG-CLIENT-012||Test Local Storage
+| 4.12.12||OTG-CLIENT-012||Test Local Storage
 |-
+|
 |}

@@ Line 3: / Line 3: @@
 The following is the list of controls to test during the assessment:
- '''Category	-  Ref. Number	 -  Test Name	-   Vulnerability'''
+{|
+|colspan="4" style="text-align:center; font-weight: bold;"| Information Gathering
+|-
-'''Information Gathering	''' <br>
+! Category	!!  Ref. Number	 !!  Test Name	!!   Vulnerability
-OWASP-IG-001	- 4.2.1 Spiders, Robots and Crawlers 	- N.A.
+|-
+| OWASP-IG-001 || 4.2.1 || Spiders, Robots and Crawlers            || N.A.
-OWASP-IG-002	- 4.2.2 Search Engine Discovery/Reconnaissance 	- N.A.
+|-
+| OWASP-IG-002 || 4.2.2 || Search Engine Discovery/Reconnaissance  || N.A.
-OWASP-IG-003	- 4.2.3 Identify application entry points 	- N.A.
+|-
+| OWASP-IG-003 || 4.2.3 || Identify application entry points       || N.A.
-OWASP-IG-004	- 4.2.4 Testing for Web Application Fingerprint 	- N.A.
+|-
+| OWASP-IG-004 || 4.2.4 || Testing for Web Application Fingerprint || N.A.
-OWASP-IG-005	- 4.2.5 Application Discovery 	- N.A.
+|-
+| OWASP-IG-005 || 4.2.5 || Application Discovery                   || N.A.
-OWASP-IG-006	- 4.2.6 Analysis of Error Codes	- Information Disclosure
+|-
+| OWASP-IG-006 || 4.2.6 || Analysis of Error Codes                 || Information Disclosure
 '''Configuration Management Testing	'''

← Older revision		Revision as of 14:41, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	The following is the list of controls to test during the assessment:		The following is the list of controls to test during the assessment:

@@ Line 37: / Line 37: @@
 OWASP-CM-008	- 4.3.8 Testing for HTTP Methods and XST	- HTTP Methods enabled, XST permitted, HTTP Verb
@@ Line 62: / Line 61: @@
 OWASP-AT-010 - 4.4.10 Testing for Race Conditions - Race Conditions vulnerability
 '''Session Management	'''
@@ Line 74: / Line 74: @@
 OWASP-SM-005	- 4.5.5 Testing for CSRF 	                        - CSRF
@@ Line 90: / Line 88: @@
 OWASP-BL-001	- 4.7 Testing for Business Logic	- Bypassable business logic
@@ Line 126: / Line 123: @@
 OWASP-DV-016	- 4.8.16 Testing for HTTP Splitting/Smuggling	- HTTP Splitting, Smuggling
 '''Denial of Service Testing	'''

@@ Line 22: / Line 22: @@
 '''Configuration Management Testing	'''
-OWASP-CM-001	- 4.3.1 SSL/TLS Testing (SSL Version, Algorithms, Key lenght, Digital Cert. Validity)	- SSL Weakness
+OWASP-CM-001	- 4.3.1 SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)	- SSL Weakness
 OWASP-CM-002	- 4.3.2 DB Listener Testing 	- DB Listener weak