Web Application Security Testing Cheat Sheet - Revision history

Dominique RIGHETTO: Migration to GitHub of the project

2019-02-16T10:27:39Z

Migration to GitHub of the project

Show changes

Christina Schelin: Some updates to grammar.

2017-12-29T17:55:58Z

Some updates to grammar.

Show changes

Jmanico at 06:16, 11 September 2017

2017-09-11T06:16:54Z

VinMiller: /* Authors and contributors */

2015-12-06T19:57:11Z

‎Authors and contributors

VinMiller: /* Authors and contributors */

2015-12-06T19:56:48Z

‎Authors and contributors

VinMiller at 19:56, 6 December 2015

2015-12-06T19:56:01Z

VinMiller at 19:51, 6 December 2015

2015-12-06T19:51:41Z

VinMiller at 19:41, 6 December 2015

2015-12-06T19:41:15Z

VinMiller at 19:40, 6 December 2015

2015-12-06T19:40:30Z

VinMiller at 19:39, 6 December 2015

2015-12-06T19:39:09Z

@@ Line 193: / Line 193: @@
-= Appendices =
+= Other Formats =
 * DradisPro template format [https://github.com/raesene/OWASP_Web_App_Testing_Cheatsheet_Converter/blob/master/OWASP_Web_Application_Testing_Cheat_Sheet.xml on github]
 * Asana template on [http://templana.com/templates/owasp-website-security-checklist/ Templana] (thanks to Bastien Siebman)
-== Authors and contributors ==
+= Authors and contributors =
 [[User:Simon Bennetts|Simon Bennetts]]<br/>
@@ Line 213: / Line 211: @@
 [[User:VinMiller | Vin Miller]]
-== Related articles ==
+= Related articles =
 * OWASP [[:Category:OWASP Testing Project|Testing Guide]]
 * Mozilla [https://wiki.mozilla.org/WebAppSec/Web_Security_Verification Web Security Verification]
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation}}
 [[Category:Cheatsheets]] [[Category:OWASP_Breakers]]

@@ Line 210: / Line 210: @@
 [[User:Ryan_Dewhurst|Ryan Dewhurst]]<br/>
-[[User:Frank.catucci | Frank Catucci]]
+[[User:Frank.catucci | Frank Catucci]]<br/>
 [[User:VinMiller | Vin Miller]]

@@ Line 212: / Line 212: @@
 [[User:Frank.catucci | Frank Catucci]]
 [[User:VinMiller | Vin Miller]]
 == Related articles ==

@@ Line 154: / Line 154: @@
 * [[Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-009) | Test for the Circumvention of Work Flows]]
 * [[Test_defenses_against_application_mis-use_(OTG-BUSLOGIC-011) | Test Defenses Against Application Mis-use]]
 * [[Test_Local_Storage_(OTG-CLIENT-012)|Test for Web Storage SQL injection (HTML5)]]
 * [[HTML5_Security_Cheat_Sheet#Offline_Applications | Check Offline Web Application]]
@@ Line 174: / Line 176: @@
 * Test that uploaded files are not served on the same hostname/port
 * Test that files and other media are integrated with the authentication and authorisation schemas
 ''Payments''
 * Test for known vulnerabilities and configuration issues on Web Server and Web Application
@@ Line 192: / Line 192: @@
 * [[Testing_for_Stack_Traces_(OTG-ERR-002)|Check for Stack Traces]]
 = Appendices =

@@ Line 47: / Line 47: @@
 * Test for [[List_of_useful_HTTP_headers | security HTTP headers]] (e.g. CSP, X-Frame-Options, HSTS)
 * Test for policies (e.g. Flash, Silverlight, robots)
 * Check for sensitive data in client-side code (e.g. API keys, credentials)
 == Secure Transmission ==
 * [[Testing_for_Weak_SSL/TLS_Ciphers,_Insufficient_Transport_Layer_Protection_(OTG-CRYPST-001) | Check SSL Version, Algorithms, Key length]]
 * Check for Digital Certificate Validity (Duration, Signature and CN)
@@ Line 57: / Line 57: @@
 * Check session tokens only delivered over HTTPS
 * [[Test_HTTP_Strict_Transport_Security_(OTG-CONFIG-009) | Check if HTTP Strict Transport Security (HSTS) in use]]
 == Authentication ==
@@ Line 108: / Line 115: @@
 * [[Password_Storage_Cheat_Sheet#Use_a_cryptographically_strong_credential-specific_salt | Check for proper use of salting]]
 * [[Insecure_Randomness | Check for randomness functions]]
 == Data Validation ==
-* [[Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)|Test for Reflected Cross Site Scripting]]
+''Injection''
 * Test for HTML Injection
 * [[Testing_for_SQL_Injection_(OTG-INPVAL-005)|Test for SQL Injection]]
@@ Line 128: / Line 131: @@
 * Test for Expression Language Injection
 * [[Testing_for_Command_Injection_(OTG-INPVAL-013)|Test for Command Injection]]
 * Test for Overflow ([[Testing_for_Stack_Overflow|Stack]], [[Testing_for_Heap_Overflow|Heap]] and Integer)
 * [[Testing_for_Format_String|Test for Format String]]
@@ Line 137: / Line 147: @@
 * [[Testing_for_Remote_File_Inclusion|Test for Remote File Inclusion]]
 * Compare client-side and server-side validation rules
 * Test for HTTP parameter pollution
 * Test for auto-binding
 * Test for Mass Assignment
 * Test for NULL/Invalid Session Cookie
 == Denial of Service ==
@@ Line 148: / Line 162: @@
 * Test for HTTP protocol DoS
 * Test for SQL wildcard DoS
 == Specific Risky Functionality ==
@@ Line 171: / Line 169: @@
 * Test that file contents match the defined file type
 * [[Test_Upload_of_Malicious_Files_(OTG-BUSLOGIC-009)|Test that all file uploads have Anti-Virus scanning in-place.]]
-* Test that unsafe filenames are sanitised
+* [[Test_Upload_of_Malicious_Files_(OTG-BUSLOGIC-016) | Test upload of malicious files]]
 * Test that uploaded files are not directly accessible within the web root
 * Test that uploaded files are not served on the same hostname/port
@@ Line 180: / Line 179: @@
 * Test for known vulnerabilities and configuration issues on Web Server and Web Application
 * Test for default or guessable password
 * [[Injection_Flaws | Test for Injection vulnerabilities ]]
 * [[Testing_for_Buffer_Overflow_(OTG-INPVAL-014) | Test for Buffer Overflows]]
@@ Line 189: / Line 187: @@
 * Test for Authentication and Authorization issues
 * [[Testing_for_CSRF_(OTG-SESS-005)|Test for CSRF]]
 == Error Handling==
 * [[Testing_for_Error_Code_(OTG-ERR-001)|Check for Error Codes]]
 * [[Testing_for_Stack_Traces_(OTG-ERR-002)|Check for Stack Traces]]
 = Appendices =
 == Other Formats ==

@@ Line 101: / Line 101: @@
 * [[Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)|Test for missing authorisation]]
 * [[Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)|Test for Insecure Direct Object References]]
 == Data Validation ==
@@ Line 156: / Line 164: @@
 * [[Test_Upload_of_Malicious_Files_(OTG-BUSLOGIC-016) | Test upload of malicious files]]
-== Risky Functionality - File Uploads ==
+== Specific Risky Functionality ==
 * [[Test_Upload_of_Unexpected_File_Types_(OTG-BUSLOGIC-008)|Test that acceptable file types are whitelisted and non-whitelisted types are rejected]]
 * Test that file size limits, upload frequency and total file counts are defined and are enforced
@@ Line 173: / Line 176: @@
 * Test that files and other media are integrated with the authentication and authorisation schemas
-== Risky Functionality - Card Payment ==
+== Risky Functionality==
 * Test for known vulnerabilities and configuration issues on Web Server and Web Application
 * Test for default or guessable password