Winter Of Security - Revision history

Psiinon: Redirected page to Code Wind

2014-06-04T11:54:56Z

Redirected page to Code Wind

Show changes

Spyros Gasteratos at 20:41, 1 June 2014

2014-06-01T20:41:18Z

Spyros Gasteratos at 20:38, 1 June 2014

2014-06-01T20:38:32Z

Spyros Gasteratos at 20:35, 1 June 2014

2014-06-01T20:35:19Z

Abraham Aranguren at 17:33, 29 May 2014

2014-05-29T17:33:53Z

Spyros Gasteratos at 23:26, 28 May 2014

2014-05-28T23:26:38Z

Spyros Gasteratos at 23:26, 28 May 2014

2014-05-28T23:26:06Z

Spyros Gasteratos: Created page with "WARNING!: This page is a draft in progress, it only contains some thoughts about the project. Feel free to edit OWASP Winter Of Security Foreword -- placeholder for some c..."

2014-05-26T21:16:00Z

Created page with "WARNING!: This page is a draft in progress, it only contains some thoughts about the project. Feel free to edit OWASP Winter Of Security Foreword -- placeholder for some c..."

New page

WARNING!:
This page is a draft in progress, it only contains some thoughts about the project. Feel free to edit

OWASP Winter Of Security

Foreword

-- placeholder for some cool-looking motivational foreword --

Poject Goal

The goal of OWOS is to give students the opportunity to earn academic credits while they learn about computer security.

Benefits

You get to work for a popular project.
Since the project is open source your work is publicly visible.
You get university credits while doing so.
You are supervised by a person with real-world experience on security
You make excellent contacts and you participate in an international team

How it works:
(borrowed from the mozilla blog)
Winter of Security, so called because we want students to get involved 800px-Redpandas4430roughly between September and April. Each project has an advisor from Mozilla who will be dedicating a few hours every week to the students. We also ask that a professor oversees the team from a university point of view, and ensures the projects align with their curriculum.
Anyone can apply, under the condition that the university will give class credits and a grade for the work done in MWoS.
Links to page no2 with roughly the same content as this https://wiki.mozilla.org/Security/Automation/WinterOfSecurity2014

How you can participate
Student
Get in touch with the people responsible for the projects listed here(link to the project's page)
Pick a project or propose your own
(how's it going to be with the professors? are the students going to arrange everything or they get us in touch with their profs?)

Profesor
Send an email to the people responsible for the projects you are interest in.

@@ Line 147: / Line 147: @@
 ''' * Your solution here * '''
 ''' Expected results '''
-You should be able to run a big enough subset of OWASP WebGoat PHP with minimal modification as a Hackademic Challenge
+You should be able to upload a trully vulnerable web application as a hackademic challenge without compromising the server outside the sandbox.
 === OWASP Hackademic Challenges - CMS improvements ===
@@ Line 159: / Line 156: @@
 '''Brief Explanation:'''
-The new CMS was created during last year's GSOC. We have received feedback from users that suggest various improvements regarding functionality e.g. better user, teacher and challenges management. There are also some security improvements that are needed and in general any functionality that adds up to the educational nature of the project is more than welcome.
+The new CMS was created during 2012 GSOC. We have received feedback from users that suggest various improvements regarding functionality e.g. better user, teacher and challenges management. There are also some security improvements that are needed and in general any functionality that adds up to the educational nature of the project is more than welcome.
+For a complete list you can take a look at the issues in our github page here https://github.com/Hackademic/hackademic
 Ideas on this project:

← Older revision		Revision as of 20:38, 1 June 2014
Line 107:		Line 107:

	'''Mentor: Abraham Aranguren - OWASP OWTF Project Leader - Contact: name.surname@owasp.org'''		'''Mentor: Abraham Aranguren - OWASP OWTF Project Leader - Contact: name.surname@owasp.org'''
		+
		+
		+	=== OWASP Hackademic Challenges - Source Code testing environment ===
		+
		+	'''Brief Explanation:'''
		+
		+	Existing challenges are based on a dynamic application testing concept. We would like to work on a project that will give the capability to the attacker to review a vulnerable piece of source code, make corrections and see the result in a realistic (but yet safe) runtime environment. The code can either be run if needed or tested for correctness and security. The implementation challenges of such a project can be numerous, including creating a realistic but also secure environment, testing submitted solutions and grading them in an automatic manner. At the same time there are now numerous sites that support submitting code and then simulate or implement a compiler's functionality.
		+
		+	'''Expected Results:'''
		+
		+	A source code testing and improvement environment where a user will be able to review, improve and test the result of a piece of source code.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	Comfortable in PHP, HTML and possibly Java. Good understanding of Application Security, source code analysis and related vulnerabilities.
		+
		+	'''Mentors:''' Konstantinos Papapanagiotou, Spyros Gasteratos - Hackademic Challenges Project Leaders
		+
		+	=== OWASP Hackademic Challenges - Challenge Sandbox ===
		+
		+	Now, in order to create a challenge, one has to validate the solution with regular expressions (or just plaintext comparison) and report success or failure to the backend,
		+	we'd like the ability to write a normal vulnerable web application as a challenge and leave it to hackademic to make sure that the server is not affected.
		+	Since this is probably the most difficult task proposed, if you are considering it, please get in touch with us early on so we can discuss about it and plan it correctly.
		+
		+	Ideas on the project:
		+
		+	''' Administrator's point of view '''
		+
		+	Create an infrastructure that spawns virtual environments for users while keeping the load reasonable on the server(s).
		+	Or configure apache,php,mysql in a way that allows for multiple instances of the programms to run in parallel completely seperated from the rest of the server.
		+	The student is expected to provide configuration scripts that do the above
		+
		+	''' Coder's Way '''
		+
		+	This is better explained with an example:
		+	In order to create an sql injection challenge one should be able to call a common unsecure mysql execute statement function.
		+	The student can override common functions like this providing their own implementation of a very temporary database (based on flat files or nosql solutions e.t.c.).
		+	The new functions should be able to detect the sqli and apply its results in a secure way(if the student drops a table no actual tables should be dropped but the table should not be visible to the student anymore).
		+
		+	''' * Your solution here * '''
		+
		+	The above solutions are by no way complete,their intention is to start you thinking.
		+	This is a difficult task so if you consider takling it talk to us early on so we can reach a good solution which is possible in the GSoC timeframe.
		+
		+	''' Expected results '''
		+
		+	You should be able to run a big enough subset of OWASP WebGoat PHP with minimal modification as a Hackademic Challenge
		+
		+	=== OWASP Hackademic Challenges - CMS improvements ===
		+
		+	'''Brief Explanation:'''
		+
		+	The new CMS was created during last year's GSOC. We have received feedback from users that suggest various improvements regarding functionality e.g. better user, teacher and challenges management. There are also some security improvements that are needed and in general any functionality that adds up to the educational nature of the project is more than welcome.
		+
		+	Ideas on this project:
		+
		+	* ''' Template''' *
		+
		+	Since it's creation the project has received a good number of new features, but the visual/ux/ui part has never gotten much love.
		+	It would be good if we had a new template with proper ui design.
		+
		+	* '''Questionaire creation plugin''' *
		+
		+	We'd like the admin to be able to create questionaires, assign rules for each question (e.g. correct answer +2pts incorrect answer -2, no answer 0) and assign them to students as homework/exams.
		+	The grading can either be done automatically (for multiple choice) or be submitted to the creator of the questionaire.
		+
		+	* '''Ability to show different articles on the user's home screen'''
		+
		+	Now each user is served the latest article in her/his home screen. We need the ability for either the teacher/admin to be able to define what article each class is served.
		+
		+	* '''Gamification of the user's progress''' *
		+
		+	A series of plugins and a template which allow the user to earn badges as they solve challenges and a better visual representation of their progress.
		+
		+	* '''Ability to define series of challenges'''
		+
		+	The teacher/admin should be able to define a series of challenges (e.g. 2,5,3,1) which are meant to be solved in that order and if one is not solved then the student can't try the next one.
		+
		+	* ''' Tagging of articles, users, challenges '''
		+
		+	A user should be able to put tags on articles and challenges if he is a student and on users, classes, articles and challenges if he is a teacher.
		+	Also the user should be able to search according to the tags.
		+
		+	* '''Your idea here'''
		+
		+	We welcome new ideas to make the project look awesome.
		+
		+	'''Expected Results:'''
		+
		+	New features and security improvements on the CMS part of the project.
		+
		+	'''Knowledge Prerequisites:'''
		+
		+	Comfortable in PHP and HTML. Good understanding of Application Security and related vulnerabilities if you undertake security improvements.
		+
		+	'''Mentors:''' Konstantinos Papapanagiotou, Spyros Gasteratos - Hackademic Challenges Project Leaders

@@ Line 1: / Line 1: @@
-== OWASP Winter Of Security ==
+== OWASP Winter Of Code ==
 == Foreword ==
-The OWASP Winter of Security (OWOS) is a program to involve students with Security projects. By participating in OWOS a student can get real life experience while contributing to an open source project and getting university credits.
+The OWASP Winter Of Code (OWOC) is a program to involve students with Security projects. By participating in OWOS a student can get real life experience while contributing to an open source project and getting university credits.
 == Benefits ==
@@ Line 14: / Line 23: @@
 You are supervised by a person with real-world experience on security
 You make excellent contacts and you participate in an international team
 == How it works: ==
@@ Line 27: / Line 40: @@
 === Student ===
 Get in touch with the people responsible for the projects listed here(link to the project's page)
 Pick a project or propose your own
 --Note: (how's it going to be with the professors? are the students going to arrange everything or they get us in touch with their profs?)
-=== Profesor ===
+=== Proffesor ===
 Send an email to the people responsible for the projects you are interest in.

← Older revision		Revision as of 17:33, 29 May 2014
Line 40:		Line 40:

	== List With proposed projects ==		== List With proposed projects ==
		+
		+	=== OWASP OWTF - Testing Framework Improvements ===
		+
		+	'''Brief explanation:'''
		+
		+	As OWASP OWTF grows it makes sense to build custom unit tests to automatically re-test that functionality has not been broken. In this project we would like to improve the existing unit testing framework so that creating OWASP OWTF unit tests is as simple as possible and all missing tests for new functionality are created. The goal of this project is to update the existing Unit Test Framework to create all missing tests as well as improve the existing ones to verify OWASP OWTF functionality in an automated fashion.
		+
		+
		+	'''Top features'''
		+
		+	In this improvement phase, the Testing Framework should:
		+	* (Top Prio) Focus more on functional tests
		+	For example: Improve coverage of OWASP Testing Guide, PTES, etc. (lots of room for improvement there!)
		+	* (Top Prio) Put together a great wiki documentation section for contributors
		+	The goal here is to help contributors write tests for the functionality that they implement. This should be as easy as possible.
		+	* (Top Prio) Fix the current Travis issues :)
		+	* (Nice to have) Bring the unit tests up to speed with the codebase
		+	This will be challenging but very worth trying after top priorities.
		+	The wiki should be heavily updated so that contributors create their own unit tests easily moving forward.
		+
		+
		+	'''General background'''
		+
		+	The Unit Test Framework should be able to:
		+	* Define test categories: For example, "all plugins", "web plugins", "aux plugins", "test framework core", etc. (please see [http://www.slideshare.net/abrahamaranguren/introducing-owasp-owtf-workshop-brucon-2012 this presentation] for more background)
		+	* Allow to regression test isolated plugins (i.e. "only test _this_ plugin")
		+	* Allow to regression test by test categories (i.e. "test only web plugins")
		+	* Allow to regression test everything (i.e. plugins + framework core: "test all")
		+	* Produce meaningful statistics and easy to navigate logs to identify which tests failed and ideally also hints on how to potentially fix the problem where possible
		+	* Allow for easy creation of _new_ unit tests specific to OWASP OWTF
		+	* Allow for easy modification and maintenance of _existing_ unit tests specific to OWASP OWTF
		+	* Perform well so that we can run as many tests as possible in a given period of time
		+	* Potentially leverage the python unittest library: [http://docs.python.org/2/library/unittest.html http://docs.python.org/2/library/unittest.html]
		+
		+
		+	For background on OWASP OWTF please see: [https://www.owasp.org/index.php/OWASP_OWTF https://www.owasp.org/index.php/OWASP_OWTF]
		+
		+
		+	'''Expected results:'''
		+
		+	* '''IMPORTANT: [http://legacy.python.org/dev/peps/pep-0008/ PEP-8 compliant code] in all modified code and surrounding areas.'''
		+	* '''IMPORTANT: [https://github.com/7a/owtf/wiki/Contributor%27s-README OWTF contributor README compliant code]'''
		+	* Performant and automated regression testing
		+	* Unit tests for a wide coverage of OWASP OWTF, ideally leveraging the Unit Test Framework where possible
		+	* Good documentation
		+
		+
		+	'''Knowledge Prerequisite:'''
		+
		+	Python, experience with unit tests and automated regression testing would be beneficial, some previous exposure to security concepts and penetration testing is welcome but not strictly necessary as long as there is will to learn
		+
		+
		+	'''Mentor: Abraham Aranguren - OWASP OWTF Project Leader - Contact: name.surname@owasp.org'''

@@ Line 26: / Line 26: @@
 == How you can participate: ==
- === Student ===
+=== Student ===
 Get in touch with the people responsible for the projects listed here(link to the project's page)
 Pick a project or propose your own
@@ Line 34: / Line 34: @@
 Send an email to the people responsible for the projects you are interest in.