This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Testing Guide v3 Table of Contents"
| Line 8: | Line 8: | ||
Testing Guide v3 (draft) | Testing Guide v3 (draft) | ||
| − | Updated: | + | Updated: 1st November 2008 |
'''T A B L E o f C O N T E N T S''' | '''T A B L E o f C O N T E N T S''' | ||
| Line 56: | Line 56: | ||
'''3.7. A Typical SDLC Testing Workflow ''' | '''3.7. A Typical SDLC Testing Workflow ''' | ||
| − | ==[[Web Application Penetration Testing |4. | + | ==[[Web Application Penetration Testing |4. Web Application Penetration Testing ]]== |
[[Testing: Introduction and objectives|'''4.1 Introduction and Objectives''']] | [[Testing: Introduction and objectives|'''4.1 Introduction and Objectives''']] | ||
| − | [[Testing Checklist| | + | [[Testing Checklist| 4.1.1 Testing Checklist]] |
[[Testing: Information Gathering|'''4.2 Information Gathering''']] | [[Testing: Information Gathering|'''4.2 Information Gathering''']] | ||
| − | [[Testing: Spiders Robots and Crawlers| | + | [[Testing: Spiders Robots and Crawlers|4.2.1 Spiders, Robots and Crawlers]] |
| − | [[Testing: Search engine discovery| | + | [[Testing: Search engine discovery|4.2.2 Search Engine Discovery/Reconnaissance]] |
| − | [[Testing: Identify application entry points| | + | [[Testing: Identify application entry points|4.2.3 Identify application entry points]] |
[[Testing for Web Application Fingerprint|4.2.4 Testing for Web Application Fingerprint]] | [[Testing for Web Application Fingerprint|4.2.4 Testing for Web Application Fingerprint]] | ||
| Line 76: | Line 76: | ||
[[Testing for Error Code|4.2.6 Analysis of Error Codes]] | [[Testing for Error Code|4.2.6 Analysis of Error Codes]] | ||
| − | [[Testing for configuration management| | + | [[Testing for configuration management|4.3 Configuration Management Testing''']] |
[[Testing for SSL-TLS| 4.3.1 SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)]]<br> | [[Testing for SSL-TLS| 4.3.1 SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)]]<br> | ||
| Line 82: | Line 82: | ||
[[Testing for DB Listener|4.3.2 DB Listener Testing]] | [[Testing for DB Listener|4.3.2 DB Listener Testing]] | ||
| − | [[Testing for infrastructure configuration management| | + | [[Testing for infrastructure configuration management|4.3.3 Infrastructure Configuration Management Testing]] |
[[Testing for application configuration management|4.3.4 Application Configuration Management Testing]] | [[Testing for application configuration management|4.3.4 Application Configuration Management Testing]] | ||
| Line 90: | Line 90: | ||
[[Testing for old_file|4.3.6 Old, Backup and Unreferenced Files]] | [[Testing for old_file|4.3.6 Old, Backup and Unreferenced Files]] | ||
| − | [[Testing for Admin Interfaces| | + | [[Testing for Admin Interfaces|4.3.7 Infrastructure and Application Admin Interfaces]] |
| − | [[Testing for HTTP Methods and XST| | + | [[Testing for HTTP Methods and XST|4.3.8 Testing for HTTP Methods and XST]] |
| − | [[Testing for business logic|''' | + | [[Testing for business logic|'''4.4 Business Logic Testing''']] |
| − | [[Testing for authentication|''' | + | [[Testing for authentication|'''4.5 Authentication Testing''']] |
| − | [[Testing for credentials transport| | + | [[Testing for credentials transport|4.5.1 Credentials transport over an encrypted channel]] |
| − | [[Testing for user enumeration| | + | [[Testing for user enumeration|4.5.2 Testing for user enumeration]] |
| − | [[Testing for Default or Guessable User Account| | + | [[Testing for Default or Guessable User Account|4.5.3 Testing for Guessable (Dictionary) User Account]] |
[[Testing for Brute Force|4.5.4 Brute Force Testing]] | [[Testing for Brute Force|4.5.4 Brute Force Testing]] | ||
| Line 113: | Line 113: | ||
[[Testing for Logout and Browser Cache Management|4.5.7 Testing for Logout and Browser Cache Management Testing]] | [[Testing for Logout and Browser Cache Management|4.5.7 Testing for Logout and Browser Cache Management Testing]] | ||
| − | [[Testing for Captcha| | + | [[Testing for Captcha|4.5.8 Testing for CAPTCHA]] |
| − | [[Testing Multiple Factors Authentication| | + | [[Testing Multiple Factors Authentication|4.5.9 Testing Multiple Factors Authentication]] |
| − | [[Testing for Race Conditions| | + | [[Testing for Race Conditions|4.5.10 Testing for Race Conditions]] |
| − | [[Testing for Authorization|''' | + | [[Testing for Authorization|'''4.6 Authorization testing''']] |
| − | [[Testing for Path Traversal| | + | [[Testing for Path Traversal|4.6.1 Testing for path traversal]] |
| − | [[Testing for Bypassing Authorization Schema| | + | [[Testing for Bypassing Authorization Schema|4.6.2 Testing for bypassing authorization schema]] |
| − | [[Testing for Privilege escalation| | + | [[Testing for Privilege escalation|4.6.3 Testing for Privilege Escalation]] |
[[Testing for Session Management|'''4.7 Session Management Testing''']] | [[Testing for Session Management|'''4.7 Session Management Testing''']] | ||
| − | [[Testing for Session_Management_Schema| | + | [[Testing for Session_Management_Schema|4.7.1 Testing for Session Management Schema]] |
| − | [[Testing for cookies attributes| | + | [[Testing for cookies attributes|4.7.2 Testing for Cookies attributes]] |
| − | [[Testing for Session Fixation| | + | [[Testing for Session Fixation|4.7.3 Testing for Session Fixation]] |
[[Testing for Exposed Session Variables|4.7.4 Testing for Exposed Session Variables ]] | [[Testing for Exposed Session Variables|4.7.4 Testing for Exposed Session Variables ]] | ||
| Line 143: | Line 143: | ||
[[Testing for Data Validation|'''4.8 Data Validation Testing''']] | [[Testing for Data Validation|'''4.8 Data Validation Testing''']] | ||
| − | [[Testing for Reflected Cross site scripting| | + | [[Testing for Reflected Cross site scripting|4.8.1 Testing for Reflected Cross Site Scripting]] |
| − | [[Testing for Stored Cross site scripting| | + | [[Testing for Stored Cross site scripting|4.8.2 Testing for Stored Cross Site Scripting]] |
| − | [[Testing for DOM-based Cross site scripting| | + | [[Testing for DOM-based Cross site scripting|4.8.3 Testing for DOM based Cross Site Scripting]] |
| − | [[Testing for Cross site flashing| | + | [[Testing for Cross site flashing|4.8.4 Testing for Cross Site Flashing]] |
[[Testing for SQL Injection| 4.8.5 Testing for SQL Injection ]] | [[Testing for SQL Injection| 4.8.5 Testing for SQL Injection ]] | ||
| Line 159: | Line 159: | ||
[[Testing for SQL Server|4.8.5.3 SQL Server Testing]] | [[Testing for SQL Server|4.8.5.3 SQL Server Testing]] | ||
| − | [[Testing for MS Access| | + | [[Testing for MS Access|4.8.5.4 MS Access Testing]] |
[[OWASP_Backend_Security_Project_Testing_PostgreSQL|4.8.5.5 (new: D.Bellucci 100% from OWASP BSP) Testing PostgreSQL]] | [[OWASP_Backend_Security_Project_Testing_PostgreSQL|4.8.5.5 (new: D.Bellucci 100% from OWASP BSP) Testing PostgreSQL]] | ||
| Line 191: | Line 191: | ||
[[Testing for Denial of Service|'''4.9 Testing for Denial of Service''']] | [[Testing for Denial of Service|'''4.9 Testing for Denial of Service''']] | ||
| − | [[Testing for SQL Wildcard Attacks| | + | [[Testing for SQL Wildcard Attacks|4.9.1 Testing for SQL Wildcard Attacks]] |
[[Testing for DoS Locking Customer Accounts|4.9.2 Testing for DoS Locking Customer Accounts]] | [[Testing for DoS Locking Customer Accounts|4.9.2 Testing for DoS Locking Customer Accounts]] | ||
| Line 207: | Line 207: | ||
[[Testing for Storing too Much Data in Session|4.9.8 Testing for Storing too Much Data in Session]] | [[Testing for Storing too Much Data in Session|4.9.8 Testing for Storing too Much Data in Session]] | ||
| − | [[Testing for Web Services| | + | [[Testing for Web Services|'''4.10 Web Services Testing''']] |
| − | [[Testing: WS Information Gathering| | + | [[Testing: WS Information Gathering|4.10.1 WS Information Gathering]] |
| − | [[Testing WSDL| | + | [[Testing WSDL|4.10.2 Testing WSDL]] |
| − | [[Testing for XML Structural| | + | [[Testing for XML Structural|4.10.3 XML Structural Testing ]] |
[[Testing for XML Content-Level|4.10.4 XML Content-level Testing ]] | [[Testing for XML Content-Level|4.10.4 XML Content-level Testing ]] | ||
| Line 229: | Line 229: | ||
[[Testing for AJAX|4.11.2 How to test AJAX]] | [[Testing for AJAX|4.11.2 How to test AJAX]] | ||
| − | ==[[Writing Reports: value the real risk | | + | ==[[Writing Reports: value the real risk |5. Writing Reports: value the real risk ]]== |
[[How to value the real risk |5.1 How to value the real risk]] | [[How to value the real risk |5.1 How to value the real risk]] | ||
| Line 264: | Line 264: | ||
* XPATH Injection | * XPATH Injection | ||
| − | ==[[OWASP Testing Guide Appendix D: Encoded Injection | | + | ==[[OWASP Testing Guide Appendix D: Encoded Injection | Appendix D: Encoded Injection]]== |
Revision as of 11:31, 1 November 2008
This is the draft of table of content of the New Testing Guide.
You can download the stable version here
Back to the OWASP Testing Guide Project: http://www.owasp.org/index.php/OWASP_Testing_Project
Testing Guide v3 (draft) Updated: 1st November 2008
T A B L E o f C O N T E N T S
Foreword by OWASP Chair
1. Frontispiece
1.1 About the OWASP Testing Guide Project
1.2 About The Open Web Application Security Project
2. Introduction
2.1 The OWASP Testing Project
2.2 Principles of Testing
2.3 Testing Techniques Explained
2.4 Security requirements test derivation,functional and non functional test requirements, and test cases through use and misuse cases
2.4.1 Security tests integrated in developers and testers workflows
2.4.2 Developers' security tests: unit tests and component level tests
3. The OWASP Testing Framework
3.1. Overview
3.2. Phase 1: Before Development Begins
3.3. Phase 2: During Definition and Design
3.4. Phase 3: During Development
3.5. Phase 4: During Deployment
3.6. Phase 5: Maintenance and Operations
3.7. A Typical SDLC Testing Workflow
4. Web Application Penetration Testing
4.1 Introduction and Objectives
4.2.1 Spiders, Robots and Crawlers
4.2.2 Search Engine Discovery/Reconnaissance
4.2.3 Identify application entry points
4.2.4 Testing for Web Application Fingerprint
4.3 Configuration Management Testing
4.3.1 SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)
4.3.3 Infrastructure Configuration Management Testing
4.3.4 Application Configuration Management Testing
4.3.5 Testing for File Extensions Handling
4.3.6 Old, Backup and Unreferenced Files
4.3.7 Infrastructure and Application Admin Interfaces
4.3.8 Testing for HTTP Methods and XST
4.5.1 Credentials transport over an encrypted channel
4.5.2 Testing for user enumeration
4.5.3 Testing for Guessable (Dictionary) User Account
4.5.5 Testing for bypassing authentication schema
4.5.6 Testing for vulnerable remember password and pwd reset
4.5.7 Testing for Logout and Browser Cache Management Testing
4.5.9 Testing Multiple Factors Authentication
4.5.10 Testing for Race Conditions
4.6.1 Testing for path traversal
4.6.2 Testing for bypassing authorization schema
4.6.3 Testing for Privilege Escalation
4.7 Session Management Testing
4.7.1 Testing for Session Management Schema
4.7.2 Testing for Cookies attributes
4.7.3 Testing for Session Fixation
4.7.4 Testing for Exposed Session Variables
4.7.6 Testing for HTTP Exploit
4.8.1 Testing for Reflected Cross Site Scripting
4.8.2 Testing for Stored Cross Site Scripting
4.8.3 Testing for DOM based Cross Site Scripting
4.8.4 Testing for Cross Site Flashing
4.8.5 Testing for SQL Injection
4.8.5.5 (new: D.Bellucci 100% from OWASP BSP) Testing PostgreSQL
4.8.6 Testing for LDAP Injection
4.8.7 Testing for ORM Injection
4.8.8 Testing for XML Injection
4.8.9 Testing for SSI Injection
4.8.10 Testing for XPath Injection
4.8.12 Testing for Code Injection
4.8.13 Testing for Command Injection
4.8.14 Testing for Buffer overflow
4.8.14.1 Testing for Heap overflow
4.8.14.2 Testing for Stack overflow
4.8.14.3 Testing for Format string
4.8.15 Testing for incubated vulnerabilities
4.9 Testing for Denial of Service
4.9.1 Testing for SQL Wildcard Attacks
4.9.2 Testing for DoS Locking Customer Accounts
4.9.3 Testing for DoS Buffer Overflows
4.9.4 Testing for DoS User Specified Object Allocation
4.9.5 Testing for User Input as a Loop Counter
4.9.6 Testing for Writing User Provided Data to Disk
4.9.7 Testing for DoS Failure to Release Resources
4.9.8 Testing for Storing too Much Data in Session
4.10.1 WS Information Gathering
4.10.4 XML Content-level Testing
4.10.5 HTTP GET parameters/REST Testing
4.10.6 Naughty SOAP attachments
5. Writing Reports: value the real risk
5.1 How to value the real risk
5.2 How to write the report of the testing
Appendix A: Testing Tools
- Black Box Testing Tools
- Source Code Analyzers
- Other Tools
Appendix B: Suggested Reading
- Whitepapers
- Books
- Useful Websites
Appendix C: Fuzz Vectors
- Fuzz Categories
- Recursive fuzzing
- Replasive fuzzing
- Cross Site Scripting (XSS)
- Buffer Overflows and Format String Errors
- Buffer Overflows (BFO)
- Format String Errors (FSE)
- Integer Overflows (INT)
- SQL Injection
- Passive SQL Injection (SQP)
- Active SQL Injection (SQI)
- LDAP Injection
- XPATH Injection
