This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP EU Summit 2008 Training"
(→Advanced Web Application Security Testing) |
Leocavallari (talk | contribs) |
||
(19 intermediate revisions by 9 users not shown) | |||
Line 6: | Line 6: | ||
Back to [[OWASP EU Summit 2008]] | Back to [[OWASP EU Summit 2008]] | ||
+ | |||
+ | == WebAppSec for Managers and Executives - The Road Less Travelled == | ||
+ | |||
+ | '''Instructor''' | ||
+ | |||
+ | [https://www.owasp.org/index.php/User:Manopaul Mano Paul] | ||
+ | |||
+ | '''Duration''' | ||
+ | |||
+ | 1 day | ||
+ | |||
+ | '''Summary''' | ||
+ | |||
+ | With the financial turn tables of major corporations resting on web applications that connect businesses, transmit and store sensitive financial and personal transaction, combined with the ubiquitous nature of the web; it is imperative that web applications that are designed, architected and developed are secure. | ||
+ | |||
+ | What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowned poet, Robert Frost ends by with the statement "And that has made all the difference". Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective that would make ALL the difference for you and your company. | ||
+ | |||
+ | '''Audience''' | ||
+ | |||
+ | This session is for Management primarily and any stakeholder that needs to understand how understanding application security concepts can benefit their organizations/companies in designing secure web applications. Whether you are a novice or an expert, you will all leave learning something new to lead your teams and help design the next generation of hack-resilient web applications. | ||
+ | |||
+ | '''Table of Contents''' | ||
+ | |||
+ | # Introduction | ||
+ | # Changing Landscape | ||
+ | # Drivers of Web Application Security (Exercise) | ||
+ | ## Method to the Madness | ||
+ | ## Attackers Advantage vs. Defenders Dilemma | ||
+ | # Stakeholders (Exercise) | ||
+ | ## Boardroom Questions | ||
+ | ## Business Aware IT Security (BAITS) | ||
+ | # Regulations, Compliance and Security | ||
+ | ## SOX, GLBA, HIPAA ... | ||
+ | ## European Data Protection Directive | ||
+ | ## PCI DSS | ||
+ | # Software Security Concepts | ||
+ | ## Design Principles (Saltzer & Schroeder) | ||
+ | ### Economy of Mechanisms | ||
+ | ### Fail Safe Defaults | ||
+ | ### Complete Mediation | ||
+ | ### Open Design | ||
+ | ### Separation of Privilege | ||
+ | ### Least Privilege | ||
+ | ### Least Common Mechanisms | ||
+ | ### Psychological Acceptability | ||
+ | ## Security Mechanisms (CIA+AAA+Mgmt) | ||
+ | ### Confidentiality | ||
+ | ### Integrity | ||
+ | ### Availability | ||
+ | ### Authentication | ||
+ | ### Authorization | ||
+ | ### Auditing | ||
+ | ### Management - Session, Exceptions, Configuration | ||
+ | # Security in the SDLC - Requirements to Release | ||
+ | ## 7 Steps to securing applications | ||
+ | ## SD4 - Secure by Default, Design, Development, and Deployment | ||
+ | # Information Security Management Top 10 (real world stories and tips) | ||
+ | ## Executive Sponsorship and Commitment | ||
+ | ## Company wide Support and Participation | ||
+ | ## Industry Standards | ||
+ | ## Getting People to Do the Right Thing | ||
+ | ## Documentation and Continuous Improvements of Processes | ||
+ | ## Training and Education is Key | ||
+ | ## Managing Risk, NOT Security | ||
+ | ## Move aside FUD, Get in Security Metrics | ||
+ | ## Not getting trapped by Compliance | ||
+ | ## Leveraging Corporate Business Initiatives | ||
+ | # OWASP Top 10 (covers what it is, anatomy (how it works), and defense) | ||
+ | ## Cross-site Scripting (XSS) | ||
+ | ## Injection Flaws (covers SQL Injection) | ||
+ | ## Malicious File Execution (covers RFI) | ||
+ | ## Insecure Direct Object Reference | ||
+ | ## Cross-site Request Forgery (CSRF) | ||
+ | ## Information Leakage and Improper Error Handling | ||
+ | ## Broken Authentication and Session Management | ||
+ | ## Insecure Cryptographic Storage | ||
+ | ## Insecure Communications | ||
+ | ## Failure to Restrict URL Access | ||
+ | # Software Risk Management | ||
+ | # Security in an Outsourced World | ||
+ | # Web 2.0 Security | ||
+ | # Self Service Programs | ||
+ | # Awareness, Training & Education | ||
+ | # Hiring and Staffing | ||
+ | # Information Security Program Framework | ||
+ | # The Road less Travelled - Fun interactive session that covers security from Literature, Science and Nature | ||
+ | |||
+ | '''Course Specifics''' | ||
+ | |||
+ | No specific requirement. Come for a fun, interactive session that will cover the basic and advanced elements of web application security for executives and managers - the road less travelled, filled with exercises for the attendees to participate. | ||
+ | |||
+ | == The Art and Science of Threat Modeling Web Applications == | ||
+ | |||
+ | '''Instructor''' | ||
+ | |||
+ | [https://www.owasp.org/index.php/User:Manopaul Mano Paul] | ||
+ | |||
+ | '''Duration''' | ||
+ | |||
+ | 1 day | ||
+ | |||
+ | '''Summary''' | ||
+ | |||
+ | To secure your home, you will first need to know how the thief could possibly enter and exit and where you should store your valuables. The same is true of your web applications. Unless you know what the vulnerabilities and threats of your web applications are, and what security measures you should take to protect them, ev1L h@x0rS or the enemy within (insider) could take advantage of the vulnerabilities. | ||
+ | |||
+ | Threat Modeling is a technique that you can use to identify ATVS (attacks, threats, vulnerabilities and safeguards) that could affect your web applications. Threat Modeling helps in designing your application securely from a confidentiality, integrity, availability, authentication, authorization and auditing perspective. It is an essential activity to be undertaken during the design stage of your SDLC and helps mitigate and minimize overall risk. | ||
+ | |||
+ | '''Audience''' | ||
+ | |||
+ | This session is for Management, Technical (Developer, QA, Security ...) and Operational professionals and any stakeholder that needs to understand how threat modeling can benefit their organizations/companies in designing secure web applications. Whether you are a novice or an expert apropos threat modeling, you will all leave learning something new to design the next generation of hack-resilient web applications. | ||
+ | |||
+ | '''Table of Contents''' | ||
+ | |||
+ | 1. Introduction | ||
+ | |||
+ | 2. Why Threat Model? | ||
+ | |||
+ | 3. Is Threat Modeling Right for You? | ||
+ | |||
+ | 4. Challenges | ||
+ | |||
+ | 5. Precursors | ||
+ | |||
+ | 6. Data Classification and Threat Modeling | ||
+ | |||
+ | 7. Web Application Security Mechanisms | ||
+ | |||
+ | 8. Benefits of Threat Modeling | ||
+ | |||
+ | 9. Common Glossary of Terms | ||
+ | |||
+ | 10. Threat Agents | ||
+ | |||
+ | 11. Threat Modeling Process | ||
+ | |||
+ | 12. Attack Trees | ||
+ | |||
+ | 13. STRIDE and DREAD | ||
+ | |||
+ | 14. Threat to Risk | ||
+ | |||
+ | 15. Threat Modeling (Exercise) | ||
+ | |||
+ | '''Course Specifics''' | ||
+ | |||
+ | No specific requirement. Come for a fun, hands-on, interactive session that will cover the basic and advanced elements of threat modeling, filled with exercises for the attendees to participate. | ||
+ | |||
== Web server/services hardening using SELinux == | == Web server/services hardening using SELinux == | ||
Line 154: | Line 301: | ||
'''Course Specifics''' | '''Course Specifics''' | ||
− | + | Laptop not required. | |
== OWASP Top 10 - What Developers Should Know on Web Application Security == | == OWASP Top 10 - What Developers Should Know on Web Application Security == | ||
Line 237: | Line 384: | ||
No specific prerequisites. | No specific prerequisites. | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
== Classic ASP Security using OWASP tools == | == Classic ASP Security using OWASP tools == | ||
Line 297: | Line 402: | ||
'''Audience''' | '''Audience''' | ||
− | Classic ASP | + | People involved in development/maintenance of Classic ASP applications at all levels, including developers, Application Architects, testers, etc. |
'''Table of Contents''' | '''Table of Contents''' | ||
Line 304: | Line 409: | ||
*Auditing ASP code with [[:Category:OWASP_Code_Review_Project|Code Review Project]] checklist | *Auditing ASP code with [[:Category:OWASP_Code_Review_Project|Code Review Project]] checklist | ||
*Implementing [[:Category:OWASP_Stinger_Project|OWASP Stinger]] protection for Classic ASP | *Implementing [[:Category:OWASP_Stinger_Project|OWASP Stinger]] protection for Classic ASP | ||
− | * | + | *Complementary security best practices. |
'''Course Specifics''' | '''Course Specifics''' | ||
Line 429: | Line 534: | ||
Demos (including strategy and implementation) of the most interesting lesson solutions will be shown. | Demos (including strategy and implementation) of the most interesting lesson solutions will be shown. | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
== Uncovering WebScarab's Secret Treasures == | == Uncovering WebScarab's Secret Treasures == | ||
Line 502: | Line 572: | ||
− | + | == Ajax Security == | |
− | == | ||
'''Instructor''' | '''Instructor''' | ||
− | + | Brad Causey | |
'''Duration''' | '''Duration''' | ||
− | 2 | + | 1/2 day |
'''Summary''' | '''Summary''' | ||
− | + | This course will provide an introductory to AJAX, its inherent security issues, how to detect them, and how to resolve them. | |
+ | |||
+ | '''Audience''' | ||
+ | |||
+ | Web Application Security Professionals | ||
+ | |||
+ | '''Table of Contents | ||
+ | ''' | ||
+ | * Introduction to AJAX | ||
+ | * Security Issues with architecture | ||
+ | * Toolkits | ||
+ | * Toolkit Security Concerns | ||
+ | * Bridges and Issues | ||
+ | * Attacking AJAX | ||
+ | * Defending AJAX | ||
+ | * Securing the Code | ||
+ | * Best Practices | ||
+ | * Other Issues and Concerns | ||
+ | * Q and A | ||
− | '''Course Specifics''' | + | '''Course Specifics |
+ | ''' | ||
− | + | Please bring your own laptop with your choice of web proxy and browser installed if you wish to participate. Participation is optional. | |
− | == | + | == Flash Player Security == |
'''Instructor''' | '''Instructor''' | ||
− | + | Peleus Uhley, Adobe Systems | |
'''Duration''' | '''Duration''' | ||
− | 1 day | + | 1/2 day |
'''Summary''' | '''Summary''' | ||
− | + | This course will provide an overview of the Flash Player security model and common architectures for Flash deployment. The course is targeted at people who need to understand the fundamentals of Flash Player security and how it will affect their website such as CSOs, web designers and web architects. The goal of the course is to provide the student with the enough information to architect a secure Flash deployment. The follow-on Auditing Flash Applications course will continue to build on this knowledge on an API by API level. | |
+ | |||
+ | '''Audience''' | ||
+ | |||
+ | Web Application Security Professionals and those who make decisions or recommendations about Flash deployments. | ||
+ | |||
+ | |||
+ | '''Course Specifics''' | ||
+ | |||
+ | Please bring your own laptop with your choice of web browser installed if you wish to participate. Participation is optional. | ||
− | == | + | == Auditing Flash Applications == |
'''Instructor''' | '''Instructor''' | ||
− | + | Peleus Uhley, Adobe Systems | |
'''Duration''' | '''Duration''' | ||
− | 2 | + | 1/2 day |
'''Summary''' | '''Summary''' | ||
− | + | This course is a follow on to the Flash Player Security course for those who want to do a deep dive into the security of Flash applications. This course is targeted at Flash authors and web-site auditors who need to validate Flash code and provide meaningful recommendations and best practices for improving Flash deployments. The goal of the course is to provide the student with the tools and information to audit a Flash website and provide quality feedback on how to remediate any issues. | |
+ | |||
+ | '''Audience''' | ||
+ | |||
+ | Flash Developers, Web Application Penetration Testers | ||
+ | |||
+ | '''Course Specifics''' | ||
− | == | + | Please bring your own laptop with your choice of web browser installed if you wish to participate. Participation is optional. |
+ | |||
+ | == Testing Guide Training == | ||
'''Instructor''' | '''Instructor''' | ||
− | + | Matteo Meucci, Giorgio Fedon - Minded Security. | |
'''Duration''' | '''Duration''' | ||
− | + | 4h. | |
'''Summary''' | '''Summary''' | ||
− | This course will | + | This course will discuss the new OWASP Testing Guide v3 methodology and the most relevant tests of the 66 total controls of the Guide. You can learn how to test a web application and how to write a report. |
− | + | '''Audience''' | |
− | == | + | Software developers, security consultants, auditors. |
+ | |||
+ | '''Table of Contents''' | ||
+ | |||
+ | The course will discuss the methology and will analize the 9 sub-categories of the Testing Guide: | ||
+ | |||
+ | * Configuration Management Testing | ||
+ | * Business Logic Testing | ||
+ | * Authentication Testing | ||
+ | * Authorization testing | ||
+ | * Session Management Testing | ||
+ | * Data Validation Testing | ||
+ | * Denial of Service Testing | ||
+ | * Web Services Testing | ||
+ | * Ajax Testing | ||
+ | |||
+ | '''Course Specifics''' | ||
+ | |||
+ | Bring your own laptop. | ||
+ | |||
+ | == Offensive Web Application Hacking == | ||
'''Instructor''' | '''Instructor''' | ||
− | + | Marco Slaviero - SensePost. | |
'''Duration''' | '''Duration''' | ||
Line 577: | Line 702: | ||
'''Summary''' | '''Summary''' | ||
− | + | The famous Sensepost web hacking course, a technical 'go-deep' course to tune up your web hacking skills! | |
'''Audience''' | '''Audience''' | ||
− | + | Application security testers. | |
+ | |||
+ | '''Table of Contents''' | ||
+ | |||
+ | If you're attending the OWASP Summit, then you understand that web application security is a big issue. Empirical and anecdotal evidence clearly suggests web applications are being attacked, and with high degrees of success. But its one thing to know about web application hacking, and its quite another to know how to hack them yourself. This workshop by SensePost is about hacking web applications. Not the theories, the lists and the tools, but the techniques and an out-of-box thought process that underpin genuinely unique and original web application compromises. The workshop employees a series of carefully designed web hacking exercises as its integral learning tool. | ||
− | + | Each exercise is designed to teach a specific lesson and will be discussed in detail after it is completed. In this way you learn from your instructors, your colleagues and your own successes and failures. The exercises have all been designed to replicate real-life scenarios with real-life-hacker stumbling blocks along the way. | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | '''Course Specifics | + | '''Course Specifics''' |
− | ''' | ||
− | + | Bring your own laptop. |
Latest revision as of 20:21, 1 November 2008
EU Summit 2008 Trainings
cvent links to be added.
Upon completion and scheduling, trainings will be copied over from OWASP EU Summit 2008 Training (Courses to be Approved)
Back to OWASP EU Summit 2008
- 1 WebAppSec for Managers and Executives - The Road Less Travelled
- 2 The Art and Science of Threat Modeling Web Applications
- 3 Web server/services hardening using SELinux
- 4 Secure Programming with Java
- 5 OWASP Top 10 - What Developers Should Know on Web Application Security
- 6 Classic ASP Security using OWASP tools
- 7 Web Application Assessments
- 8 Hacking Owasp Orizon Project v1.0
- 9 Securing WebGoat with ModSecurity
- 10 Uncovering WebScarab's Secret Treasures
- 11 Ajax Security
- 12 Flash Player Security
- 13 Auditing Flash Applications
- 14 Testing Guide Training
- 15 Offensive Web Application Hacking
WebAppSec for Managers and Executives - The Road Less Travelled
Instructor
Duration
1 day
Summary
With the financial turn tables of major corporations resting on web applications that connect businesses, transmit and store sensitive financial and personal transaction, combined with the ubiquitous nature of the web; it is imperative that web applications that are designed, architected and developed are secure.
What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowned poet, Robert Frost ends by with the statement "And that has made all the difference". Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective that would make ALL the difference for you and your company.
Audience
This session is for Management primarily and any stakeholder that needs to understand how understanding application security concepts can benefit their organizations/companies in designing secure web applications. Whether you are a novice or an expert, you will all leave learning something new to lead your teams and help design the next generation of hack-resilient web applications.
Table of Contents
- Introduction
- Changing Landscape
- Drivers of Web Application Security (Exercise)
- Method to the Madness
- Attackers Advantage vs. Defenders Dilemma
- Stakeholders (Exercise)
- Boardroom Questions
- Business Aware IT Security (BAITS)
- Regulations, Compliance and Security
- SOX, GLBA, HIPAA ...
- European Data Protection Directive
- PCI DSS
- Software Security Concepts
- Design Principles (Saltzer & Schroeder)
- Economy of Mechanisms
- Fail Safe Defaults
- Complete Mediation
- Open Design
- Separation of Privilege
- Least Privilege
- Least Common Mechanisms
- Psychological Acceptability
- Security Mechanisms (CIA+AAA+Mgmt)
- Confidentiality
- Integrity
- Availability
- Authentication
- Authorization
- Auditing
- Management - Session, Exceptions, Configuration
- Design Principles (Saltzer & Schroeder)
- Security in the SDLC - Requirements to Release
- 7 Steps to securing applications
- SD4 - Secure by Default, Design, Development, and Deployment
- Information Security Management Top 10 (real world stories and tips)
- Executive Sponsorship and Commitment
- Company wide Support and Participation
- Industry Standards
- Getting People to Do the Right Thing
- Documentation and Continuous Improvements of Processes
- Training and Education is Key
- Managing Risk, NOT Security
- Move aside FUD, Get in Security Metrics
- Not getting trapped by Compliance
- Leveraging Corporate Business Initiatives
- OWASP Top 10 (covers what it is, anatomy (how it works), and defense)
- Cross-site Scripting (XSS)
- Injection Flaws (covers SQL Injection)
- Malicious File Execution (covers RFI)
- Insecure Direct Object Reference
- Cross-site Request Forgery (CSRF)
- Information Leakage and Improper Error Handling
- Broken Authentication and Session Management
- Insecure Cryptographic Storage
- Insecure Communications
- Failure to Restrict URL Access
- Software Risk Management
- Security in an Outsourced World
- Web 2.0 Security
- Self Service Programs
- Awareness, Training & Education
- Hiring and Staffing
- Information Security Program Framework
- The Road less Travelled - Fun interactive session that covers security from Literature, Science and Nature
Course Specifics
No specific requirement. Come for a fun, interactive session that will cover the basic and advanced elements of web application security for executives and managers - the road less travelled, filled with exercises for the attendees to participate.
The Art and Science of Threat Modeling Web Applications
Instructor
Duration
1 day
Summary
To secure your home, you will first need to know how the thief could possibly enter and exit and where you should store your valuables. The same is true of your web applications. Unless you know what the vulnerabilities and threats of your web applications are, and what security measures you should take to protect them, ev1L h@x0rS or the enemy within (insider) could take advantage of the vulnerabilities.
Threat Modeling is a technique that you can use to identify ATVS (attacks, threats, vulnerabilities and safeguards) that could affect your web applications. Threat Modeling helps in designing your application securely from a confidentiality, integrity, availability, authentication, authorization and auditing perspective. It is an essential activity to be undertaken during the design stage of your SDLC and helps mitigate and minimize overall risk.
Audience
This session is for Management, Technical (Developer, QA, Security ...) and Operational professionals and any stakeholder that needs to understand how threat modeling can benefit their organizations/companies in designing secure web applications. Whether you are a novice or an expert apropos threat modeling, you will all leave learning something new to design the next generation of hack-resilient web applications.
Table of Contents
1. Introduction
2. Why Threat Model?
3. Is Threat Modeling Right for You?
4. Challenges
5. Precursors
6. Data Classification and Threat Modeling
7. Web Application Security Mechanisms
8. Benefits of Threat Modeling
9. Common Glossary of Terms
10. Threat Agents
11. Threat Modeling Process
12. Attack Trees
13. STRIDE and DREAD
14. Threat to Risk
15. Threat Modeling (Exercise)
Course Specifics
No specific requirement. Come for a fun, hands-on, interactive session that will cover the basic and advanced elements of threat modeling, filled with exercises for the attendees to participate.
Web server/services hardening using SELinux
Instructor
Pavol Luptak
Duration
1 day
Summary
Security-Enhanced Linux (SELinux) is a FLASK implementation integrated in the Linux kernel with a number of utilities designed to provide mandatory access controls (MAC) through the use of Linux Security Modules (LSM) in the Linux kernel. SELinux generally supports many kinds of mandatory access control policies, including those based on the concepts of type enforcement, role-based access control, and multi-level security.
A Linux kernel integrating SELinux enforces mandatory access control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs. This reduces or eliminates the ability of these programs and daemons to cause harm when compromised (via buffer overflows or misconfigurations, for example). This confinement mechanism operates independently of the traditional Linux access control mechanisms. It has no concept of a "root" super-user, and does not share the well-known shortcomings of the traditional Linux security mechanisms (such as a dependence on setuid/setgid binaries).
This training provides basic concepts of SELinux, its differences to classical UNIX/Linux systems, describe security advantages of mandatory access control policies and teach how to effectively and rapidly configure a fully functional LAMP environment on SELinux system.
Audience
Security consultants, system administators, programmers focused on system security
Table of Contents
1. SELinux history
2. Unix/Linux DAC (Discretionary Access Control) and its problems
3. MAC (Mandatory Access Control)
4. Advantages of using MAC
5. DTE (Domain Type Enforcement) model
6. RBAC (Roles Based Access Control) model
7. MLS (Multi Level Security) model
8. SELinux FLASK Architecture
9. SELinux policy (EXERCISE)
10. File System Security Contexts (EXERCISE)
11. SELinux Object Classes and Permissions
12. TE (Type Enforcement) Rules (Attributes, Type Declaration, Type Transitions, Domain Type Transitions, Object Labeling Transitions, Access Vectors)
13. Understanding AVC, log messages
14. audit2allow and audit2why (EXERCISE)
15. SELinux Troubleshoot Tool (EXERCISE)
16. Auditing and Auditing tools
17. Policy Macros
18. Backtracking rule (EXERCISE)
19. SELinux Users, Roles, MLS Levels
20. Strict Policy
21. Targeted Policy
22. SELinux Booleans and their use for Apache web server (EXERCISE)
23. Files and Directories in Targeted Policy, common SELinux Macros (EXERCISE)
24. Analyzing Example Policy - apache.te (EXERCISE)
25. Assigning Object and Process Types
26. SELinux Booting
27. Copying and moving files, checking security contexts, relabeling a file and directory's security context (EXERCISE)
28. Policy core utilities
29. Managing File Labeling, Relabeling a File System (EXERCISE)
30. SELinux Administrator GUI (EXERCISE)
31. SELinux Modules (EXERCISE)
32. Hardening existing LAMP environments using SELinux (EXERCISE)
33. Writing New Policy for a Daemon (EXERCISE for clever students)
Course Specifics
Bring your own laptop. Each student will have own SELinux virtual machine for his experiments.
Secure Programming with Java
Instructor
Lucas C. Ferreira
Duration
1 Day
Summary
This training class will present best practices of secure programming in the Java language. It includes Java specific practices (i.e. how to avoid problems that arise from the compilation of Java source code to the bytecode language used by the JVM) and practices that may arise in other programming languages (with examples in Java). Some tools that may be used to verify the security of Java code and systems will be shown.
The topics include a quick overview of the OWASP Top 10, in order to contextualize the practices presented, and several best practices aimed at the different software layers. At the presentation layer, we focus on input validation, access control issues and dealing with exceptions. At the business objects layer, the practices deal with cloning and serialization issues. Practices to prevent command injection are presented at the persistence layer. Practices that should be used throughout all the software are also presented, including input data validation, class and method visibility, using and storing secrets, dealing with inner classes, overflows and boxing, and object initialization.
Audience
Java web application developers. This training requires basic understanding of web applications and an intermediate level of proficiency in the Java language and Object Oriented concepts. People with interest in other OO languages may also benefit from this training, but specific techniques, examples and tools used are targeted to Java.
Table of Contents
- OWASP Top 10 - quick overview
- Secure Programming Best Practices
- Presentation layer
- Preventing cross-site scripting
- Access control
- Request validation
- Error treatment
- Business object layer
- Cloning and serialization issues
- Persistence layer
- Command injection issues
- Database access users and permissions
- file manipulation
- Infra-structure layer
- J2EE container-related best practices
- Native method issues
- SSL and encryption
- Practices for all software layers
- Data validation
- Garbage collection issues
- Classes and method scoping
- Use of secrets
- Inner class issues
- Over/underflow and boxing issues
- Presentation layer
- Tools
- Code review tool
- Data flow tool
- Pen-testing tool
Course Specifics
Laptop not required.
OWASP Top 10 - What Developers Should Know on Web Application Security
Instructor
Sebastien Deleersnyder and Martin Knobloch
Duration
4 h To be scheduled on Tuesday.
Summary
Application security is an essential component of any successful project; this includes web applications, open source PHP applications, web services and proprietary business web sites. Web application security education and awareness is needed throughout the entire development and deployment organization. Each area and level of development or deployment organizations have specific needs and requirements regarding web application security education. A manager needs other information than a security professional or developer. Novices to the profession require other training than people with several years of experience.
The OWASP Education project aims to provide in building blocks of web application security information. These modules can be combined together in education tracks targeting different audiences. This Education Track provides in a 4 hour session covering what developers should know on web application security. It starts with an explanation of web application security and why it is important. Then the OWASP Top 10 is used to explain the nastiest vulnerabilities and how these can be prevented or re mediated. A secure coding initiative must deal with all stages of a program’s life cycle. Secure web applications are only possible when a secure SDLC is used. The SDLC is explained from the standpoint of people, processes and tools. Particularly for developers good secure development practices are covered in a separate topic. Finally the track finishes with an exhaustive list of web application security resources for web application developers.
Audience
Web application developers who are unaware there are security issues with contemporary web applications. No prior knowledge of web application security is assumed nor necessary. This track is independent of the coding language or web frameworks used; like PHP, JSF, Java EE or .NET. We must realize that web application developers are only one link - albeit an important one - of the chain that represents the security of a web application. This track aims to make that link as secure as possible, given the constraint of 4 hours. Another important aspect is that web application security should be tailored to the risk profile of an organization and the specific development environment of that organization.
Table of Contents
The challenge is to cover web application security in 4 hours to a web application developer. This is presented in such a way that the developers will be able to recognize and correct web application vulnerabilities in their projects.
- Why WebAppSec matters (20 min) (direct link)
- This part is the introduction of the track. It identifies the current security problems with web applications. During the introduction a definition of web application security is given. Trends that are influencing the current state of web application insecurity are also explained.
- What goes wrong
- WebAppSec Defined
- Current trends
- OWASP Top 10 Introduction & Remedies (90 min) (direct link)
- The primary aim of the OWASP Top 10 is to educate developers, designers, architects and organizations about the consequences of the most common web application security vulnerabilities. The Top 10 provides basic methods to protect against these vulnerabilities.
- Cross Site Scripting (XSS)
- Injection Flaws
- Malicious File Execution
- Insecure Direct Object Reference
- Cross Site Request Forgery (CSRF)
- Information Leakage and Improper Error Handling
- Broken Authentication and Session Management
- Insecure Cryptographic Storage
- Insecure Communications
- Failure to Restrict URL Access
- Embed within SDLC (People, Processes & Tools) (20 min) (direct link)
- There is no silver bullet when it comes to securing web applications. This problem has to be addressed from different angles, covering the involved actors, processes: development as well as deployment and Technologies.
- People Awareness and Education
- Development WebAppSec Controls
- Deployment WebAppSec Controls
- WebAppSec Tools
- Good Secure Development Practices (70 min) (direct link)
- Next to the Top 10 remedies this module provides some good secure development practices from the OWASP Guide, covering e.g.
- Validating User Input
- Authentication
- Authorization
- Session Management
- Using Interpreters
- Crypto
- Catching Errors
- File System
- Configuration
- Web 2.0
- Testing for Vulnerabilities (20 min) (direct link)
- One important aspect is to test for application vulnerabilities. During this short module an introduction is provided together with some WebGoat test cases.
- Testing for application vulnerabilities
- The OWASP Testing Guide
- WebGoat demonstrated
- Good WebAppSec Resources (not limited to OWASP) (10 min) (direct link)
- This 4 hour education track in only the beginning of your journey. Web application security is a moving target. New vulnerabilities and threats are discovered regularly. Web application security controls are becoming mature. The following resources should provide you with enough pointers to serve both as reference and for further research.
- Hard Copy
- Web Sites
- Mailing lists
- Blogs
- Roundup (10 min)
Course Specifics
No specific prerequisites.
Classic ASP Security using OWASP tools
Instructor
Juan Carlos Calderon
Duration
1 day
Summary
Classic ASP 2.0 and 3.0 applications are still largely used as this technology is more than 10 years old and was largely used. there are thousands of sites on the wild that need guidance on the security arena. This is where OWASP can come up and provide help for “making the Web a better place”.
Audience
People involved in development/maintenance of Classic ASP applications at all levels, including developers, Application Architects, testers, etc.
Table of Contents
- Secure programming on ASP using OWASP ESAPI
- Auditing ASP code with Code Review Project checklist
- Implementing OWASP Stinger protection for Classic ASP
- Complementary security best practices.
Course Specifics
None. Keep posted for changes on the table of contents and course specifics.
Web Application Assessments
Instructor
Vicente Aguilera Diaz
Duration
4h
Summary
As in the physical world, the "professionals" attackers spend most of their time to analysing its objective and try to gather as much information as possible about it. The more information becomes available and is more detailed and accurate, the attack is more likely to succeed.
The aim of this course is to identify patterns and tools to perform this analysis (step prior to the attack), and is supplemented by a case study on a practical application.
Audience
Software developers, security consultants, system administrators and people loving security.
Table of Contents
- Introduction
- Web Application Discovery
- Gathering information on the target web application
- Search Engines
- Interaction with external entities and information services
- Analysis of existing information in the web application (public information, information leaks, causing errors, etc.).
- Knowing / Understand the target
- Identifying characteristics (technologies, platforms, user profiles, features, etc.).
- Analysis of infrastructure components: databases, Web servers, application servers, authentication servers, etc.). Detection and identification.
- Identification of the exposition area
- Analysis of attack vectors and vulnerabilities exploitation
- Case Study
- Assessment of an webmail application
- Vulnerability exploitation: IMAP / SMTP Injection
Course Specifics
Bring your own laptop.
Hacking Owasp Orizon Project v1.0
Instructor
Paolo Perego
Duration
4h
Summary
In the course it will be presented Owasp Orizon v1.0 framework. The major APIs will be fully explained and it will be built a simple scanning tool using the Orizon framework.
The course goal is to let people fully understand Orizon internals and let people understand how to use the framework in a real world.
Audience
Security specialist, code reviewers and curious developers
Table of Contents
- Owasp Orizon Internals
- Translation engine
- Owasp Orizon XML project
- XML used in writing security checks
- XML used in translation phase
- Static analysis engine
- Crawling engine
- Reporting engine
- Create a simple tool using Orizon
Course Specifics
People have to bring their own laptop with latest Owasp Orizon version, J2SE 1.6 or later and a Java IDE (e.g. eclipse) is also feasible.
Securing WebGoat with ModSecurity
Instructor
Stephen Craig Evans
Duration
4h
Summary
ModSecurity, normally a tool of the network security group, has capabilities that can allow a software security specialist with programming skills to mitigate business logic flaws and other vulnerabilities that are out-of-reach of basic blacklists.
This 4 hour course covers the highlights of the Summer of Code 2008 project, "Securing WebGoat using ModSecurity" (please see https://www.owasp.org/index.php/Category:OWASP_Securing_WebGoat_using_ModSecurity_Project and the project wiki).
Audience
- Users of ModSecurity that want to learn how it can be leveraged beyond the basic rule sets in order to mitigate vulnerabilities in areas such as authentication, AJAX, and output sanitization
- Web application specialists, especially pentesters, who want to learn how ModSecurity can offer an additional remedial solution to customers when the application cannot be touched
- Curious people that are wondering what the hell this project is about
Table of Contents
- ModSecurity basics
- WebGoat overview
- A walkthrough of the "Securing WebGoat using ModSecurity" Summer of Code 2008 project
- Mitigating WebGoat vulnerabilities using the ModSecurity core rule set
- Using ModSecurity's Lua scripting language:
- For its programming capabilities (including re-building the Lua library to include 3rd party functionality)
- To implement configuration files
- For global persistence
- And much, much, more...
- Using ModSecurity's Javascript injection (prepend and append):
- To substitute/override/extend existing Javascript functions
- To enhance the user experience when implementing a ModSecurity solution on the back end such as an authentication mechanism
- Using ModSecurity's session collection, Lua script, and Javascript injection together to mitigate almost any vulnerability
Course Specifics
Demos (including strategy and implementation) of the most interesting lesson solutions will be shown.
Uncovering WebScarab's Secret Treasures
Instructor
Rogan Dawes
Duration
1 day.
Summary
OWASP WebScarab has a lot of hidden features that probably no one but the author really knows about. This in depth hands on session will show delegates how to access these features, and how to use them to their full potential.
Audience
Application reviewers, developers
Table of Contents
- Using the spider
- Manual Request Transforms
- What is the XSS/CRLF plugin, and how does it work?
- Using the Fuzzer
- Comparing Responses
- Searching WebScarab history
- Exploring the Beanshell
- Writing Proxy Intercept scripts
- Writing Script Manager Scripts
- Writing other scripts
Course Specifics
Bring your own laptop
Ajax Security
Instructor
Brad Causey
Duration
1/2 day
Summary
This course will provide an introductory to AJAX, its inherent security issues, how to detect them, and how to resolve them.
Audience
Web Application Security Professionals
Table of Contents
- Introduction to AJAX
- Security Issues with architecture
- Toolkits
- Toolkit Security Concerns
- Bridges and Issues
- Attacking AJAX
- Defending AJAX
- Securing the Code
- Best Practices
- Other Issues and Concerns
- Q and A
Course Specifics
Please bring your own laptop with your choice of web proxy and browser installed if you wish to participate. Participation is optional.
Flash Player Security
Instructor
Peleus Uhley, Adobe Systems
Duration
1/2 day
Summary
This course will provide an overview of the Flash Player security model and common architectures for Flash deployment. The course is targeted at people who need to understand the fundamentals of Flash Player security and how it will affect their website such as CSOs, web designers and web architects. The goal of the course is to provide the student with the enough information to architect a secure Flash deployment. The follow-on Auditing Flash Applications course will continue to build on this knowledge on an API by API level.
Audience
Web Application Security Professionals and those who make decisions or recommendations about Flash deployments.
Course Specifics
Please bring your own laptop with your choice of web browser installed if you wish to participate. Participation is optional.
Auditing Flash Applications
Instructor
Peleus Uhley, Adobe Systems
Duration
1/2 day
Summary
This course is a follow on to the Flash Player Security course for those who want to do a deep dive into the security of Flash applications. This course is targeted at Flash authors and web-site auditors who need to validate Flash code and provide meaningful recommendations and best practices for improving Flash deployments. The goal of the course is to provide the student with the tools and information to audit a Flash website and provide quality feedback on how to remediate any issues.
Audience
Flash Developers, Web Application Penetration Testers
Course Specifics
Please bring your own laptop with your choice of web browser installed if you wish to participate. Participation is optional.
Testing Guide Training
Instructor
Matteo Meucci, Giorgio Fedon - Minded Security.
Duration
4h.
Summary
This course will discuss the new OWASP Testing Guide v3 methodology and the most relevant tests of the 66 total controls of the Guide. You can learn how to test a web application and how to write a report.
Audience
Software developers, security consultants, auditors.
Table of Contents
The course will discuss the methology and will analize the 9 sub-categories of the Testing Guide:
- Configuration Management Testing
- Business Logic Testing
- Authentication Testing
- Authorization testing
- Session Management Testing
- Data Validation Testing
- Denial of Service Testing
- Web Services Testing
- Ajax Testing
Course Specifics
Bring your own laptop.
Offensive Web Application Hacking
Instructor
Marco Slaviero - SensePost.
Duration
1 day
Summary
The famous Sensepost web hacking course, a technical 'go-deep' course to tune up your web hacking skills!
Audience
Application security testers.
Table of Contents
If you're attending the OWASP Summit, then you understand that web application security is a big issue. Empirical and anecdotal evidence clearly suggests web applications are being attacked, and with high degrees of success. But its one thing to know about web application hacking, and its quite another to know how to hack them yourself. This workshop by SensePost is about hacking web applications. Not the theories, the lists and the tools, but the techniques and an out-of-box thought process that underpin genuinely unique and original web application compromises. The workshop employees a series of carefully designed web hacking exercises as its integral learning tool.
Each exercise is designed to teach a specific lesson and will be discussed in detail after it is completed. In this way you learn from your instructors, your colleagues and your own successes and failures. The exercises have all been designed to replicate real-life scenarios with real-life-hacker stumbling blocks along the way.
Course Specifics
Bring your own laptop.