This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP WAP-Web Application Protection"

From OWASP
Jump to: navigation, search
(→‎News and Events)
(→‎Events)
Line 203: Line 203:
  
 
===Events===
 
===Events===
−
*[https://www.facebook.com/semanadascienciasetecnologiasaaue/photos/pb.701934916585847.-2207520000.1430093295./720636151382390/?type=3&theater WAP in 4th SCT of University of Évora]. Miguel Correia presented the comunication: '''''Cyber-attacks againts PHP Web Applications and How avoid them with the WAP tool'''''. Apr 2015.<br/>
+
[https://www.facebook.com/semanadascienciasetecnologiasaaue/photos/pb.701934916585847.-2207520000.1430093295./720636151382390/?type=3&theater WAP in 4th SCT of University of Évora]
 +
* Miguel Correia presented the comunication: '''''Cyber-attacks againts PHP Web Applications and How avoid them with the WAP tool'''''. Apr 2015.<br/>
 +
<br/>
  
−
* [https://paris-isp.uni.lu WAP in ParIS - ISP at University of Luxembourg]. Ibéria Medeiros presented WAP and realized a lab in the Intensive Study Programmed (ISP). March 2015.<br/>
+
[https://paris-isp.uni.lu WAP in ParIS - ISP at University of Luxembourg]
 +
* Ibéria Medeiros presented WAP and realized a lab in the Intensive Study Programmed (ISP). March 2015.<br/>
 +
<br/>
  
−
* [http://iscte.acm.org/event/web-application-protection/ WAP in ACM Student Chapter at ISCTE-IUL]. Ibéria Medeiros presented the WAP tool in the ACM Student Chapter. March 2015.<br/>
+
[http://iscte.acm.org/event/web-application-protection/ WAP in ACM Student Chapter at ISCTE-IUL]
 +
* Ibéria Medeiros presented the WAP tool in the ACM Student Chapter. March 2015.<br/>
 +
<br/>
  
−
* [http://awap.sourceforge.net/news.html Many articles are talking about WAP]<br/>
+
[http://awap.sourceforge.net/news.html Many articles are talking about WAP]<br/>
 +
<br/>
  
−
* [http://2014.dsn.org/ WAP in DSN Conference]. Miguel Correia presented the comunication: '''''Web Application Protection with the WAP tool'''''. June 2014. <br/>
+
[http://2014.dsn.org/ WAP in DSN Conference]
 +
* Miguel Correia presented the comunication: '''''Web Application Protection with the WAP tool'''''. June 2014. <br/>
 +
<br/>
  
−
* [https://mocho.di.fc.ul.pt/mod/resource/view.php?id=13019 Seminar about WAP]. Ibéria Medeiros presented a seminar: '''''Hybrid Methods to Detect and Correct Web Application Vulnerabilities Automatically'''''. May 2014.<br/>
+
[https://mocho.di.fc.ul.pt/mod/resource/view.php?id=13019 Seminar about WAP]
 +
* Ibéria Medeiros presented a seminar: '''''Hybrid Methods to Detect and Correct Web Application Vulnerabilities Automatically'''''. May 2014.<br/>
 +
<br/>
  
−
* [http://www2014.kr/ WAP in WWW Conference, in the research track Security 1]. Ibéria Medeiros presented the comunication: '''''Automatic Detection and Correction of Web Application Vulnerabilities using Data Mining to Predict False Positive'''''s. April 2014.<br/>
+
[http://www2014.kr/ WAP in WWW Conference, in the research track Security 1]
−
 
+
* Ibéria Medeiros presented the comunication: '''''Automatic Detection and Correction of Web Application Vulnerabilities using Data Mining to Predict False Positive'''''s. April 2014.<br/>
−
* [http://www.indin2013.org/n/ WAP in INDIN Conference], Ibéria Medeiros presented the comunication: '''''Securing Energy Metering Software with Automatic Source Code Correction'''''. July 2013.<br/>
+
<br/>
  
 +
[http://www.indin2013.org/n/ WAP in INDIN Conference]
 +
* Ibéria Medeiros presented the comunication: '''''Securing Energy Metering Software with Automatic Source Code Correction'''''. July 2013.<br/>
  
 
===Publications===
 
===Publications===

Revision as of 00:56, 30 April 2015

OWASP Project Header.jpg

OWASP WAP - Web Application Protection Project

WAP is a tool to detect and correct input validation vulnerabilities in web applications written in PHP and predicts false positives. The tool combines source code static analysis and data mining to detect vulnerabilities and predict false positives. Then, corrects the source code to remove the real vulnerabilities inserting fixes (small functions) in the right places of the source e code.

Introduction

  • OWASP WAP is a security tool to detect and remove input validation vulnerabilities in web applications, and predict false positives.
  • Uses source code static analysis to detect vulnerabilities, data mining to predict false positives and inserts fixes to correct the source code.
  • Detects and corrects 8 types of input validation vulnerabilities.
  • Teaches the user to build secure software.
  • Works on Linux, Macintosh and Windows.
  • Requires JRE to run.
  • Portable, ready to run and no installation required.

Description

WAP is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP (version 4.0 or higher) with a low rate of false positives.

WAP detects and corrects the following vulnerabilities:

  • SQL Injection (SQLI)
  • Cross-site scripting (XSS)
  • Remote File Inclusion (RFI)
  • Local File Inclusion (LFI)
  • Directory Traversal or Path Traversal (DT/PT)
  • Source Code Disclosure (SCD)
  • OS Command Injection (OSCI)
  • PHP Code Injection

This tool semantically analyses the source code. More precisely, it does taint analysis (data-flow analysis) to detect the input validation vulnerabilities. The aim of the taint analysis is to track malicious inputs inserted by entry points ($_GET, $_POST arrays) and to verify if they reach some sensitive sink (PHP functions that can be exploited by malicious input, such as mysql_query). After the detection, the tool uses data mining to confirm if the vulnerabilities are real or false positives. At the end, the real vulnerabilities are corrected by the insertion of the fixes (small pieces of code) in the source code.


WAP is constituted by three modules:

  • Code Analyzer: composed by tree generator and taint analyser. The tool has integrated a lexer and a parser generated by ANTLR, and based in a grammar and a tree grammar written to PHP language. The tree generator uses the lexer and the parser to build the AST (Abstract Sintatic Tree) to each PHP file. The taint analyzer performs the taint analysis navigating through the AST to detect potentials vulnerabilities.
  • False Positives Predictor: composed by a supervised trained data set with instances classified as being vulnerabilities and false positives and by the Logistic Regression machine learning algorithm. For each potential vulnerability detected by code analyser, this module collects the presence of the attributes that define a false positive and creates with them an instance. Then, the Logistic Regression algorithm receives the instances and classifies them as being a false positive or not (real vulnerability).
  • Code Corrector: each real vulnerability is removed by correction of its source code. This module for the type of vulnerability selects the fix that removes the vulnerability and signalizes the places in the source code where the fix will be inserted. Then, the code is corrected with the insertion of the fixes and new files are created. Fixes are small pieces of the code (small PHP functions developed to the effect) that performing sanitization or validation of the user inputs, depending of the vulnerability type.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of the link GNU Affero General Public License 3.0 as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Project Resources

http://awap.sourceforge.net

Project Leader

Ibéria Medeiros

Related Projects

Classifications

Project Type Files TOOL.jpg
Incubator Project Owasp-builders-small.png
Owasp-breakers-small.png
Affero General Public License 3.0

News and Events

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_WAP-Web_Application_Protection&oldid=194208"