Difference between revisions of "OWASP Testing Guide v3 Table of Contents"

Revision as of 14:34, 7 May 2008

26th April 2008 This is the draft of table of content of the New Testing Guide. You can download the stable version here or read it on line here

Also see http://www.owasp.org/index.php/OWASP_Testing_Guide_v3_Startup.

The new OWASP testing Guidev3:
This document analyze the OWASP Testing Guide v2 checklist and a plan for create the new v3.

• 1) Methodical Testing (new category)
• 2) Authorization testing missing. (new category)
• 3) Information gathering is not a vulnerability  not in report  Passive mode
• 4) Business logic testing  not in report  Passive mode
• 5) Infrastructural test  (new category) *this has to only concentrate on 80 and 443 and other web related testing
• 6) Web Services section needs improvement
• 7) AJAX Testing section needs improvement
• 8) Testing Methodology section updates (requirements, plans, levels and environments)
• 9) New category: Client side Testing
• 10) New category: Thick Client Testing
• 11) New category: Flash/Silverlight Applications
• 12) New category: Assessing Financial Applications
• 13) New category: Fuzzing (we have the vectors, but this should explain the whole concept)

Proposed new categories for the OTG v3:

• OTG Form Templates
  • OTG Request for Quote (RFQ) (new)
  • OTG 3rd Party Assessment Authorization Form (new)
  • OTG Sample Report (new)
• Passive Mode
• Information Gathering
• Business logic testing
• Web Application Penetration Testing
  • Infrastructural testing
  • Authentication Testing
  • Authorization Testing (new)
  • Session Management Testing
  • Data Validation Testing
  • Denial of Service Testing
  • Web Services Testing
  • Client-Side Testing
    • AJAX Testing
    • Flash Testing (new)
    • RIA stuff (new)