This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Testing Guide Table of Contents"

From OWASP
Jump to: navigation, search
(→‎Manual testing techniques: changed names for DoS Testing sections.)
Line 48: Line 48:
 
#[[Testing for default or guessable user accounts and empty passwords]]
 
#[[Testing for default or guessable user accounts and empty passwords]]
 
#[[Testing for application layer Denial of Service (DoS) attacks]]
 
#[[Testing for application layer Denial of Service (DoS) attacks]]
−
#[[Testing for DoS: Locking Customer Accounts]]
+
##[[DoS Testing: Locking Customer Accounts]]
−
#[[Testing for DoS: Buffer Overflows]]
+
##[[DoS Testing: Buffer Overflows]]
−
#[[DoS: User Specified Object Allocation]]
+
##[[DoS Testing: User Specified Object Allocation]]
−
#[[DoS: User Input as a Loop Counter]]
+
##[[DoS Testing: User Input as a Loop Counter]]
−
#[[DoS: Writing User Provided Data to Disk]]
+
##[[DoS Testing: Writing User Provided Data to Disk]]
−
#[[DoS: Failure to Release Resources]]
+
##[[DoS Testing: Failure to Release Resources]]
−
#[[DoS: Storing too Much Data in Session]]
+
##[[DoS Testing: Storing too Much Data in Session]]
 
#[[Buffer Overflow Testing Guide|Buffer Overflow]]
 
#[[Buffer Overflow Testing Guide|Buffer Overflow]]
 
#[[Test and debug files]]
 
#[[Test and debug files]]

Revision as of 17:50, 28 July 2006

Frontispiece

  1. Copyright and License
  2. Endorsements
  3. Trademarks

Introduction

  1. Performing An Application Security Review
  2. Principles of Testing
  3. Testing Techniques Explained

Methodologies Used

  1. Secure application design
  2. Code Review (See the code review project)
    • Overview
    • Advantages and Disadvantages
  3. Penetration Testing
    • Overview
    • Advantages and Disadvantages
  4. The Need for a Balanced Approach
  5. A Note about Web Application Scanners
  6. A Note about Static Source Code Review Tools

Finding Specific Issues In a Non-Technical Manner

  1. Threat Modeling Introduction
  2. Design Reviews
  3. Threat Modeling the Application
  4. Policy Reviews
  5. Requirements Analysis
  6. Developer Interviews and Interaction

Finding Specific Vulnerabilities Using Source Code Review

For code review please see: http://www.owasp.org/index.php/Category:OWASP_Code_Review_Project The code review section has now got its own area.

Manual testing techniques

  1. Business logic testing - <TBD>
  2. Authentication
  3. Cookie manipulation
  4. Weak session tokens
  5. Session riding test
  6. Testing for Cross site scripting vulnerabilities
  7. Testing for vulnerable remember password implementation
  8. Weak Password Self-Reset Testing
  9. Testing for default or guessable user accounts and empty passwords
  10. Testing for application layer Denial of Service (DoS) attacks
    1. DoS Testing: Locking Customer Accounts
    2. DoS Testing: Buffer Overflows
    3. DoS Testing: User Specified Object Allocation
    4. DoS Testing: User Input as a Loop Counter
    5. DoS Testing: Writing User Provided Data to Disk
    6. DoS Testing: Failure to Release Resources
    7. DoS Testing: Storing too Much Data in Session
  11. Buffer Overflow
  12. Test and debug files
  13. File extensions handling
  14. Old, backup and unreferenced files
  15. Defense from Automatic Attacks
  16. Configuration Management Infrastructure
  17. Sensitive data in URL’s
  18. SSL / TLS cipher specifications and requirements for site
  19. Web Services Security Testing
  20. References
  21. Tools

The OWASP Testing Framework

  1. Overview
  2. Phase 1 — Before Development Begins
    • Phase 1A: Policies and Standards Review
    • Phase 1B: Develop Measurement and Metrics Criteria (Ensure Traceability)
  3. Phase 2: During Definition and Design
    • Phase 2A: Security Requirements Review
    • Phase 2B: Design an Architecture Review
    • Phase 2C: Create and Review UML Models
    • Phase 2D: Create and Review Threat Models
  4. Phase 3: During Development
    • Phase 3A: Code Walkthroughs
    • Phase 3B: Code Reviews
  5. Phase 4: During Deployment
    • Phase 4A: Application Penetration Testing
    • Phase 4B: Configuration Management Testing
  6. Phase 5: Maintenance and Operations
    • Phase 5A: Conduct Operational Management Reviews
    • Phase 5B: Conduct Periodic Health Checks
    • Phase 5C: Ensure Change Verification
  7. A Typical SDLC Testing Workflow
    • Figure 3: Typical SDLC Testing Workflow.

Appendix A: Testing Tools

  1. Source Code Analyzers
  2. Open Source / Freeware
    • Commercial
  3. Black Box Scanners
    • Open Source
    • Commercial
  4. Other Tools
    • Runtime Analysis
    • Binary Analysis
    • Requirements Management

Appendix B: Suggested Reading

  1. Whitepapers
  2. Books
  3. Articles
  4. Useful Websites
  5. OWASP — http://www.owasp.org

Figures

  1. Figure 1: Proportion of Test Effort in SDLC.
  2. Figure 2: Proportion of Test Effort According to Test Technique.
  3. Figure 3: Typical SDLC Testing Workflow.
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Testing_Guide_Table_of_Contents&oldid=8343"