OWASP Spring Of Code 2007 Applications

This page contains project Applications to the OWASP_Spring_Of_Code_2007

If you want to apply for a SpoC 007 sponsorship you HAVE TO USE THIS PAGE for your application

See OWASP_Spring_Of_Code_2007#How_To_Participate for what do to one you completed your Application

---

Proposed template: {for longer proposals, in addition to these details you can create a PDF}:

{Your first name or Alias} - {Project name}

Please remember that projects will be selected and funded based on how well they meet the Selection Criteria.

You can propose your project in any form you wish, but the best proposals will be well thought out, clear and concise, and reflective of your passion for the topic. We strongly suggest that you include the following information in your proposal.

• Your educational and professional background

• Application security experience and accomplishments

• Participation and leadership in open communities

• The opportunity, challenges, issues or need your proposal addresses

• Objectives or ways in which you will meet the goal(s)

• Specific activities and who will carry out these activities

• Specific deliverables and a rough project schedule so we can track progress

• Long-term vision for the project

• Any other reasons why you and your project should be selected

Buanzo - Enigform: Firefox Addon for OpenPGP signing of HTTP requests

I am a 25 year old Independent security consultant from Buenos Aires, Argentina, that has contributed to the world of information systems security since 1994, when BBSes and Linux still lived together.

A quick search for buanzo on google [1] will provide all necessary details about my professional and community background. For comprobable experience, you could also check my Rent a Coder profile.[2].

In my free time I like playing with my Punk-Pop band [3], Futurabanda. [4], and maintaining my Restaurants, Wines and Recipes site. [5]. I have to admit that my first priorities are my beloved son [6] and my wonderful wife [7].

Accomplishments

I've contributed scripts, fixes and translations to the Nmap project. I've also acted as Expert Contributor for SANS TOP-20 2004, 2005 and 2006. I've developed tools that can be found in Freshmeat, like mprl (a getty enhancement to allow remote logins from the login: prompt of the console). I've also written the Unix chapter of the OISSG's Information Systems Security Assessment Framework, v0.1 [8]. I'm currently writing an Internet Draft to be proposed for RFC regarding Enigform.

Community

I run the official 2600 meetings site for Argentina [9], I've been proposed, but I refused, for President of the Argentinian Free Software group called SOLAR [www.solar.org.ar]. I'm an active member of the FLOSS community since 1996, having written articles in magazines http://www.net-security.org/dl/articles/Detecting_and_Understanding_rootkits.txt, made TV, radio and newspaper appearances [10] and led different security research groups of Spain, Mexico and Argentina. Currently I contribute time thorugh my sites, forums and blogs, answering questions in mailing lists and helping coordinate some local LUGs. I do also manager the Linux Counter for Argentina [11].

My Project

Enigform [12] is a Firefox extension that enhances HTTP with OpenPGP functionality. It digitally signs outgoing HTTP requests so that a web server can authenticate the identity and data of the incoming request. It is a Web Security tool because it can, if correctly implemented as any OpenPGP based technology, render man in the middle attacks useless. I think OpenPGP already speaks for itself regarding eMail. Imagine the same benefits for http and web applications. I think Enigform can fit into the OWASP Validation Project [13].

Enigform is the reference implementation of the Internet Draft I'm working on, in discussion with members of the IETF's OpenPGP Working Group.

Some simple PHP code is enough to make a web application Enigform-aware [14]. The Smutty PHP MVC Framework already supports Enigform [15].

Long Term

Have the Draft be proposed as a Standards Track RFC document, have Enigform support directly in Apache and IIS, and port Enigform to other browsers and/or programming languages, and also provide OpenPGP De/Encryption support.

Why should I be selected

I have the experience, security awareness and means to make this project THE web security project of the decade. I am a respected member of the international security community, and I firmly believe Enigform is my greatest idea so far.

Eoin Keary - Code review Project

• Executive Summary:

I am proposing that I complete the OWASP Code review guide during this period. The code review guide was started by me in 2005 and has much information on reviewing code for common vulnerabilities. It is frequently accessed (looking at the stats on the OWASP site) and therefore is useful to practitioners.

I believe the code review guide is an integral part of the OWASP BOK (Body of Knowledge). Ensuring secure development is key to secure applications and code review is of paramount importance in this domain.

There are many sections still to be added and more to be readjusted and rewritten to reflect the current state of the security world. Much needs to be written on Web 2.0 technologies and distributed B2B technologies such as Webservices.

The Code review process and procedure needs also to be covered. A guide to establishing a mature code review process also needs to be done. Code review methodologies also need to be discussed.

• Objectives and Deliverables:

Update of the code review guide:

• Add additional areas relating to the code review process such as:
  • Benefits and pitfalls
  • Methodology
  • The code review process
    • Transactional analysis
    • Managing the code review process
    • Assigning risk to findings

• • Technical guides
    • Language specific best practice
    • Java
    • .NET
    • PHP
    • MySQL
    • Stored Procs
    • C/C++

• • Code review by vulnerability:
    • Reviewing Code for Buffer Overruns and Overflows
    • Reviewing Code for OS Injection
    • Reviewing Code for SQL Injection
    • Reviewing Code for Data Validation
    • Reviewing code for XSS issues
    • Reviewing Code for Error Handling
    • Reviewing Code for Logging Issues
    • Reviewing The Secure Code Environment
    • Reviewing code for Authorization Issues
    • Reviewing code for Authentication Issues
    • Reviewing code for Session Integrity
    • Reviewing code for Cross Site Request Forgery
    • Reviewing code for Cryptography implementation issues
    • Reviewing code Dangerous HTTP Methods (Deployment)
    • Race Conditions

The areas of code are structured giving a brief explanation, the anti-pattern (vulnerable pattern to look for) and a suggested fix.

• Why I should be sponsored for the project:

I used to head up the code review team as part of the application security group in fidelity investments and have 5+ years of the secure code review process. I also was the lead of the Testing guide until V2 was published via the Autumn of Code.

I have always delivered any work I have volunteered for on time.

I have been involved in OWASP projects for 2/3 years now and have always been an active contributor.

Paolo Perego - Owasp Orizon Project

• Executive Summary:

Owasp Orizon [16] Project born in 2006 as answer to the lack of common engine and library usable by opensource code review related tools.

I'm proposing that, during the Spring of Code 2007 period, I'll complete static analisys API and java source code enforment objects.

Sometimes a complete code review approach is not suitable for most customers who wants to harden their code which is being approaching release stage. For such a reason, I started writing Java objects that embeds most of the security checks against common web vulnerabilities (XSS, SQL injection, Session handling, ...) so that source code can be hardened with a small effort in terms of code rewriting.

I do believe that a common set of API and a common safe coding best practices library is one of the most important goals to bring application security to the developers.

• Objectives and Deliverables:

Completing the static code review API section

• improving programming language to XML translator
• improving security best practices code review scan library
• improving secure coding fashion best practices library
• writing the pattern matching scan using the aformentioned libraries

Writing the java source code enforment objects

• writing an object to handle form data values to avoid XSS
• writing an object to handle form data values to avoid SQL Injection
• writing an object to handle HttpRequest and HttpSession objects

• Why I should be sponsored for the project:

Owasp Orizon is the first Owasp project I'm involved in. I'm also contributor of Owasp Italian chapter managed by Matteo Meucci and I'm talking at various speeches about application security and safe coding best practices.

I'm a security consultant working in ethical hacking and we're approaching code review and safe topics right now. I'm a developer too so I understand also the "dark side" of the problem developing code with security in mind.

I work using the "release early release often" paradigm so to be concrete and let other people having something usable to work with.

Sebastien Deleersnyder - OWASP Education Project

• Executive Summary:

This Education project aims to provide in building blocks of web application security information. These modules can be combined together in education tracks targeting different audiences.

Web Application Security Education and Awareness is needed throughout the entire organization, each area and level of organizations have specific needs and requirements regarding education. A manager needs other information than a security professional or developer. Novices to the profession require other training than people with several years of experience.

• Objectives and Deliverables:

Currently the project goals are to create Educational Tracks:

• Complete the consolidation page of OWASP presentations performed in the past
• A "Web Application Security Primer" Track for beginners (4 hours)
• A "What developers should know on Web Application Security" Track for developers (4 hours)

• Why you should be sponsored for the project:

I started the successful Belgian Chapter 3 years ago and have actively contributed to OWASP since then. I also co-organized the European conference last year in Belgium.

This is the first separate project that I started, originating from a local demand to set up educational tracks for people that are new to Web Application Security. There are literally hundreds of presentations and an enormous amount of information on the OWASP web site. The goal of this project is to restructure pieces of that information in reusable modules that can be combined in educational tracks. It is my believe that awareness is an important cornerstone of building secure web applications, and this project will actively support that.

If we are granted Spoc 007 participation, I will be sharing the budget with all active participants. This will be an extra motivation for project participation. I will reinvest my part in the project to set up a web conferencing / web casting solution to be used to disseminate the project results and make them available for later use.

• More details:

The detailed road map can be found here. The SpoC 007 goal is to finish Sub Goals 1, 2, 3 and 4. If time permits we can start with sub goal 5.

Subere - OWASP JBroFuzz Project

Overview

JBroFuzz is a stateless network protocol fuzzer that emerged from the needs of penetration testing. The purpose of this application is to provide a single, portable application that offers stable cross-platform network protocol fuzzing capabilities. At the same time, JBroFuzz attempts to keep the User Interface (UI) as intuitive as possible.

Fuzzing

As seen by the emphasis given on the subject of fuzzing in the 2007 Testing Guide (v2), network protocol fuzzing serves as a fundamental cornerstone of application security testing. For this, many different categories and types of fuzzing have been defined.

Objectives

JBroFuzz needs to expand and grow in order to cover network fuzzing in a more complete manner. Its modular implementation allows for the addtion of new functionality by means of independent tabs. The key tabs proposed to be added during the spring of code 2007 are (details in next section):

• Open Source Tab
• NTLM Brute Force over HTTP/S Tab
• Pure HTTP/S Fuzzing using HTTPClient
• Blind SQL Injection Fuzzing Tab

At the same time, the following existing tabs need to be updated and made more robust (details in next section):

• TCP Fuzzing tab allowing graph outputs
• TCP Sniffing tab update thread Agent Queue
• Update Generators file format
• Include SOAP and XML fuzzing

This expansion process relates to stabilising code that is presently included in JBroFuzz, thus allowing it to run for extensive periods of time (24h+) as well as adding more functionality in terms of the three new tabs.

Deliverables

Based on the above, the new code elements that will be added are as follows:

• Open Source Tab: Provide the ability to enumerate e-mails from newsgroups without breaching google automated search rules
• NTLM Brute Force over HTTP/S Tab: Provide the ability to enumerate NTLM as well as brute over HTTP/S NTLM.
• Pure HTTP/S Fuzzing: Implement a fuzzing tab utilising HTTPClient from Jakarta that will also allow for multi-threading
• Blind SQL Fuzzing Tab Implement a tab that extracts information from a blind SQL injection point identified on web server over HTTP/HTTPS.

For updating existing code elements that require a partial rewrite, the following areas of focus are presented in detail:

• TCP Fuzzing tab allowing graph outputs: Provide the ability to graph fuzzing results during a particular session run. This will give the ability to integrate and pickup potential fuzzing patterns.
• TCP Sniffing tab update thread Agent Queue: Update the code of the sniffing panel in order to handle threaded agents in a more memory efficient way.
• Update Generators file format: Update the generators file format to allow for the parsing and creation of recursive generators.
• Include SOAP and XML fuzzing: Include an up to date list of SOAP and XML fuzzing templates.

Overall, the above two lists of changes should provide sufficient complexity and output for the spring of code 2007, forming a challenging implementation project.

Background

In its short life, the OWASP JBroFuzz Project has attracted the interest of the online security community with a total of appr. 5000 downloads in the last months.

Coming from a strong java background (5+ years) I decided to implement and release JBroFuzz in order to initially simplify penetrations testing processes that relate to web application and network protocol fuzzing.

I see the spring of code 2007 as a unique opportunity to industrialise network protocol fuzzing (and in particular HTTP/S fuzzing) within a single application, residing within OWASP.

Why should JBroFuzz be sponsored?

Centralising fuzzing resources into one application that has the ability to handle network protocol fuzzing over HTTP and HTTPS in a simple and intuitive manner forms an area of focus that should not be dismissed in building secure software applications.

Keep the code platform independent adds a huge advantage.

Receving an OWASP grant from the spring of code 2007 will trigger a share in the budget with all active participants depending on their level of involvement. This will be a direct function of the number of tabs and/or user functionality that they have assisted in implementing.

Joshua Perrymon - OWASP LiveCD Project

• Executive Summary:

I am proposing that I complete the second version of the OWASP LiveCD during this period. The first version of the LiveCD is now available and include many of the current OWASP documents and tools. I believe the LiveCD is one of the best mediums to promote OWASP tools and documentation. It is portable and already being used by thousands of security proffesionals to perform application testing and training.

In the current state the CD is stable and contains a lot of tools. However, this is just the beginning. There is a LOT of work that needs to be completed. The entire CD experience needs to be branded using OWASP graphics. This shouls start with the boot screen and carry all the way through to the icons and desktop graphics. The CD should also inlcude the wiki and ALL the tools developed for OWASP.

• Objectives and Deliverables:

Update of the LiveCD:

• Complete OWASP branding
• Add OWASP wiki
• Add encryption capabilities
• Add more OWASP tools
• Add more pen-test tools such as;

VOIP, RFID, BlueTooth, Wireless, etc..

• Why I should be sponsored for the project:

I had the idea of the LiveCD about a year ago and have worked very hard to get the first version developed. This was driven by my vision to make all of the OWASP tools available on a portable medium. The main difference in the OWASP liveCD vs. other live CDs is going to be the regularity of updates. If sponsorship can be obtained the CD could be updated on a monthly basis. Not once a year like other liveCDs. The CD will also include specialty tools and documentation to perform VOIP, RFID,Bluetooth, and wireless security assessments.

---

Mark Curphey – The OWASP Web Security Certification Framework

Problem

PCI DSS is attracting a lot of criticism for a lot of valid reasons.

http://securitybuddha.com/2007/03/23/the-problems-with-the-pci-data-security-standard-part-1/

http://blogs.csoonline.com/node/210

http://www.computerweekly.com/blogs/stuart_king/2007/03/more-on-pci---the-audit-guide.html

The list is of course long and not appropriate here……and while its easy to knock PCI, there is nothing better out there.

Solution and Deliverables

As opposed to me continuing saying what’s wrong with PCI DSS, it seems to me that OWASP is a perfect forum to simply create and publish a “better criteria”. This can either be adopted and implemented by an organization like OWASP or considered to be incorporated into the PCI or other security standards. We won't get bogged down in the politics up-front, but hold something good up to the world for people to adopt. This project would of course draw on and bring together many of the other OWASP Projects including the Guide (What is a secure web app), Testing Guides (How to test for a secure web app), WebGoat (part of how to certify an individual understands and can find web app issues) etc. Many of those projects may not be complete or a perfect fit today, but this project can bring a common connecting theme to a lot of very valuable IP that OWASP has built over the years. I will also create it in such as way that a corporate could adopt/adapt it themseles as well as an industry. Where other OWASP projects are not complete or currently suitable I will build a requirements doc that can be considered by those teams if they feel appropriate.

This project would address the;

Standard

• A complete auditable (important) web site security standard suitable for modern e-commerce companies including
  • The technical things people should care about
  • The operational / management things people should care about

Certification Model

• A complete framework for certification (ongoing) and implementation (including certifying auditors, ongoing validation etc). This will include for example the model for certifying auditors (including the actual test program); checklists and forms for auditors to complete and other supporting material.

Essentially its a complete blueprint for an organisation like OWASP or a regulatory body need to run a web site security certification program complete with the supporting material to implement it.

Note: This is no trivial task to get right. I would need to ensure I can commit to completing the work to a good quality. I think this will take at least 2 months from start to finish to complete but I think is very important for the industry and for potentially for OWASP. I wanted to gauge the interest by first posting this.

Erwin Geirnaert - OWASP Java Project

• Executive Summary:

I would like to help the OWASP Java Project to gather all Java security related information and to document any domains that lack documentation.

• Objectives and Deliverables:

The main objective I see is to gather all information in one place, where security experts and developers can find the information they need. In order to get there, I need to collect all information in the OWASP Wiki, ask people if they want to donate it to OWASP so that we can include it as public material, add URLs, white-papers, references to books, ... And if time permits, write some documentation myself.

One deliverable is the OWASP Top 10 for J2EE applications with clear examples of vulnerabilities and mitigations.

• Why you should be sponsored for the project:

I have more then 10 years experience in Java and J2EE and the last 6 years I have tested and broke a lot of web applications. I gave also some very successful J2EE security courses and web security courses. I spoke at different conferences about application security in Europe. And I am responsible for the security track at Javapolis, one of the biggest Jave conferences in Europe. I am the co-founder of ZION SECURITY where we do security testing, code review, design reviews, training,... I'm also member of the OWASP Belgium board that started in March 2007.

Erwin Geirnaert - OWASP WebGoat Solutions Guide

• Executive Summary:

WebGoat is used by a lot of people to learn about web application security and the different vulnerabilities. But it takes a lot of time to grasp how the tools like WebScarab work and how to use them effectively in WebGoat. I propose to create a walkthrough of the lessons in WebGoat so that people can learn from the solutions, without spoiling the fun.

• Objectives and Deliverables:

The WebGoat Solutions Guide is a document that can be bundled with WebGoat. Each lesson contains a detailed solution with screenshots and tools. I created a PDF with the solution for WebGoat 4.0 but this is too big to load (15 MB) and is not very practical.

After a discussion with Bruce about this, we think that the solutions should be made like the existing Lessons Plan so it is easier to maintain and update when a lesson changes. This means that there will be documentation folder and an individual solution for each lesson.

• Why you should be sponsored for the project:

I have more then 10 years experience in Java and J2EE and the last 6 years I have tested and broke a lot of web applications. I gave also some very successful J2EE security courses and web security courses. I spoke at different conferences about application security in Europe. And I am responsible for the security track at Javapolis, one of the biggest Jave conferences in Europe. I am the co-founder of ZION SECURITY where we do security testing, code review, design reviews, training,... I'm also member of the OWASP Belgium board that started in March 2007.

Bunyamin Demir – OWASP WeBekci Project

Executive Summary:

Web application firewalls (WAF) are gaining importance among the information security technologies designed to protect web sites from attack. WAF solutions prevent attacks that network firewalls and intrusion detection systems can't and they require no modification of application source code. ModSecurity [17] is an open source web application firewall that runs as an Apache module. It is an embeddable web application firewall and it provides protection from a range of attacks against web applications. It is an open source project available to everyone; it however does not come with an admin panel.

I decided to provide this essential tool with a control panel which I believe will ease and thus encourage its usage.

ModSecurity allows for HTTP traffic monitoring and real-time analysis with no changes to existing infrastructure. My main goal is to analyze attacks and generate rules to change the configuration of the ModSecurity accordingly.

ModSecurity has a feature called “flexible rule engine” as its heart of Attack Prevention capability . It uses ModSecurity’s “Rule Language,” (a programming language designed to work with HTTP transaction data). It is easy to use and flexible; yet the system administrators need to learn its own rules to create what is called “Certified ModSecurity Rules” to be implemented. My control panel will automate the major code-generation in Rule Language.

Objectives and Deliverables:

• Configuration : Will add all configuration parameter
• Rule Generator: Will write all the Rules in Rule Language
• Logging  : Auditlog and debuglog will be added.
• Multiple-DB  : Will add PostgreSql and Sqlite support.

Why I should be sponsored for the project:

I am involved with OWASP Turkey [18] and interested very much in WAF. Even though this is my first project for OWASP, I am very much interested in every aspect of ModSecurity. With SpoC007’s support I will finalize my work on OWASP WeBekci [19].

Eric Sheridan and Dr. Goran Trajkovski - The Scholastic Application Security Assessment Project

ABSTRACT

One of the major goals of the Open Web Application Security Project is to educate developers in the field of application software security. Understanding the risks and threats associated with web application software is pivotal in building a mature application security process. While OWASP has made a significant impact in the professional industry, more time and energy should be focused towards the academic community. It is an unfortunate fact that most universities do not require a stringent software security course for their computer science students. Consequently, most young developers do not have the ability to assess and mitigate the risks and threats for their own applications. It is for this reason that we believe the Open Web Application Security Project should fund an initiative to encourage the adaptation of application software security methodologies in the academic course curriculum.

The Scholastic Application Security Project is intended to be the first step towards integrating security requirements in academic course curriculums. The primary goal of the project is to give students hands-on experience performing application security assessments using the tools and documentation found at http:///www.owasp.org. The assessment, lead by an application security professional, will demonstrate to students how the information and tools found at OWASP can be used to assess and ultimately increase the overall security posture of a web application.

This project contributes towards bridging the gap between academia and industry, by equipping students with hands-on ready-for-the-job-market skills in the application software securing industry.

PARTICIPANTS

The Scholastic Application Security Assessment Project requires that college level students, lead by an application security professional, perform a security audit on an open source web application using the tools and information available at OWASP.

• Application Security Professional – Eric Sheridan (Aspect Security)
• Towson University (TU) Partner – Dr. Goran Trajkovski, Towson University (http://www.towson.edu)
• Students – Students of TU’s Application Software Security Course (COSC 458), nominated by the TU Partner
• Web Application – The Open WebMail Project (http://openwebmail.org/)

OWASP UTILIZATION

The Scholastic Application Security Assessment Project requires heavy utilization of existing OWASP tools and utilities. Through this requirement, the project will illustrate the fact that existing OWASP resources can be used and heavily relied upon in a professional security audit. The following is a list of notable OWASP resources whose use will be documented throughout the assessment:

• OWASP Top Ten 2007 - The security critical areas that the students will assess in the review
• OWASP Testing Guide v2 – The primary resource for building penetration testing cases
• OWASP Guide – The primary resource for technical details pertaining to a technology and/or vulnerability
• OWASP WebScarabNG – The primary proxy utility used throughout the assessment

THE FINAL REPORT

Students are required to follow the principle of “responsible disclosure” during the course of the security assessment. The developers of the open source application will be notified if any significant issues are found. Once the assessment is complete, a final report will be delivered to the application developers and the appropriate OWASP Spring of Code personnel. For each finding in the report, the students will be required to describe how the tools and information found at OWASP were used in the discovery.

HOW DOES OWASP BENEFIT?

The Scholastic Application Security Assessment Project is specifically designed to benefit the OWASP brand:

The OWASP Community…

• will be provided a case study proving that the resources available at OWASP can be utilized in an academic environment, that can be later used in advertising the OWASP efforts to similar programs as the one at TU.
• will be providing students a hands on experience in learning and testing for the latest web application security threats, thus potentially enlarging the OWASP community of contributors and supporters.
• will be addressing the need to educate developers in the security critical areas.
• will be seen as offering a professional level service to another open source project.
• will be addressing one of the root causes of application software insecurity.

BACKGROUND

Eric Sheridan:

• Earned a Bachelor’s of Science in Computer Science from Towson University
• Graduate Student in Information Security at Johns Hopkins University
• Application Security Engineer at Aspect Security
• Lead of the OWASP Stinger Project and the OWASP Validation Project

Goran Trajkovski, PhD:

• Has been teaching the Application Software Security course for the Computer Security undergraduate and master-level majors at TU since 2004 (TU has been a Center of Excellence in Information Assurance, designated by the NSA since 2002).
• Assistant professor of Computer and Information Sciences at Towson University, and Director of its Cognitive Agency and Robotics Lab (CARoL).
• Has lead curricular efforts in integrating application software security topics throughout the Computer Science and Computer Information Sciences curriculum
• 12 years of full time teaching experience in higher ed.

Boris - OWASP Site Generator

OWASP Site Generator is a great tool, but it could be even better and more widespread. There’s a lot room for improvements to both its functionality and user experience. The way I see it, main user needs to be addressed and specific development objectives for the next release of OWASP Site Generator would be:

User Needs

• Create multiple types of sites easily
• Track and analyze requests easily
• Change the look and feel of the resulting sites easily
• Create sites for multiple web backend technologies easily
• Learn how to use OWASP Site Generator easily

Development Objectives

• Create a vulnerability library that can be used for web services, HTML forms, AJAX, etc. instead of having to craft the same attack for each
• Add support for logging of all received requests, as well as querying resulting log files
• "Templatize" the code generation process, so it can support skinning of the resulting sites
• "Templatize" the code generation process, so it can support different backend web technologies
• Fix all significant defects in the current release of OWASP Site Generator
• Redesign the GUI to make it more efficient and user friendly
• Create a smooth setup program which would install both client and server components as effortlessly as possible
• Write documentation and articles about it
• Make the development process open to the public and, hopefully, driven by its feedback from day one

Why should I be sponsored for this project

Well, probably because of my past work on AoC (I just hope that won’t be the reason for me not to be sponsored :)

Boris - OWASP Report Generator

There is no doubt that OWASP Report Generator is a very handy tool for penetration testers and other security researchers, but it would be even better if some enhancements were made:

User Needs

• More robustness
• Ease of use (more efficient and intuitive GUI)
• Automated reporting for some typical (or not so typical) scenarios
• More documentation
• More samples

Development Objectives

• Redesign the GUI to make it more efficient and user friendly
• Clean up the code
• Add functionality to import, execute and create reports for OWASP Tiger automated tests
• Create some samples
• Create a smooth setup program
• Write documentation and articles about it
• Make the development process open to the public and, hopefully, driven by its feedback from day one

Why should I be sponsored for this project

Well, probably because of my past work on AoC (I just hope that won’t be the reason for me not to be sponsored :)

Boris - OWASP Tiger

OWASP Tiger project is at its very beginning. Some new features are needed in order for it to become more useful. Here’s a short list:

User Needs

• Easier editing of test projects
• Support for testing sites that require authentication
• Support for testing sites that require use of cookies
• An easy way of specifying vulnerability data, ideally an automated one
• More flexible reporting
• More project templates
• More documentation

Development Objectives

• Add support for cookies
• Add support for standard authentication schemes
• Add support for importing vulnerability data from a test definition (or a vulnerability library)
• Make use of OWASP Report Generator for more advanced reports
• Create a setup program that would install both client and project templates and also allow for adding new templates after the initial installation
• Write documentation and articles about it
• Make the development process open to the public and, hopefully, driven by its feedback from day one

Why should I be sponsored for this project

Well, probably because of my past work on AoC (I just hope that won’t be the reason for me not to be sponsored :)

Heiko - Web Application Security put into practice

I'm trying to make the OWASP Top Ten and Guide project known in the programming community, but I understand that clear examples in the specific programming language and best practices with explanation educate the best. I'm at the chair for secure software at my university and I want to contribute practical examples, because I believe not to teach secure programming is a great oversight in today's education. Not only the programmers in large companies have to be aware of security impacts, but also their future employees and their freelance programmers. I'm with a large organization of freelance programmers, which I want to make aware of security flaws.

The Ruby on Rails Security project [20] started this year and is the only security initiative for Ruby on Rails. Ruby is the fastest growing level A programming language, according to the Tiobe programming community index [21], partly because of its advertised simplicity. This is dangerous, as programmers could be enticed to do cargo cult programming [22] without knowing the security impacts. I found several security holes in popular modules, and even the Rails framework itself generates potentially insecure code. Nevertheless, Rails provides good means against many of the OWASP Top Ten security flaws, but I believe these means have to be popularized much more.

Objectives and Deliverables

• Create a security guide to the most popular web server software, Apache
  • Installation
  • secure configuration, emphasis on Rails, but not limited to it
  • file system privileges for Rails and Apache
  • anti profiling techniques for Apache
  • Modules and Mod_security configuration

• Create a security guide to the popular database software, MySQL, as practical contribution to the OWASP Top 10 Insecure storage section
  • Installation
  • secure configuration, emphasis on Rails, but not limited to it
  • file system privileges for Rails and MySQL
  • MySQL access restriction techniques
  • encryption methods

• Ruby on Rails security guide and code examples, with at least the following topics:
  • Anti profiling techniques
  • Rails routes security
  • error handling and presentation, as in OWASP Top 10 Improper Error Handling
  • OWASP Top 10: XSS in Rails
  • OWASP Top 10: SQL injection in Rails
  • OWASP Top 10: Parameter injection in Rails
  • OWASP Top 10: Session handling in Rails
  • OWASP Top 10: Access control in Rails
  • handling of files
  • integrity
  • encryption and SSL
  • logging flaws
  • Ajax security

• Code & other
  • means to check the security of MySQL
  • input validation guide, and implement it in Ruby
  • update the poorly documented guide at http://manuals.rubyonrails.com/read/chapter/40 which is the only official guide to security
  • usage guide for OWASP tools, also in connection with Rails
  • make the results known in the several communities I'm in
  • if applicable: submit code to Rails for security holes found

Why I should be sponsored for the project

I have been programming professionally for 10 years and created several software products, including Internet applications, and I always focused on security. I am currently graduating university, my thesis is about web application security. Recently, I started the Ruby on Rails security project, which is the only security project for Rails. I have always delivered my work on time, and I believe I have the knowledge to deliver good quality.

Long-term vision for the project

Make it available to the community and accept security notices and best practices from other users to constantly improve it.

Benefits to the OWASP

• practical guides on how to put security into practice: the most popular web server software Apache and the popular database software MySQL
• if applicable: additional examples and chapters for the OWASP Guide
• the first and only fully-fledged security guide to a programming language and framework which is used by many large companies
• security awareness of future employees and freelancers
• more exposure of the OWASP

Denis – Python Tainted Mode

I am graduate student of Moscow State University, department of Computational Mathematics and Cybernetics. My graduate work is dedicated to web-application security. The goal of my graduate work is to combine dynamic code analysis with penetration testing to provide more precise analysis. This work will help to find security vulnerabilities in web-applications. I successfully presented parts of my work at university conferences.

My Project

The goal of my project is to create analog of Perl’s Taint Mode for Python programming language. Taint mode is successfully used in Perl, PHP, and Ruby to find input validation vulnerabilities in web-applications (see for ex. PHPRevent[23]). Unfortunately there is no implementation of Taint Mode for Python language despite of wide spread of Python-based web-applications. Taint Mode for Python is highly claimed. I plan to modify Python interpreter and add Taint label propagation. Then I’ll add three configuration lists:

• List of sources. All data emanating from sources must be marked tainted.
• List of critical functions, that shouldn’t receive tainted data.
• List of sanitizing functions that untaints data.

These three lists are dependent on technology that is used between web-server and web-applications in web server. In my project I plan to build such lists for mod_python and then broaden for other technologies. With switched on taint mode web-application will receive exceptions when critical function receives tainted data.

Why should I be selected

I have strong mathematical & computer science background. I’m familiar with research publications on dynamic analysis and with implementation of taint mode in Perl and PHP (PHPrevent Project). This project is part of my work at university. It will be made under mentoring of my scientific advisor. This work is already practically done that’s why I’m sure I will finish my project in time. I have strong skills in developing projects with Python, Java, C, C++, and Assembler. Then I plan to support, develop and enhance my project and increase its quality with penetration testing.

If you have any questions or would like further information, feel free to contact me.

Yours faithfully, Denis

Darren Edmonds - WebScarab NG Security Test Automation

Background

I am a 28 year old software developer from the UK with a background in java based web development and application security testing. I have strong mathematical skills, a degree in software engineering, a SCJP qualification and 8 years of commercial development experience. I have created many web based and standalone applications delivering on time and adhering to common software practices. I'm an avid supporter of open source software and try to use it whenever possible in a commercial environment. I've made contributions to the Geotools mapping project, written a securing tomcat article for OWASP and developed a full modification for the first person shooter Quake 3.

Project Details

Having used numerous penetration testing applications I believe there is a need for an open source application which supports some, or all, of the features of the more expensive commercial products. I propose to make WebScarab generate, record, and playback security test cases so that regression testing is possible. If time permits I would also like to include some extra automated tests that are not always feasible during manual testing; searching for backup files (~, Copy of X), checking non-authorised access to authorised areas, common and brute force name directory searching, etc. Perhaps include the ability to read the test database of other scanning tools such as nikto. I have already made contact with Rogan Dawes, original WebScarab NG author, to discuss some initial ideas. I believe it is important that Rogan is consulted during the initial planning phase to make sure the project keeps to a set of consistent guidelines.

Milestones

• Research regression testing features in other applications
• Create a functional specification
• Build testing framework (possible inclusion of scripting language for user defined tests)
• Testing

Why I Should be Sponsored

I believe I am an ideal candidate to develop the proposed additions to WebScarab NG, not just because of my qualifications and experience, but because I plan to use WebScarab NG in my work to help perform the initial testing of web applications. As well as my own time my current employer will allocate me a set amount of time to ensure the project achieves its milestones. The end result will make WebScarab NG a much more powerful testing tool and will be a great asset to the OWASP community. With continued development and input from the community I see no reason why WebScarab NG cannot rival commercial testing application features, usability, and business benefit. Increasing WebScarab's features will result in increased community awareness bringing in extra developers, ensuring continual development and so the cycle starts again.

Bernardo - sqlmap

• Executive Summary

sqlmap is an automatic blind SQL injection tool, developed in python, capable to perform an active database fingerprint, to enumerate entire remote database and much more. The aim of this project is to implement a fully functional database mapper tool which takes advantages of web application programming security flaws which lead to SQL injection vulnerabilities.

• Objectives and Deliverables
  • Add support for Oracle database management system;
  • Add support to extract database users password hash;
  • Extend inband SQL injection functionality to all other possible queries;
  • Add Microsoft SQL Server database fingerprint;
  • Add a fuzzer class with the aim to parse html page looking for standard database error messages consequently improving database fingerprinting;
  • Add support for SQL injection on HTTP Cookie and User-Agent headers;
  • Add support for query ETA (Estimated Time of Arrival) real time calculation;
  • Improve Google dorking support to take advantage of remote hosts affected by SQL injection to perform other command line argument actions;
  • Improve logging functionality.

• Long-term vision for the project

Make sqlmap available as an easy-to-use enumeration and penetration testing tool to the OWASP community extending its functionality to exploit SQL injection vulnerabilities to provide a remote shell on the affected web application database server when possible. In the long run I would also like to develop a graphical user interface.

• Why I should be sponsored for the project

I have good python programming skills and some years of experience in computer networks security. I spent most of the last year researching on web application insecurity taking over the sqlmap development since December 2006. Actually I work as software developer at an information security company in Italy where I mostly deal with vulnerability assessment.

Jim - Best Practices & Countermeasures

Community

I have been running the Buffalo, NY OWASP chapter since 2004. I have been President of ISACA WNY since 2005. I have delivered presentations at Buffalo ISSA, Rochester ISSA, ISACA WNY, and Buffalo OWASP meetings on the topic of Web Application Security.

My Project

The Best Practices & Countermeasures project will outline best practices that should be followed to address/prevent known web application security issues. The best practices will be divided up into related sections. For instance, there will be an "Authentication" section that would have best practices as follows: 1) Require strong passwords 2) For sensitive sites, require two-factor authentication 3) For intranet sites, tie authentication into existing authentication directory server, such as LDAP. 4) Implement account lock-out after 5 failed login attempts 5) Add a log entry and/or an alert to IDS operators after 5 failed login attempts 6) etc.

Each best practice could also have links to language-specific code constructs that show how to implement each best practice.

Long Term

It is my hope that this project can be used not only by developers, but also by IT auditors and security professionals during audits & assessments

Why should I be selected

I have 15 years experience in IT, with 10 years experience in IT Security. I have a bachelor's degree in Computer Science and professional experience as a programmer/developer.

Arshan Dabirsiaghi - OWASP The Anti-Samy Project

My name is Arshan Dabirsiaghi and I am a 25 year old security consultant. I want to open the door for web sites to allow users to supply their own HTML without exposing them to cross-site scripting attacks.

Background

B.S., M.S. in Computer Science (focus on Information Security)

2.5 years security engineer/consultant experience

4 years of web and systems development

8 years of security hobbying

Challenge

Many sites today would enjoy the ability to allow users to provide their own HTML in order to customize their page layout and general user experience. Because of the concerns regarding XSS, it is generally thought of as 'too dangerous' to allow them to input any HTML at all. Sites like MySpace who have been brave enough to provide this functionality have no standardized, proven solution to validate user HTML. In many cases, it's easier to disallow everything that looks HTML or to output encode all their input. Sites like MySpace that have been brave enough to try to attempt this have been the targets of complex attacks. Many sites today don't offer this type of functionality because of concerns for XSS and dangerous HTML.

Objectives

The first goal is to conduct a survey of existing browsers and compare their respective behavior regarding JavaScript (both well-formed and not) inside HTML with regards to W3C specifications

The second goal is to create a software library (versions in both .Net and J2EE) that can accomplish the following goals:

- provide an input validation utility that can detect non-obvious JavaScript inside user-provided HTML
- provide a filtering utility that can take blocks of HTML and strip any JavaScript inside of it while retaining all formatting-related code
- provide these capabilities even when dealing with realistically dirty HTML
- provide feedback information to the user to help them tune their source to fall within acceptable values
- provide these capabilities in an API that's simple and portable
- utilize an XML engine file that can be used in various language implementations (.Net/J2EE/PHP)

I envision the project requiring 3 man-months, with a few milestones to be established at reasonable intervals, such as:

- 3 months out: Begin browser/W3C survey.
- 2 months out: Finish survey and begin development of API.
- 1 month  out: Complete initial API in both Java and .Net
- Near release: Perform intense QA on API, fix any remaining bugs.

Long Term Vision

My goal is to create a peer-reviewed and eventually time-tested solution for detecting and filtering JavaScript from user input. By doing so, we can enable web applications to provide users with richer, more interactive experiences without sacrificing security. This tool will not only provide an input validation component to sites who are currently facing this challenge, but it will also act as an enabler to sites who wished to embrace the new age of user-generated content but were unable to do so because of the risk of XSS.