OWASP Testing Guide Table of Contents

Frontispiece

1. Copyright and License
2. Endorsements
3. Trademarks

Introduction

1. Performing An Application Security Review
2. Principles of Testing
3. Testing Techniques Explained

Methodologies Used

1. Secure application design
2. Code Review (See the code review project)
   • Overview
   • Advantages and Disadvantages
3. Penetration Testing
   • Overview
   • Advantages and Disadvantages
4. The Need for a Balanced Approach
5. A Note about Web Application Scanners
6. A Note about Static Source Code Review Tools

Finding Specific Issues In a Non-Technical Manner

1. Threat Modeling Introduction
2. Design Reviews
3. Threat Modeling the Application
4. Policy Reviews
5. Requirements Analysis
6. Developer Interviews and Interaction

Finding Specific Vulnerabilities Using Source Code Review

1. Gathering the information
   • Context, Context, Context
   • The Checklist
   • The Code Base
   • Transactional Analysis
2. Source code examples
3. Authentication & Authorisation
   • How to locate the potentially vulnerable code
4. Buffer Overruns and Overflows
   • How to locate the potentially vulnerable code:
   • Vulnerable Patterns for buffer overflows
   • Good Patterns & procedures to prevent buffer overflows
5. Data Validation
   • Canoncalization of input.
     • Data validation strategy
   • Good Patterns for Data validation
     • Framework Example
   • Data validation of parameter names
   • Web services data validation
6. Error, Exception handling & Logging
   • Releasing resources and good housekeeping
7. OS Injection
8. SQL Injection
   • How to Locate potentially vulnerable code
   • Best practices when dealing with DB’s
9. Threat Modeling
   • Overview
   • Advantages and Disadvantages
     • Advantages
     • Disadvantage

Manual testing techniques

1. Business logic testing - <TBD>
2. Authentication
3. How to perform cookie manipulation test
4. How to test for weak session tokens
5. Vulnerable remember password implementation
6. Default or Guessable User Accounts and Empty Passwords
7. Application Layer Denial of Service (DoS) Attacks
8. DoS: Locking Customer Accounts
9. DoS: Buffer Overflows
10. DoS: User Specified Object Allocation
11. DoS: User Input as a Loop Counter
12. DoS: Writing User Provided Data to Disk
13. DoS: Failure to Release Resources
14. DoS: Storing too Much Data in Session
15. Buffer Overflow
16. Test and debug files
17. File extensions handling
18. Old, backup and unreferenced files
19. Defense from Automatic Attacks
20. Configuration Management Infrastructure
21. Sensitive data in URL’s
22. SSL / TLS cipher specifications and requirements for site
23. How to Test
24. References
25. Tools
26. Web Services Security Testing

The OWASP Testing Framework

1. Overview
2. Phase 1 — Before Development Begins
   • Phase 1A: Policies and Standards Review
   • Phase 1B: Develop Measurement and Metrics Criteria (Ensure Traceability)
3. Phase 2: During Definition and Design
   • Phase 2A: Security Requirements Review
   • Phase 2B: Design an Architecture Review
   • Phase 2C: Create and Review UML Models
   • Phase 2D: Create and Review Threat Models
4. Phase 3: During Development
   • Phase 3A: Code Walkthroughs
   • Phase 3B: Code Reviews
5. Phase 4: During Deployment
   • Phase 4A: Application Penetration Testing
   • Phase 4B: Configuration Management Testing
6. Phase 5: Maintenance and Operations
   • Phase 5A: Conduct Operational Management Reviews
   • Phase 5B: Conduct Periodic Health Checks
   • Phase 5C: Ensure Change Verification
7. A Typical SDLC Testing Workflow
   • Figure 3: Typical SDLC Testing Workflow.

Appendix A: Testing Tools

1. Source Code Analyzers
2. Open Source / Freeware
   • Commercial
3. Black Box Scanners
   • Open Source
   • Commercial
4. Other Tools
   • Runtime Analysis
   • Binary Analysis
   • Requirements Management

Appendix B: Suggested Reading

1. Whitepapers
2. Books
3. Articles
4. Useful Websites
5. OWASP — http://www.owasp.org

Figures

1. Figure 1: Proportion of Test Effort in SDLC.
2. Figure 2: Proportion of Test Effort According to Test Technique.
3. Figure 3: Typical SDLC Testing Workflow.