This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP Securing WebGoat using ModSecurity Project"

From OWASP
Jump to: navigation, search
(adding some blog references to the project)
Line 42: Line 42:
  
 
ModSecurity Blog
 
ModSecurity Blog
 +
 
http://blog.modsecurity.org/2008/10/securing-webgoat-using-modsecurity.html
 
http://blog.modsecurity.org/2008/10/securing-webgoat-using-modsecurity.html
  
 
OWASP EU Summit in Portugal: Thursday
 
OWASP EU Summit in Portugal: Thursday
 +
 
http://denimgroup.typepad.com/denim_group/2008/11/owasp-eu-summit-in-portugal-thursday.html
 
http://denimgroup.typepad.com/denim_group/2008/11/owasp-eu-summit-in-portugal-thursday.html
  
 
OWASP Podcast #2 Securing Webgoat with ModSecurity
 
OWASP Podcast #2 Securing Webgoat with ModSecurity
 +
 
http://manicode.blogspot.com/2008/12/owasp-podcast-2-securing-webgoat-with.html
 
http://manicode.blogspot.com/2008/12/owasp-podcast-2-securing-webgoat-with.html
  
 
Waffing: ModSecurity applied
 
Waffing: ModSecurity applied
 +
 
http://swende.se/index.php?/archives/26-Waffing-ModSecurity-applied.html
 
http://swende.se/index.php?/archives/26-Waffing-ModSecurity-applied.html
  
 
WebGoat, Lua, and ModSecurity verses Password Guessing
 
WebGoat, Lua, and ModSecurity verses Password Guessing
 +
 
http://blog.securitymonks.com/2009/01/10/webgoat-lua-and-modsecurity-verses-password-guessing/
 
http://blog.securitymonks.com/2009/01/10/webgoat-lua-and-modsecurity-verses-password-guessing/
  

Revision as of 10:20, 3 February 2009

OWASP Books logo.png This project has produced a book that can be downloaded or purchased.
Feel free to browse the full catalog of available OWASP books.
PROJECT IDENTIFICATION
Project Name OWASP Securing WebGoat using ModSecurity Project
Short Project Description The purpose of this project is to create custom Modsecurity rulesets that, in addition to the Core Set, will protect WebGoat 5.1 from as many of its vulnerabilities as possible (the goal is 90%) without changing one line of source code. To ensure that it will be a complete 'no touch' on WebGoat and its environment, ModSecurity will be configured on Apache server as a remote proxy server. For those vulnerabilities that cannot be prevented (partially or not at all), I will document my efforts in attempting to protect them. Business logic vulnerabilities will be particularly challenging to solve.
Project key Information Project Leader
Stephen Craig Evans
Project Contributors
(if applicable)
Mailing List
Subscribe here
Use here
License
Creative Commons Attribution Share Alike 3.0
Project Type
Documentation
Sponsors
OWASP SoC 08
Release Status Main Links Related Projects

Beta Quality
Please see here for complete information.

OWASP WebGoat Project

Welcome to the OWASP Securing WebGoat using ModSecurity Project

The purpose of the OWASP Securing WebGoat using ModSecurity Project is to use ModSecurity 2.5 to protect WebGoat 5.2 from as many of its vulnerabilities as possible (the goal is 90%).

Securing WebGoat using ModSecurity Project wiki v1.0

Mailing List

https://lists.owasp.org/mailman/listinfo/owasp-webgoat-using-modsecurity

[email protected]

Project News

  • 31 Dec 2008:
    • This project was discussed by Arshan Dabirsiaghi, Jeff Williams, Jeremiah Grossman, and Jim Manico in OWASP Podcast #1 starting at the 58 minute mark.
    • Project member Stephen Craig Evans talks about the project as the guest of Jim Manico in OWASP Podcast #2.
  • 29 Nov 2008:
    • Added Appendix D to wiki, "Additional important stuff", which includes the wiki in a Word document (here) and some slide decks
    • Tested out the mailing list
    • Sent an email to OWASP Leaders and to Kenneth van Wyck's Secure Coding list to inform them of the project and its current state
  • 16 Nov 2008 - Added 'Section 4.4: Unfinished Business' which includes discussions about concurrent file access and Lua security.
  • 06 Nov 2008 - Gave 2 project presentations at the OWASP EU Summit in Portugal.
  • 05 Nov 2008 - Finished incorporating all reviewer comments.
  • 22 Oct 2008 - Wiki updates; project near 100% completion.
  • 14 Jul 2008 - Project wiki created and under construction.

Mentions in the Media

ModSecurity Blog

http://blog.modsecurity.org/2008/10/securing-webgoat-using-modsecurity.html

OWASP EU Summit in Portugal: Thursday

http://denimgroup.typepad.com/denim_group/2008/11/owasp-eu-summit-in-portugal-thursday.html

OWASP Podcast #2 Securing Webgoat with ModSecurity

http://manicode.blogspot.com/2008/12/owasp-podcast-2-securing-webgoat-with.html

Waffing: ModSecurity applied

http://swende.se/index.php?/archives/26-Waffing-ModSecurity-applied.html

WebGoat, Lua, and ModSecurity verses Password Guessing

http://blog.securitymonks.com/2009/01/10/webgoat-lua-and-modsecurity-verses-password-guessing/

Contacts

stephencraig_dot_evans_at_gmail_dot_com

This category currently contains no pages or media.