OWASP Leeds UK
Welcome to the Leeds UK chapter homepage. This is a new chapter and we are looking for enthusiatic new members to make this one of the best OWASP chapters. We are hoping to accumalate a good proportion of subject matter experts who will in turn be able to provide guidance and presentations for the benefit of all chapter members. So please join the mailing list and contribute.
Details of your chapter Board members can be found here Leeds_UK_chapter_leaders
The chapter email address is [email protected]
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?
2010 Planned Meetings
Date: Wednesday 15th September
RSVP your ticket for this event http://www.eventbrite.com/event/842723609
Location: Novotel Leeds, 4 Whitehall Quay, Leeds, LS1 4HR
Schedule: 18:00 for 18:15 start
18:20 - 18:30
OWASP Chapter introduction. OWASP values. Chapter information.
Jason Alexander - OWASP Leeds/Northern Chapter Board Member
18:30 - 19:15
Context Application Tool CAT
Context Application Tool (CAT) is a tool for performing manual web application penetration testing. The presentation will show the main features of CAT with demonstrations of where CAT can perform tests that other tools currently available cannot and how CAT empowers the user to create more complex test cases to further explore the boundaries of the application. The focus of CAT is on manual penetration testing and not on automated web VA scanning. Also a sneak preview of the current features that are currently in development an due to be release late this year.
The presentation will start with an overview of the new CAT application and demonstrating how the tool can be used in all aspects of manual web application testing. The aim to provide delegates with a high level understand of the capability of CAT, covering the following core areas:
-Request Repeater – Used for repeating a single request -Proxy – Classic Inline proxy including -Fuzzer – Allows for batch of tests to be sent to a server for brute forcing, parameter fuzzing, forced browsing etc. -Log – View a list of requests to sort, search repeat etc. Allows for a sequence of requests to be repeated and modified. -Authentication Checker – Two synchronised proxies which can be used to check authentication and authorisation controls. -SSL Checker – Request a specific page with various SSL ciphers and versions. -Notepad – A text/RTF editor which can be used as a scratch pad for conversions etc. -Web Browser – An integrated web browser with proxy pre-configured based on the Internet Explorer’s rendering engine.
Covering the following features:
Then the presentation will focus on a few examples where CAT allows for testing which was previously particularly difficult, these include:
1. Using project based tabbed interface which allows for great control and organisation for larger projects 2. Assisted authorisation and authenticated checking use synchronised proxies and cookie fixation 3. Testing of multi-stage and multi-host Single Sign On solutions 4. LDAP timing attacks using HTTP/HTTPS connection caching 5. How CAT encodings can be used to bypass Web Application Firewalls 6. Clickjacking Testing
Finally a sneak preview of the new features that are being developed including the new DB exploitation panel.
Michael Jordon - Principal Security consultant, Context Information Security
19:15 - 20:00
OWASP O2 Platform - Automating Security Knowledge
The O2 Platform is focused on automating application security knowledge and workflows. It is specifically designed for developers and security consultants to be able to perform quick, effective and thorough source code-driven application security reviews (blackbox + whitebox). In addition to the manual findings created/discovered by security consultants, the OWASP O2 Platform allows the easy consumption of results from multiple OWASP projects and commercial scanning tools. This allows security consultants to find, exploit and automate (via Unit Tests) security vulnerabilities usually dismissed by the community as impossible to find/recreate. More importantly, it provides security consultants a mechanism to:
(a) "talk" with developers (via UnitTest) (b) give developers a way to replicate + "check if it's fixed" the vulnerabilities reported (c) engage in a two-way conversion on the best way to fix/remediate those vulnerabilities.
Dinis Cruz - OWASP O2 Project lead and member of the OWASP Global Projects Committee
20:00 - Finish
How I met your girlfriend
Michael Jordon - Michael Jordon is a principal security consultant for Context Information Security. He has over 10 years experience as a software developer and security consultant. His speciality is within application security and secure software development. He is the principal developer of Context App Tool (CAT) the web application penetration testing tool. He is CREST application certified, a member of the SSDP committee and has a degree in Software Engineering. He has release advisories include vulnerabilities in Outlook Web Access, Citrix, Squirrel Mail and Sophos Anti-Virus. He has previously talked at conferences include CREST Conference, ISSD and InfoSecurity Europe
Dinis Cruz - Dinis is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development. For the past years Dinis has focused on the field of Static Source Code analysis, from May 2007 to Dec 2009 he worked as a independent consultant for Ounce Labs (bought by IBM in July 2009) where during active security engagements using Ounce's technology he developed the Open Source codebase which now is the foundation of the OWASP O2 Platform. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between the multiple WebAppSec tools, the Security consultants and the final developers. Dinis is a also active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG (at multiple locations including BlackHat), and has delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences At OWASP, Dinis is the leader of the OWASP O2 Platform project, member of the OWASP Global Projects Committee, chair of the OWASP Connections Committee and member of the OWASP Board.
Samy Kamkar - Samy Kamkar is best known for the Samy worm, the first XSS worm, infecting over one million users on MySpace in less than 24 hours. A co-founder of Fonality, Inc., an IP PBX company, Samy previously led the development of all top-level domain name server software and systems for Global Domains International (.ws). In the past 10 years, Samy has focused on evolutionary and genetic algorithmic software development, Voice over IP software development, automated security and vulnerability research in network security, reverse engineering, and network gaming. When not strapped behind the Matrix, Samy can be found stunt driving, getting involved in local community service projects, and continuing his focus on staying out of jail.