This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Testing Guide Table of Contents"

From OWASP
Jump to: navigation, search
(Added "Finding Specific Vulnerabilities Using Source Code Review" to port the related contents.)
m (→‎Manual testing techniques: Make index items links.)
Line 62: Line 62:
  
 
==[[Manual testing techniques]]==
 
==[[Manual testing techniques]]==
−
#Business logic testing - <TBD>
+
#[[Business logic testing]] - <TBD>
−
#Authentication
+
#[[Authentication Testing Guide|Authentication]]
 
#*Default or guessable user accounts
 
#*Default or guessable user accounts
 
#** Causes
 
#** Causes
Line 71: Line 71:
 
#** Whitebox Testing
 
#** Whitebox Testing
 
#** Further Reading
 
#** Further Reading
−
#Cookie manipulation
+
#[[Cookie manipulation]]
 
#*Short Description of Issue
 
#*Short Description of Issue
 
#*How to Test
 
#*How to Test
Line 85: Line 85:
 
#*Whitepapers
 
#*Whitepapers
 
#*Tools
 
#*Tools
−
#Weak Session Tokens
+
#[[Weak Session Tokens]]
 
#*Blackbox Testing
 
#*Blackbox Testing
 
#*Manual
 
#*Manual
Line 91: Line 91:
 
#*Whitebox Testing
 
#*Whitebox Testing
 
#*Further Reading
 
#*Further Reading
−
#Session riding
+
#[[Session riding]]
 
#*How to Test
 
#*How to Test
 
#*Black Box
 
#*Black Box
Line 99: Line 99:
 
#*Whitepapers
 
#*Whitepapers
 
#*Tools
 
#*Tools
−
#Vulnerable remember password implementation
+
#[[Vulnerable remember password implementation]]
 
#*Blackbox Testing
 
#*Blackbox Testing
 
#*Manual
 
#*Manual
Line 105: Line 105:
 
#*Whitebox Testing
 
#*Whitebox Testing
 
#*Further Reading
 
#*Further Reading
−
#Weak Password Self-Reset Testing
+
#[[Weak Password Self-Reset Testing]]
 
#*Blackbox Testing
 
#*Blackbox Testing
 
#*Manual
 
#*Manual
−
#Default or Guessable User Accounts and Empty Passwords
+
#[[Default or Guessable User Accounts and Empty Passwords]]
 
#*Blackbox Testing
 
#*Blackbox Testing
 
#*Manual
 
#*Manual
Line 114: Line 114:
 
#*Whitebox Testing
 
#*Whitebox Testing
 
#*Further Reading
 
#*Further Reading
−
#Application Layer Denial of Service (DoS) Attacks
+
#[[Application Layer Denial of Service (DoS) Attacks]]
−
#DoS: Locking Customer Accounts
+
#[[DoS: Locking Customer Accounts]]
 
#*Black Box Testing
 
#*Black Box Testing
 
#*White Box Testing
 
#*White Box Testing
−
#DoS: Buffer Overflows
+
#[[DoS: Buffer Overflows]]
 
#*Code Example
 
#*Code Example
 
#*Testing Black Box
 
#*Testing Black Box
 
#*Testing White Box
 
#*Testing White Box
−
#DoS: User Specified Object Allocation
+
#[[DoS: User Specified Object Allocation]]
 
#*Code Example
 
#*Code Example
 
#*Testing Black Box
 
#*Testing Black Box
 
#*Testing White Box
 
#*Testing White Box
−
#DoS: User Input as a Loop Counter
+
#[[DoS: User Input as a Loop Counter]]
 
#*Code Example
 
#*Code Example
 
#*Testing Black Box
 
#*Testing Black Box
 
#*Testing White Box
 
#*Testing White Box
−
#*DoS: Writing User Provided Data to Disk
+
#[[DoS: Writing User Provided Data to Disk]]
 
#*Testing Black Box
 
#*Testing Black Box
 
#*Testing White Box
 
#*Testing White Box
−
#DoS: Failure to Release Resources
+
#[[DoS: Failure to Release Resources]]
 
#*Code Example
 
#*Code Example
 
#*Testing Black Box
 
#*Testing Black Box
 
#*Testing White Box
 
#*Testing White Box
−
#DoS: Storing too Much Data in Session
+
#[[DoS: Storing too Much Data in Session]]
 
#*Testing Black Box
 
#*Testing Black Box
 
#*Testing White Box
 
#*Testing White Box
 
#*Other References
 
#*Other References
−
#Buffer Overflow
+
#[[Buffer Overflow Testing Guide|Buffer Overflow]]
 
#*Buffer Overflow – Heap Overflow Vulnerability
 
#*Buffer Overflow – Heap Overflow Vulnerability
 
#**How to Test
 
#**How to Test
Line 147: Line 147:
 
#**White Box
 
#**White Box
 
#*Buffer Overflow – Stack Overflow Vulnerability
 
#*Buffer Overflow – Stack Overflow Vulnerability
−
#*How to Test
+
#**How to Test
−
#*Black Box
+
#**Black Box
−
#*White Box
+
#**White Box
−
#*References
+
#**References
−
#*Examples
+
#**Examples
−
#*Whitepapers
+
#**Whitepapers
−
#*Tools
+
#**Tools
 
#*Buffer Overflow – Format String Vulnerability
 
#*Buffer Overflow – Format String Vulnerability
 
#**Black Box
 
#**Black Box
Line 160: Line 160:
 
#**Whitepapers
 
#**Whitepapers
 
#**Tools
 
#**Tools
−
#Test and debug files
+
#[[Test and debug files]]
 
#*How to Test
 
#*How to Test
 
#*Black Box
 
#*Black Box
Line 168: Line 168:
 
#*Whitepapers
 
#*Whitepapers
 
#*Tools
 
#*Tools
−
#File extensions handling
+
#[[File extensions handling]]
 
#*How to Test
 
#*How to Test
 
#*Black Box
 
#*Black Box
Line 176: Line 176:
 
#*Whitepapers
 
#*Whitepapers
 
#*Tools
 
#*Tools
−
#Old, backup and unreferenced files
+
#[[Old, backup and unreferenced files]]
 
#*Threats
 
#*Threats
 
#*Countermeasures
 
#*Countermeasures
Line 182: Line 182:
 
#*Black Box
 
#*Black Box
 
#*White Box
 
#*White Box
−
#** Tools
+
#**Tools
−
#Defense from Automatic Attacks
+
#[[Defense from Automatic Attacks]]
 
#*Blackbox Testing
 
#*Blackbox Testing
 
#*Manual
 
#*Manual
Line 190: Line 190:
 
#*Further Reading
 
#*Further Reading
 
#*SSL usage during whole session (see recent post on Webappsec regarding this) [Yvan Boily ([email protected]) ]
 
#*SSL usage during whole session (see recent post on Webappsec regarding this) [Yvan Boily ([email protected]) ]
−
#Configuration Management Infrastructure
+
#[[Configuration Management Infrastructure]]
 
#*Review of the application architecture
 
#*Review of the application architecture
 
#*Known server vulnerabilities
 
#*Known server vulnerabilities
Line 204: Line 204:
 
#*Log rotation
 
#*Log rotation
 
#*Log review
 
#*Log review
−
#Sensitive data in URL’s
+
#[[Sensitive data in URL’s]]
 
#*Hashing sensitive data
 
#*Hashing sensitive data
−
#SSL / TLS cipher specifications and requirements for site
+
#[[SSL / TLS cipher specifications and requirements for site]]
 
#*How to Test
 
#*How to Test
 
#*Black Box
 
#*Black Box
Line 214: Line 214:
 
#*Whitepapers
 
#*Whitepapers
 
#Tools
 
#Tools
−
#How to Test
+
#[[How to Test]]
 
#*Black Box
 
#*Black Box
 
#*White Box
 
#*White Box
−
#References
+
#[[References]]
 
#*Examples
 
#*Examples
 
#*Whitepapers
 
#*Whitepapers
−
#Tools
+
#[[Testing Tools|Tools]]
 
#*Language/Services/Application Specific Testing
 
#*Language/Services/Application Specific Testing
−
#Web Services Security Testing
+
#[[Web Services Security Testing]]
 
#*Notes
 
#*Notes
 
#*How to Test
 
#*How to Test
Line 231: Line 231:
 
#*Examples
 
#*Examples
 
#*Whitepapers
 
#*Whitepapers
−
#*Analyzing Results
+
#*Analyzing Results
 +
 
 
==[[The OWASP Testing Framework]]==
 
==[[The OWASP Testing Framework]]==
 
#Overview
 
#Overview

Revision as of 14:10, 26 July 2006

Frontispiece

  1. Copyright and License
  2. Endorsements
  3. Trademarks

Introduction

  1. Performing An Application Security Review
  2. Principles of Testing
  3. Testing Techniques Explained

Methodologies Used

  1. Secure application design
  2. Code Review (See the code review project)
    • Overview
    • Advantages and Disadvantages
  3. Penetration Testing
    • Overview
    • Advantages and Disadvantages
  4. The Need for a Balanced Approach
  5. A Note about Web Application Scanners
  6. A Note about Static Source Code Review Tools

Finding Specific Issues In a Non-Technical Manner

  1. Threat Modeling Introduction
  2. Design Reviews
  3. Threat Modeling the Application
  4. Policy Reviews
  5. Requirements Analysis
  6. Developer Interviews and Interaction

Finding Specific Vulnerabilities Using Source Code Review

  1. Gathering the information
    • Context, Context, Context
    • The Checklist
    • The Code Base
    • Transactional Analysis
  2. Source code examples
  3. Authentication & Authorisation
    • How to locate the potentially vulnerable code
  4. Buffer Overruns and Overflows
    • How to locate the potentially vulnerable code:
    • Vulnerable Patterns for buffer overflows
    • Good Patterns & procedures to prevent buffer overflows
  5. Data Validation
    • Canoncalization of input.
      • Data validation strategy
    • Good Patterns for Data validation
      • Framework Example
    • Data validation of parameter names
    • Web services data validation
  6. Error, Exception handling & Logging
    • Releasing resources and good housekeeping
  7. OS Injection
  8. SQL Injection
    • How to Locate potentially vulnerable code
    • Best practices when dealing with DB’s
  9. Threat Modeling
    • Overview
    • Advantages and Disadvantages
      • Advantages
      • Disadvantage

Manual testing techniques

  1. Business logic testing - <TBD>
  2. Authentication
    • Default or guessable user accounts
      • Causes
      • Blackbox Testing
      • Manual
      • Suggested Tools - <TBD>
      • Whitebox Testing
      • Further Reading
  3. Cookie manipulation
    • Short Description of Issue
    • How to Test
    • Black Box
    • Cookie reverse engineering
    • Cookie manipulation
    • Brute force
      • Cookie predictability
      • 335697#**
    • Overflow
    • White Box
    • Examples
    • Whitepapers
    • Tools
  4. Weak Session Tokens
    • Blackbox Testing
    • Manual
    • Suggested Tools
    • Whitebox Testing
    • Further Reading
  5. Session riding
    • How to Test
    • Black Box
    • White Box
    • References
    • Examples
    • Whitepapers
    • Tools
  6. Vulnerable remember password implementation
    • Blackbox Testing
    • Manual
    • Suggested Tools:
    • Whitebox Testing
    • Further Reading
  7. Weak Password Self-Reset Testing
    • Blackbox Testing
    • Manual
  8. Default or Guessable User Accounts and Empty Passwords
    • Blackbox Testing
    • Manual
    • Suggested Tools
    • Whitebox Testing
    • Further Reading
  9. Application Layer Denial of Service (DoS) Attacks
  10. DoS: Locking Customer Accounts
    • Black Box Testing
    • White Box Testing
  11. DoS: Buffer Overflows
    • Code Example
    • Testing Black Box
    • Testing White Box
  12. DoS: User Specified Object Allocation
    • Code Example
    • Testing Black Box
    • Testing White Box
  13. DoS: User Input as a Loop Counter
    • Code Example
    • Testing Black Box
    • Testing White Box
  14. DoS: Writing User Provided Data to Disk
    • Testing Black Box
    • Testing White Box
  15. DoS: Failure to Release Resources
    • Code Example
    • Testing Black Box
    • Testing White Box
  16. DoS: Storing too Much Data in Session
    • Testing Black Box
    • Testing White Box
    • Other References
  17. Buffer Overflow
    • Buffer Overflow – Heap Overflow Vulnerability
      • How to Test
      • Black Box
      • White Box
    • Buffer Overflow – Stack Overflow Vulnerability
      • How to Test
      • Black Box
      • White Box
      • References
      • Examples
      • Whitepapers
      • Tools
    • Buffer Overflow – Format String Vulnerability
      • Black Box
      • White Box
      • References
      • Whitepapers
      • Tools
  18. Test and debug files
    • How to Test
    • Black Box
    • White Box
    • References - <TBD>
    • Examples
    • Whitepapers
    • Tools
  19. File extensions handling
    • How to Test
    • Black Box
    • White Box
    • References
    • Examples
    • Whitepapers
    • Tools
  20. Old, backup and unreferenced files
    • Threats
    • Countermeasures
    • How to Test
    • Black Box
    • White Box
      • Tools
  21. Defense from Automatic Attacks
    • Blackbox Testing
    • Manual
    • Suggested Tools
    • Whitebox Testing
    • Further Reading
    • SSL usage during whole session (see recent post on Webappsec regarding this) [Yvan Boily ([email protected]) ]
  22. Configuration Management Infrastructure
    • Review of the application architecture
    • Known server vulnerabilities
    • Administrative tools
    • Authentication back-ends
    • Configuration Management Application
    • Sample/known files and directories
    • Comment review
    • Configuration review
    • Logging
    • Log location
    • Log storage
    • Log rotation
    • Log review
  23. Sensitive data in URL’s
    • Hashing sensitive data
  24. SSL / TLS cipher specifications and requirements for site
    • How to Test
    • Black Box
    • White Box
      • References
    • Examples
    • Whitepapers
  25. Tools
  26. How to Test
    • Black Box
    • White Box
  27. References
    • Examples
    • Whitepapers
  28. Tools
    • Language/Services/Application Specific Testing
  29. Web Services Security Testing
    • Notes
    • How to Test
    • Transport Layer Security
    • Message Layer Security
    • Application Layer Security
    • References
    • Examples
    • Whitepapers
    • Analyzing Results

The OWASP Testing Framework

  1. Overview
  2. Phase 1 — Before Development Begins
    • Phase 1A: Policies and Standards Review
    • Phase 1B: Develop Measurement and Metrics Criteria (Ensure Traceability)
  3. Phase 2: During Definition and Design
    • Phase 2A: Security Requirements Review
    • Phase 2B: Design an Architecture Review
    • Phase 2C: Create and Review UML Models
    • Phase 2D: Create and Review Threat Models
  4. Phase 3: During Development
    • Phase 3A: Code Walkthroughs
    • Phase 3B: Code Reviews
  5. Phase 4: During Deployment
    • Phase 4A: Application Penetration Testing
    • Phase 4B: Configuration Management Testing
  6. Phase 5: Maintenance and Operations
    • Phase 5A: Conduct Operational Management Reviews
    • Phase 5B: Conduct Periodic Health Checks
    • Phase 5C: Ensure Change Verification
  7. A Typical SDLC Testing Workflow
    • Figure 3: Typical SDLC Testing Workflow.

Appendix A: Testing Tools

  1. Source Code Analyzers
  2. Open Source / Freeware
    • Commercial
  3. Black Box Scanners
    • Open Source
    • Commercial
  4. Other Tools
    • Runtime Analysis
    • Binary Analysis
    • Requirements Management

Appendix B: Suggested Reading

  1. Whitepapers
  2. Books
  3. Articles
  4. Useful Websites
  5. OWASP — http://www.owasp.org

Figures

  1. Figure 1: Proportion of Test Effort in SDLC.
  2. Figure 2: Proportion of Test Effort According to Test Technique.
  3. Figure 3: Typical SDLC Testing Workflow.
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Testing_Guide_Table_of_Contents&oldid=8182"