|
|
| (150 intermediate revisions by 15 users not shown) |
| Line 1: |
Line 1: |
| − | Updated 19th Nov, 17.00 GMT+1
| + | __NOTOC__ |
| − | Legend:<br>
| |
| − | xx%: Progress status of the paragraph <br>
| |
| − | Review: the paragraph need a review (Matteo Meucci)<br>
| |
| − | TD: Paragraph To Be Assigned<br>
| |
| | | | |
| − | [[http://www.owasp.org/index.php/OWASP_Autumn_of_Code_2006_-_Projects:_Testing_Guide OWASP Testing Guide AoC]]
| + | Please go [http://www.owasp.org/index.php/OWASP_Testing_Guide_v3_Table_of_Contents here] for the last release of the OWASP Testing Guide. |
| − | | |
| − | [[http://www.owasp.org/index.php/OWASP_Testing_Guide_v2_Review_Panel Review Panel]]
| |
| − | | |
| − | | |
| − | ==[[Testing Guide Frontispiece AoC|Frontispiece]]==
| |
| − | | |
| − | '''1.1 About The Open Web Application Security Project''' (100%)<br>
| |
| − | 1.1.1 Overview (100%)<br>
| |
| − | 1.1.2 Structure (100%)<br>
| |
| − | 1.1.3 Licensing (100%)<br>
| |
| − | 1.1.4 Participation and Membership (100%)<br>
| |
| − | 1.1.5 Projects (100%)<br>
| |
| − | 1.1.6 OWASP Privacy Policy (100%)<br>
| |
| − | '''1.2 About the OWASP Testing Guide Project'''<br>
| |
| − | 1.1 Copyright (100%)<br>
| |
| − | 1.2 Editors (0%, Review)<br>
| |
| − | 1.3 Authors and Reviewers (0%, Review)<br>
| |
| − | 1.4 Revision History(0%, Review)<br>
| |
| − | 1.5 Trademarks(100%)<br>
| |
| − | | |
| − | ==[[Testing Guide Introduction AoC|Introduction]]==
| |
| − | '''2.1 The OWASP Testing Project''' (100%)<br>
| |
| − | '''2.2 Principles of Testing''' (100%)<br>
| |
| − | '''2.3 Testing Techniques Explained''' (100%)<br>
| |
| − | | |
| − | ==[[The OWASP Testing Framework AoC|The OWASP Testing Framework]]==
| |
| − | '''3.1. Overview''' (100%)<br>
| |
| − | '''3.2. Phase 1 — Before Development Begins '''(100%)<br>
| |
| − | '''3.3. Phase 2: During Definition and Design'''(100%)<br>
| |
| − | '''3.4. Phase 3: During Development'''(100%)<br>
| |
| − | '''3.5. Phase 4: During Deployment'''(100%)<br>
| |
| − | '''3.6. Phase 5: Maintenance and Operations'''(100%)<br>
| |
| − | '''3.7. A Typical SDLC Testing Workflow '''(100%)<br>
| |
| − | | |
| − | ==[[Web Application Penetration Testing AoC |Web Application Penetration Testing ]]==
| |
| − | '''4.1 Introduction and objectives''' (100%, Matteo Meucci)<br>
| |
| − | | |
| − | '''4.2 Information Gathering''' (100%, Carlo Pelliccioni)<br>
| |
| − | 4.2.1 Testing Web Application Fingerprint (Antonio Parata)<br>
| |
| − | 4.2.2 Application Discovery (100%, Mauro Bregolin)<br>
| |
| − | 4.2.3 Spidering and googling (80%, Tom Brennan, Tom Ryan)<br>
| |
| − | 4.2.4 Analysis of error codes (100%, Carlo Pelliccioni)<br>
| |
| − | 4.2.5 Infrastructure configuration management testing (100%)<br>
| |
| − | 4.2.5.1 SSL/TLS Testing (100%,Mauro Bregolin)<br>
| |
| − | 4.2.5.2 DB Listener Testing (60%, Eoin Keary, Matteo Meucci)<br>
| |
| − | 4.2.6 Application configuration management testing (90%)<br>
| |
| − | 4.2.6.1 File extensions handling (80%,Mauro Bregolin)<br>
| |
| − | 4.2.6.2 Old, backup and unreferenced files (100%,Mauro Bregolin)<br>
| |
| − | | |
| − | '''4.3 Business logic testing''' (100%,Madhura Halasgikar)<br>
| |
| − | | |
| − | '''4.4 Authentication Testing''' (100%, Intro Meucci)<br>
| |
| − | 4.4.1 Default or guessable (dictionary) user account (100%)<br>
| |
| − | 4.4.2 Brute Force (100%,Giorgio Fedon, Andrea Lombardini)<br>
| |
| − | 4.4.3 Bypassing authentication schema (100%,Giorgio Fedon, Andrea Lombardini)<br>
| |
| − | 4.4.4 Directory traversal/file include (100%, Luca Carettoni)<br>
| |
| − | 4.4.5 Vulnerable remember password and pwd reset (100%, Ralph M. Los,Alberto Revelli)<br>
| |
| − | 4.4.6 Logout and Browser Cache Management Testing (100%,Alberto Revelli)<br>
| |
| − | | |
| − | '''4.5 Session Management Testing''' (100% intro,Glyn Geoghegan, Meucci)<br>
| |
| − | 4.5.1 Analysis of the Session Management Schema (100%, Meucci)<br>
| |
| − | 4.5.2 Cookie and Session token Manipulation (100%,Alberto Revelli, Matteo Meucci) <br>
| |
| − | 4.5.3 Exposed session variables (100%,Meucci)<br>
| |
| − | 4.5.4 Session Riding (XSRF) (100%, Mauro Bregolin,Review)<br>
| |
| − | 4.5.5 HTTP Exploit (0%, Arian J.Evans)<br>
| |
| − | | |
| − | '''4.6 Data Validation Testing''' (Intro 95% Meucci) <br>
| |
| − | 4.6.1 Cross site scripting (80%, Tom Brennan, Tom Ryan) <br>
| |
| − | 4.6.1.1 HTTP Methods and XST (100%, Alberto Revelli) <br>
| |
| − | 4.6.2 SQL Injection (100%, Antonio Parata) <br>
| |
| − | 4.6.2.1 Stored procedure injection (40%,Gary Burns)<br>
| |
| − | 4.6.2.2 Oracle testing (0%,TD) <br>
| |
| − | 4.6.2.3 MySQL testing (100%, Stefano Di Paola) <br>
| |
| − | 4.6.2.4 SQL Server testing (95%,Ariel Waissbein)<br>
| |
| − | 4.6.3 LDAP Injection (95%,Stefano Di Paola) <br>
| |
| − | 4.6.4 ORM Injection (0%,Mark Roxberry) <br>
| |
| − | 4.6.5 XML Injection (100%,Antonio Parata, Stefano Di Paola) <br>
| |
| − | 4.6.6 SSI Injection (100%,Claudio Merloni, Review) <br>
| |
| − | 4.6.7 XPath Injection (90%, Antonio Parata, Alberto Revelli, Stefano Di Paola) <br>
| |
| − | 4.6.8 IMAP/SMTP Injection (100%, Vicente Aguilera) <br>
| |
| − | 4.6.9 Code Injection (70%, Mark Roxberry) <br>
| |
| − | 4.6.10 OS Commanding (70%, Gary Burns) <br>
| |
| − | 4.6.11 Buffer overflow Testing (100%) <br>
| |
| − | 4.6.11.1 Heap overflow (100%) <br>
| |
| − | 4.6.11.2 Stack overflow (100%) <br>
| |
| − | 4.6.11.3 Format string (100%) <br>
| |
| − | 4.6.12 Incubated vulnerability testing (95%,Ariel Waissbein, Laura Nuñez) <br>
| |
| − | '''4.7 Denial of Service Testing''' (100%) <br>
| |
| − | 4.7.1 Locking Customer Accounts 100% Review<br>
| |
| − | 4.7.2 Buffer Overflows (100%) <br>
| |
| − | 4.7.3 User Specified Object Allocation (100%)<br>
| |
| − | 4.7.4 User Input as a Loop Counter (100%)<br>
| |
| − | 4.7.5 Writing User Provided Data to Disk (100%)<br>
| |
| − | 4.7.6 Failure to Release Resources (100%)<br>
| |
| − | 4.7.7 Storing too Much Data in Session (100%)<br>
| |
| − | | |
| − | '''4.8 Web Services Testing''' (100%,Eoin Keary, Mark Roxberry)<br>
| |
| − | 4.8.1 XML Structural Testing (100%)<br>
| |
| − | 4.8.2 XML content-level Testing (100%)<br>
| |
| − | 4.8.3 HTTP GET parameters/REST Testing (100%)<br>
| |
| − | 4.8.4 Naughty SOAP attachments (100%)<br>
| |
| − | 4.8.5 Replay Testing (100%)<br>
| |
| − | | |
| − | '''4.9 AJAX Testing''' (70%, Dan Cornell, Giorgio Fedon, Stefano Di Paola)<br>
| |
| − | 4.9.1 Vulnerabilities (60%, Anush Shetty) <br>
| |
| − | 4.9.2 How to test (60%)<br>
| |
| − | | |
| − | ==[[Writing Reports: value the real risk AoC |Writing Reports: value the real risk ]]==
| |
| − | '''5.1 How to value the real risk''' (80%, Daniel Cuthbert, Matteo Meucci, Sebastien Deleersnyder, Marco Morana)<br>
| |
| − | '''5.2 How to write the report of the testing''' (20%, Daniel Cuthbert, Tom Brennan, Tom Ryan) TD<br>
| |
| − | | |
| − | ==[[Appendix A: Testing Tools |Appendix A: Testing Tools ]]==
| |
| − | (90%)<br>
| |
| − | * Black Box Testing Tools
| |
| − | * Source Code Analyzers
| |
| − | * Other Tools
| |
| − | | |
| − | ==[[OWASP Testing Guide Appendix B: Suggested Reading | Appendix B: Suggested Reading]]==
| |
| − | (70%)<br>
| |
| − | * Whitepapers<br>
| |
| − | * Books<br>
| |
| − | * Articles<br>
| |
| − | * Useful Websites<br>
| |
| − | | |
| − | ==[[OWASP Testing Guide Appendix C: Fuzz Vectors | Appendix C: Fuzz Vectors]]==
| |
| − | (70%)
| |
| − | | |
| − | <br>
| |
| − | | |
| − | {{Category:OWASP Testing Project AoC}}
| |
