This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "SpoC 007 - Attacks Reference Guide - Progress Page"

From OWASP
Jump to: navigation, search
(Phase 2)
(Phase 1)
Line 9: Line 9:
 
===Phase 1 ===
 
===Phase 1 ===
 
* Attack List Revision: '''Done!'''
 
* Attack List Revision: '''Done!'''
 +
We note that Attack reference guide was previously defined based on [http://cwe.mitre.org/ CWE - Common Weakness Enumeration], which defines global software weakness and threats. In order to develop the Attack reference guide focused on Web application attacks, we removed some items from the list, as follows:
 +
 
* Attacks Description: 20 of 84 items done!
 
* Attacks Description: 20 of 84 items done!
  

Revision as of 19:53, 14 August 2007

The Attack reference guide is being developed by NSRAV Security Research group and Przemyslaw 'Rezos' Skowron. In order to avoid work superposition, the project was divided in 3 phases comprising the following activities:

  1. Attack list revision and description
  2. Attacks categorization
  3. Research and describe new attacks

CheckPoints and Decision

Phase 1

  • Attack List Revision: Done!

We note that Attack reference guide was previously defined based on CWE - Common Weakness Enumeration, which defines global software weakness and threats. In order to develop the Attack reference guide focused on Web application attacks, we removed some items from the list, as follows:

  • Attacks Description: 20 of 84 items done!

Phase 2 - DONE!

The attacks categorization was based on Common Attack Pattern Enumeration and Classification - CAPEC, since it is maintained by a respected entity and wide enough to fit all web application attacks.

The categories defined are:

  • Abuse of Functionality
  • Spoofing
  • Probabilistic Techniques
  • Exploitation of Authentication
  • Resource Depletion
  • Exploitation of Privilege/Trust
  • Injection (Injecting Control Plane content through the Data Plane)
  • Data Structure Attacks
  • Data Leakage Attacks
  • Resource Manipulation
  • Protocol Manipulation
  • Time and State Attacks

It was also defined the threats categorization based on WASC Threat Classification v2, under development.

Phase 3

  • Research new attacks
  • New attacks description