Presenting the OWASP Testing Guide v4 ALPHA Andrew Muller, Matteo Meucci

About Me Andrew works with ISO and OWASP developing security testing standards and guides.Andrew works with ISO and OWASP developing security testing standards and guides. Director at Ionize Matteo has lead the OTG Project from version 2.Matteo has lead the OTG Project from version 2. CEO at Minded Security Hosted by OWASP & the NYC Chapter

Agenda Hosted by OWASP & the NYC Chapter What is the OTG?What is the OTG? History of the OTGHistory of the OTG Moving from version 3 to version 4Moving from version 3 to version 4 Version 4 roadmapVersion 4 roadmap

V4: Index Hosted by OWASP & the NYC Chapter 1. Frontispiece 2. Introduction 3. The OWASP Testing Framework 4. Web Application Penetration Testing 5. Writing Reports: value the real risk Appendix A: Testing Tools Appendix B: Suggested Reading Appendix C: Fuzz Vectors Appendix D: Encoded Injection

V4 Alpha Hosted by OWASP & the NYC Chapter NIST SP “Technical Guide to Information Security Testing and Assessment” Gary McGraw (CTO Cigital) says: “In my opinion it is the strongest piece of Intellectual Property in the OWASP portfolio” – OWASP Podcast by Jim Manico NSA’s "Guidelines for Implementation of REST“ Official (ISC)2 Guide to the CSSLP - Page: 70, 365 Many books, blogs and websites

Key benefits Hosted by OWASP & the NYC Chapter 6 OWASP Testing Guide is driven by our Community OWASP Testing Guide is driven by our Community It’s aligned with the other OWASP guides It’s aligned with the other OWASP guides Development Guide Development Guide Code Review Guide Code Review Guide OpenSAMM OpenSAMM Common Numbering Project Common Numbering Project Accepted testing methodology Accepted testing methodology Relevant Relevant Repeatable Repeatable Rigourous Rigourous

Testing Guide History Hosted by OWASP & the NYC Chapter January 2004 – " The OWASP Testing Guide", Version 1.0 July 14, 2004 – "OWASP Web Application Penetration Checklist", Version 1.1 December 25, 2006 – "OWASP Testing Guide", Version 2.0 December 16, 2008 – "OWASP Testing Guide", Version – "OWASP Testing Guide", Version 4.0

2011 Roadmap Hosted by OWASP & the NYC Chapter Review all the control numbers to adhere to the OWASP Common numbering, Review all the sections in v3, Create a more readable guide, eliminating some sections that are not really useful, Insert new testing techniques: HTTP Verb tampering, HTTP Parameter Pollutions, etc., Rationalize some sections as Session Management Testing, Create a new section: Client side security and Firefox extensions testing?

OWASP TG Complexity Hosted by OWASP & the NYC Chapter Number of pages Version

V3 vs. V4 Chapters Hosted by OWASP & the NYC Chapter

Information Gathering

Hosted by OWASP & the NYC Chapter Configuration Management

Hosted by OWASP & the NYC Chapter Identity Management

Hosted by OWASP & the NYC Chapter Authentication Testing

Hosted by OWASP & the NYC Chapter Authorization Testing

Hosted by OWASP & the NYC Chapter Session Management Testing

Hosted by OWASP & the NYC Chapter Data Validation Testing

Hosted by OWASP & the NYC Chapter Error handling

Hosted by OWASP & the NYC Chapter Cryptography Testing

Hosted by OWASP & the NYC Chapter Logging Testing

Hosted by OWASP & the NYC Chapter Denial of Service

Hosted by OWASP & the NYC Chapter Web Service Testing

Hosted by OWASP & the NYC Chapter Client Side Testing

Hosted by OWASP & the NYC Chapter V4 Authors Amro Alolaqi Alexander Antukh Alexander Vavousis Anant Shrivastava Andrew Muller Babu Arokiadas Ben Walther Cecil Su Christian Heinrich Clerkendweller David Fern Davide Danelon Denis Vinny Eduardo Castellanos Eoin Keary Ismael Rocha Goncalves Jeff Williams John Abraham Juan Galiana Juan Manuel Bahamonde Kevin Johnson Luca Carettoni Matteo Meucci Pavol Luptak Rick Mitchell Rob Barnes Robert Winkel Ryan Dewhurst Simone Onofri Stefano Di Paola Thomas Kalamaris Tom Eston

2013 Roadmap Hosted by OWASP & the NYC Chapter We are at the final stage of the new versionWe are at the final stage of the new version 1 st deadline for a first draft of the articles: 30 th November st deadline for a first draft of the articles: 30 th November th December : final deadline for writing the articles15 th December : final deadline for writing the articles 15 th January: 1 st review15 th January: 1 st review End of January: Beta version (we hope! Good luck boys! Welcome to hell!)End of January: Beta version (we hope! Good luck boys! Welcome to hell!)

Future Improvements Managing contributions via Github Split Guide into Application, Web Service, and Mobile Testing Guides Jack Mannino has started the Mobile Testing Project _Security_Project_-_Security_Testing Hosted by OWASP & the NYC Chapter

Questions? Hosted by OWASP & the NYC Chapter