Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP OWASP Lab Projects Overview Ahmed Saafan Software Security and Data Protection Consultant 12/4/2014

OWASP Agenda Introduction to OWASP Projects’ Process Tools Projects Walk-through Documentation Projects Walk-through Demos

OWASP Introduction What Falls Under OWASP Labs Significant-value code committed Not production ready Can remain in labs forever Tagged inactive after 6 months

OWASP Introduction Benefits of Being a Labs Projects Promotion support Resources priority over incubators Travel funding

OWASP Introduction Project Review Process Technical committee Feedback every 6 months Health Quality Usability Graduation

OWASP Introduction Types of Projects Tools Documentation

OWASP TOOLS

OWASP Projects: Tools OWASP DoS HTTP POST Layer 7 Resource Depletion Attack Send large POSTs slowly Only 20k POSTs to crash an 8-Cores 16GB RAM Web Server Demo

OWASP Projects: Tools OWASP EnDe Advanced Encoding / Decoding Obfuscation and Reversing Demo

OWASP Projects: Tools OWASP CSRFTester Test for CSRF Create CSRF Payloads Auto-post JS Demo

OWASP Projects: Tools YASCA Yet Another Source Code Auditor! Based on Open Source Engines FindBugs, PMD, JLint, JavaScript Lint, PHPLint, Cppcheck, ClamAV, Pixy, FxCop, RATS…etc.Net, Java, Python and PHP Good for automation and finding the hanging fruits

OWASP Projects: Tools OWASP Mantra A bundle of security oriented browser extensions Based on Chromium Demo

OWASP Projects: Tools O2 Platform Security reviews and KB Platform SDLC workflow support Visual studio integration

OWASP Projects: Tools OWASP Broken Web Applications A collection of vulnerable Web Apps Basic, advanced and realistic sections VMware image Demo

OWASP Projects: Tools OWASP Hackademic Challenges Basic web attacks challenges Sep 2011 Demo

OWASP Projects: Tools Mutillidae A vulnerable web application Covering OWASP Top 10 flaws Vicnum A vulnerable web application Used for games and minors education

OWASP Projects: Tools OWASP CTF Actual CTF engine used in OWASP events Challenges code is not open (obviously!) Old unused challenges are opened regularly

OWASP DOCUMENTATION

OWASP Projects: Documentation OWASP Appsec Tutorial Series Video tutorials Basic concepts (XSS, SQLi, HSTS…) On going effort with lots to do

OWASP Projects: Documentation OWASP App Sensor Conceptual framework and methodology Attack detection points and response actions Demo

OWASP Projects: Documentation OWASP Legal Legal documentation framework Security in software contracts Terminology and definitions

OWASP Projects: Documentation OWASP Virtual Patching Guide Best practices for virtual patching Types, definitions and justification

OWASP Question: What is the name of the browser extension that analyzes web applications to detect frameworks, plugins and versions?

OWASP THANK YOU Questions?