OWASP e Case

OWASP v2
Matteo Meucci
OWASP-Italy Chair, CISSP, CISA
OWASP
Italy@SMAU
[email protected]
23 Oct 2005
Copyright © 2005 - The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License.
The OWASP Foundation
http://www.owasp.org
Il progetto OWASP
Il progetto Open Web Application Security Project (OWASP) nasce
da un gruppo composto di volontari che produce tool, standard e
documentazione open-source di qualità professionale.
La comunità OWASP incentiva l'organizzazione di conferenze, la
nascita di local chapter, la scrittura di articoli, papers, e discussioni
riguardanti la Web Security.
La partecipazione in OWASP è free ed aperta a tutti, come il
materiale disponibile sul portale www.owasp.org
Migliaia di membri, 77 capitoli locali
Milioni di hit su www.owasp.org al mese
Defense Information Systems Agency (DISA) , US Federal Trade
Commisson (FTC), VISA, Mastercard, American Express hanno
adottato la documentazione OWASP nei loro standard e linee guida
SMAU – E-Academy, 07 Oct 06
OWASP Italy
2
Iniziative principali:
Guide
CLASP
Ajax
Top 10
Training
Conferences
WebGoat
Orizon
.NET, Java
Building our
brand
Yours!
Chapters
Testing
Project
incubator
WebScarab
Validation
Certification
SMAU – E-Academy, 07 Oct 06
Wiki portal
Forums
Blogs
OWASP Italy
3
OWASP Autumn of Code 2006
1. WebScarab NG – Rogan Dawes
2. Live CD – Joshua Perrymon
3. CAL9000 – Chris Loomis
4. SiteGenerator and ORG – Mike de Libero
5. Pantera – Simon Roses
6. Web Goat – Sherif Koussa
7. Testing Guide – Matteo Meucci
8. OWASP .NET Tools – Boris
9. OWASP Website and Branding – Aaron M. Holmes
SMAU – E-Academy, 07 Oct 06
OWASP Italy
4
OWASP Testing v2: Index draft
1. Frontispiece
2. Introduction
3. The OWASP Testing Framework (we describe the framework and
the testing methodologies)
4. Web Application Penetration Testing Techniques (we describe all
about the pentesting splitted by categories like authentication,
session management, ecc)
5. Writing Reports: value the real risk (a new chapter about the value
of the real risk after finding the vulnerabilities)
Appendix A: Testing Tools
Appendix B: Suggested Reading
Appendix C: Fuzz Vectors
SMAU – E-Academy, 07 Oct 06
OWASP Italy
5
Grazie!
http://www.owasp.org
http://www.owasp.org/index.php/Italy
[email protected]
SMAU – E-Academy, 07 Oct 06
OWASP Italy
6