Tuesday, April 22, 2014

OWASP Connector - April 22


OWASP Global Connector
April 22, 2014 | | www.owasp.org | Contact Us | Brought to you by the OWASP Foundation
owasp projects

Featured OWASP Project

OWASP SQLiX Project
SQLiX, coded in Perl, is a SQL Injection scanner, able to crawl, detect SQL injection vectors, identify the back-end database and grab function call/UDF results (even execute system commands for MS-SQL). The concepts in use are different than the one used in other SQL injection scanners. SQLiX is able to find normal and blind SQL injection vectors and it doesn't need to reverse engineer the original SQL request (using only function calls). The Project is currently under the process of porting from Perl to Python.
For more information, please contact the Project Leader, Anirudh Anand.

New OWASP Projects

OWASP Code Pulse Project
The OWASP Code Pulse Project is a tool that provides insight into the real-time code coverage of black box testing activities. It is a crosCos-platform desktop application that runs on most major platforms. The pre-release beta for the Code Pulse Project was released earlier this month.
For more information, please contact the Project Leader, Hassan Radwan.
OWASP Secure Headers Project
The OWASP Secure Headers Project involves setting headers from the server is easy and often doesn't require any code changes. Once set, they can restrict modern browsers from running into easily preventable vulnerabilities. Secure Headers intends to raise awareness and use of these headers.
For more information, please contact the Project Leader, Josh Matz.
OWASP Sting Game Project
The OWASP STING Game Project is a card game that will be developed in a downloadable format in the style of Magic the Gathering to teach application security attack and defense. Players will simultaneously attack other players apps while defending their own and supporting game business objectives.
For more information, please contact the Project Leader, Tony Turner.

Project Announcements

iGoat Project New Release
Some big news coming out of the OWASP iGoat Project! First, the OWASP iGoat Project has just released version 2.1, with the new release providing support for iOS 7.1.
To go along with the new release, OWASP iGoat has also announced their new lead developer, Jonathan Carter. Along with the new lead developer, the prospect of new iGoat lessons is eminent. Volunteers are always encouraged to develop their own lessons and donate them to the iGoat Project.
Download the newest version of iGoat Here
Learn how to create your own iGoat lesson Here
Open Source Showcase
The Open Source Showcase, being held at AppSec EU, is a unique event module that allows project leaders and/or project contributors to showcase their work in a demo setting gaining exposure for their projects. The Showcase affords a more personal view of project between attendees.
The guidelines for submitting to the Open Source Showcase are simple: the Open Source Showcase is open to ANY project - not just OWASP projects. The only requirement for submission is that the project must be licensed under an approved Open Source License. All open source projects are encouraged to apply to take part in the Open Source Showcase at AppSec EU 2014 in Cambridge, UK.
Apply Here to be part of the OSS
OWASP Top 10 Privacy Risks Project is gaining momentum in Europe
European Data Protection Supervisory, Internet Privacy Engineering Network (IPEN)division, aims to develop solutions to improve privacy on the internet. They have approached the OWASP Top 10 Privacy Risks Project Leaders for input on the content of their upcoming workshops. The project, which now has over 80 volunteers participating will have the opportunity to shape Internet Security policies.
ZAP 3.0 released!
DOWNLOAD THE LATEST VERSION
REVIEW ALL OF THE UPDATES FOR THE RELEASE
membership

Thank you to our newest Corporate Members:

UIEvolution
Coalfire

Thank you to our renewed Corporate Member:

Accuvant Labs
conferences

Global AppSec Events in 2014

LATAM Tour 2014 (April 21 - May 9)
It isn't too late to sign up for our free conference at one of our 8 stops!

AppSec EU 2014 (June 23 - 26, Cambridge, UK)

AppSec USA 2014 (September 16 - 19, Denver, CO)

Upcoming Regional Events

OWASP Extended AppSec Algeria (May 6-7) Algeria
NYC Security Training
LASCON 2014 (October 21 - 24, Austin, TX)

Partner and Promotional Events

OWASP has partnered with these great events in beginning of 2014 to grow our community and build awareness around software security. If you want to learn more about OWASP's involvement or will be attending and want to help out contact us
Hacker's IDOL - A Cyber Safety Campaign, April 1-October 17, India.
NorthSec 2014, April 25-27, Montreal, Canada.
Thotcon 2014, April 25, Chicago, IL.
National CCDC, April 25-27, San Antonio, TX.
Fraud Summit San Francisco, April 28, San Francisco, CA.
Security B-Sides London 2014, April 29, London, UK.
Fraud Summit Chicago, May 13, Chicago, IL.
ISSA-LA Security Summit, May 16, Los Angeles, CA.
Kansas City Developer Conference, May 15-17, Kansas City, KS.
HITB, May 28-29, Amsterdam, NL.
BSides LV, August 5-6, Las Vegas, NV.
Social Media

OWASP Foundation Social Media

LinkedIn
Twitter
Google +
Facebook
Ning
StackOverflow
education
webinar globe

OWASP Global Webinar

Thursday, April 24th at 10AM EST
Join us for this month's OWASP Project Webinar lead by Project Leader Cam Morris. Cam will be discussing the OWASP Passfault Project. OWASP Passfault evaluates the strength of passwords accurately enough to predict the time to crack. It makes creating passwords and password policies significantly more intuitive and simple.
Register for the 10 am EST Presentation

Register for the 9 pm EST Presentation
communication

A Message from Michael Coates

One area we can improve on is communication - amazing things happen throughout OWASP and we often don't even know about it. Let's change that.
I want to change this by highlighting activity and events every 2 weeks. On Tuesday 4/22 we held the first OWASP Community Update at 9am pacific.

  • We'll use a google hangout event - this allows streaming video and multiple speakers
  • The event is live streamed on youtube & recorded for anyone to review
  • Using Q&A features in google hangouts, twitter (#owasp), and the wiki page we can take questions & answers
  • This update is from all of us. So please add items to the Update page even if you aren't able to make the event!

Check out the updates and announcements from April 22!

Just for Fun

Congratulations to Gerald Miller who was the first person to solve last week's challenge: 3 large + 59 medium + 40 small = 102 total empty
Click here to view last week's puzzle
How fast can you solve this puzzle?
Distances from you to certain cities are written below.
BERLIN: 200 miles
PARIS: 300 miles
ROME: 400 miles
AMSTERDAM: 300 miles
CARDIFF: ??? miles
How far should it be to Cardiff ?
Send your answers to our comment desk for a chance to win a really cheezy prize. Winners will be announced in the next connector.

New OWASP Portal and Community

The new OWASP portal is now live. Since it's launch on April 7, 836 unique people have logged in. In total, over 1300 logins have been recorded.
The portal is the place to go to manage memberships and register for events.
Part of what the portal offers is a community platform. Here owaspers can connect with other owaspers via groups, can submit new ideas, can participate in community polls, and find out what other owaspers are working on. This functionality is in Beta testing, so give it a try and let us know what you think.
To get information on how to get login access to the portal, follow the link below:
PORTAL FAQ

2014 OWASP Annual Report will be released this week!

Members will be emailed a link to the report. The link will be made available on the OWASP wiki


Thursday, April 17, 2014

Open Source Showcase: Demo your Project at AppSec EU 2014!


OWASP is the foremost web application security non-profit organization in the world, with thousands of members globally, including some of the biggest names in the industry. The mission of OWASP is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks. All OWASP materials are free and open under an open source software license.

The UK Cambridge chapter invites you to join top security architects, developers, technology thought leaders, and executives from Fortune 500 firms to the OWASP AppSec Europe global conference taking place in Cambridge, UK from June 23-26, 2014. This conference is an opportunity to hear about the latest research on a myriad of topics related to web security, as well as establish connections between developers, security experts, and business leaders who are all stakeholders in ensuring applications are as secure as possible.

As part of AppSec EU, the conference organizers are looking for projects to participate in the Open Source Showcase. The Open Source Showcase is a unique event module that allows project leaders and/or project contributors to showcase their work in a demo setting and gain exposure for their projects without the need to conduct a full talk session. The showcase allows a more personal view of the project between attendees.

The guidelines for submitting to the Open Source Showcase are simple: the Open Source Showcase is open to ANY project - not just OWASP projects. The only requirement for submission is that the project must be licensed under an approved Open Source License.
All open source projects are encouraged to apply to take part in the Open Source Showcase at AppSec EU 2014 in Cambridge, UK. The application form can be found here: Submission Form.

If you have additional questions, please contact the AppSec EU 2014 Planning Team (appseceu2014@owasp.org).

Wednesday, April 16, 2014

Graphic Design Menu

As some of you may know, OWASP has recently hired a very talented graphic design contractor, Hugo Costa, to help our community with their design related needs. As there are many different marketing pieces Hugo is able to develop, the Ops Team went ahead and put together a Design Menu of services to better outline the types of options our community can choose from. 

The prices listed next to each item are the cost associated for the development of each piece. OWASP is encouraging projects, chapters, and outreach volunteers to use their funds to cover the cost of the designer’s time for development of each menu item. If your project or chapter does not have funds, then please let us know and we will attempt to find you resources for your design needs.

The price includes 3 rough sketches of the menu item, and 5 changes/edits to the chosen design. Then we will charge by the hour for additional changes. The current hourly rate is $15 USD/Hour. Please note that OWASP is not making any profit on the below prices or hourly rate, and passing along the rate and billing directly from the designer.

There are a good range of services that we are able to provide so we recommend having a read, and letting the staff know if you have questions about anything on the design menu. We are more than happy to help you with any design related question. Please submit your request or question via the Contact Us Form

Tuesday, April 15, 2014

OWASP iGoat Project: New release!










Some big news coming out of the OWASP iGoat Project! First, the OWASP iGoat Project has just released version 2.1, with the new release providing support for iOS 7.1. The newest features with the 2.1 version are:

  • The overall look and feel has been updated to comply with iOS 7.x requirements, with the default target now being iOS 7.1, although 7.0 and 7.x should work too.
  • The latest version of OpenSSL for building SQLcipher in the Local Data Storage lesson.
  • Several NSInterger fields have been updated so they work properly on 64- and 32-bit builds.
  • Updates to a couple of deprecated methods to the new 7.x replacement.

OWASP iGoat app continues to only be distributed as a self-contained Xcode project in source code. To run iGoat, you will need Xcode, which is free from Apple. You can run it for free on the iPhone Simulator included with Xcode, or install it on your iOS device, but the latter requires you to register and pay (USD$99/year) to be an Apple iOS Developer.

To go along with the new release, OWASP iGoat has also announced their new lead developer, Jonathan Carter. Along with the new lead developer, the prospect of new iGoat lessons is eminent. Volunteers are always encouraged to develop their own lessons and donate them to the iGoat Project.

The newest version of iGoat can be found here: https://code.google.com/p/owasp-igoat/wiki/NewDownloads?tm=2 and information about creating an iGoat lesson can be found here:https://code.google.com/p/owasp-igoat/w/list.


Thursday, April 10, 2014

OWASP.next

 
As Chairman of the OWASP global board I’ve strove to bring a scalable structure to OWASP that allows us to continue growing and tackling application security. Over the past 3 years we’ve dramatically increased participation around the world, increased our funding which allows greater opportunities, built a full-time operations team to support our events and appointed an executive director for the foundation. Behind the scenes we’ve also focused heavily on maturing OWASP’s entity for legal and tax compliance, established annual budgeting and tracking, and created annual goals for the foundation that impacts operational focus and growth. All of these efforts setup OWASP to continue rapid growth around the world.

Today we have over 42,000 participants around the world who collaborate with OWASP through local chapter meetings (we have over 200 chapters in over 100 countries), events, projects, free trainings and more. OWASP was even recognized with an SC Magazine editor’s choice award this year.

All of these efforts are the result of the hard work and dedication of our community, operations team and all volunteers. As chairman I’ve tried to build systems and relationships to foster our open community and allow it to grow to meet these challenges. 


.next

Now it’s time for OWASP to make another turn. The need and importance for application security could never be greater. Every week there is a new breach announced impacting thousands of people. Every quarter we hear about a devastating flaw that has widespread security ramifications. OWASP needs to stand up to the challenge of tackling application security.

To rise to the growing challenges we face OWASP must shift course and focus on what makes us successful. 


(1) OWASP is a group of doers 

We must reward and recognize those that see a problem and tackle it.  A list of to-do’s is interesting, but we can all talk about what we want to accomplish. The real power is a list of “have-dones” or more specifically, a list of items we have accomplished. Two quotes I’ve recently heard capture this well: “ideas are cheap, implementation is what matters” and "You know what's easy? Yelling on the internet. You know what's hard? Working with people to build things that last." -Christie Koehler

We all must identify the doers and reward them. Also, the correct response to someone suggesting “hey, why don’t you do x?” Is to say “great idea, please come and help us get that started” or, of course, you could hear that idea, be the doer, and add yet another item to your competed-items list. 


(2) OWASP must take the fight to the enemy

Sitting on a hill and watching a battle does not make you a victor. We must take the fight to the enemy. The application security enemy has many faces: lack of security knowledge or tools to enable fast and secure development, insufficient tools and techniques to defend against attackers, and also popular libraries and frameworks with lingering vulnerabilities that cripple trust in the Internet when they are uncovered.

Over the next weeks I will personally be reaching out to groups developing critical elements of the web to offer our assistance in securing their open source products. In addition I’ll be working directly with different industry verticals so OWASP can integrate into their communities and bring security to medical, manufacturing, critical infrastructure and more. This is not a one-person effort – we’ll figure out how OWASP can foster effective relationships that scale and last in this area. 


(3) The OWASP community is our driving force 

The power of OWASP is in our diverse and talented community that brings together a wealth of skills and expertise. We must break down any walls that prevent participation. We need discussion methods that can support thousands of active contributors. Our community should be so easy to engage that an individual who attends their first OWASP chapter meeting in can go home and join our online discussion area to engage in projects, the wiki, and interact with our amazing community.

Further, our community must be inclusive and supportive. We must recognize that there are different approaches and seek to first understand before judging. We must seek to help those that are struggling and recognize that the ends don’t necessarily justify the means. There are many approaches to tackling a problem and the way we choose to interact with others reflects on our leadership and the value we bring to the OWASP community.

(4) OWASP must put our best foot forward and also be able to experiment, fail quickly, learn and try again


OWASP supports experimentation and research - we always have and always will. Just like a research group or a nimble company, we must be prepared to experiment, fail quickly, learn and try a new approach. Those that do so should be celebrated even if they are in the stages of experimenting, failing and repeating.

However, companies and professionals around the world also look to OWASP for solid guidance on application security. We must ensure that we identify our ideas, projects, and tools that are top notch and ready to be used by others. These ideas will have stood the test of time and have been carefully analyzed by our community. These premier or flagship projects must be well polished, maintained and a serve a true testament that the OWASP community can be proud of.

We may not be in that position today, but I believe by leveraging the combined power of our community and effectively using our available resources we can quickly move into this scenario.


Getting to OWASP.next

OWASP is bigger than you or me, a single project or voice - OWASP represents the vision of a future where applications can provide amazing services and features to the world while also being secure. This security extends to protect the application's users, data, critical components for application functionality and more. It is time for OWASP to ask how we can grow to meet these challenges, build the next 100,000 contributors to OWASP and scale our efforts to meet the obstacles before us.

You’ll see more material coming over the weeks to support the above items. I encourage all of you to ask and discuss how we can make OWASP the organization that is needed to tackle the growing threats to application security.




--

Michael Coates
Chairman & Fellow OWASP'er
@_mwc



OWASP ZAP 2.3.0











OWASP ZAP 2.3.0 is now available : http://code.google.com/p/zaproxy/wiki/Downloads?tm=2

There are a large number of changes in this release, so this post will just give a high level overview of some of the most significant changes:

ZAP ‘lite’ version

For this release we are providing a ‘lite’ version of ZAP in addition to the ‘full’ version. This contains exactly the same core code, but it just includes fewer default add-ons. Of course, you can download all of the ‘missing’ add-ons from the ZAP marketplace to ‘upgrade’ the lite version to a full one.

The ‘lite’ version is aimed at people new to security who need less initial functionality which will hopefully be easier to get started with. It will also be suitable for people looking for a smaller download or those wishing to customize exactly which add-ons they install.

Support for client-side (browser) events

You can now view, intercept, manipulate, resend and fuzz client-side events. This includes postMessages, so you can now detect DOM based XSS vulnerabilities in postMessages. This is the first phase in a series of planned changes to support the testing of AJAX and HTML5 applications even more effectively.

Enhanced authentication support

ZAP's support for authentication has been completely revamped to easily handle complex types of authentication methods and scenarios. Support has also been added for user-defined scripts which allow you to handle custom authentication schemes. In addition, now ZAP understands and allows you to configure web applications' Users so various actions throughout ZAP can be performed from the point of view of defined users. To get started, check out the new Authentication and Users panels in the Session Properties for each of the defined Contexts.

Support for non standard apps

This release includes support for ‘single page’ applications and non standard key-value separators. You can now control these settings via the new Structure panel in the Session Properties.

New Input Vectors including user-defined scripts

ZAP supports new options for defining the input vectors i.e. the elements of a request that ZAP will attack. The new options are available in the Active Scan Input Vectors panel of the Options. Support has also been added for defining custom scripts that define new input vectors.

Scan policy - fine grained control

The scan policy now has a fine grained control, allowing you to tweak individual scanner rules. You can also define, load and save scan policies, allowing you to maintain a set of policies that work well in different circumstances.

In addition, by default ZAP will not now scan well-known service parameters (e.g. __VIEWSTATE) speeding up the overall scanning process. This is completely user configurable, allowing you to specify exactly which parameters ZAP should ignore.

Advanced Active Scan dialog

A new 'Advanced Active Scan' dialog allows you to specify exactly how you want the active scanner to function. It allows you to specify‘custom vectors’ that explicitly define which strings you want to attack. It also supports the option to scan as any of the Users you have defined for the application under test. Start an Advanced Active Scan via the Tools menu or via the Attack section of the right click popup menu.

Extended command line options

You can now run ZAP ‘inline’ i.e. without starting the ZAP UI or a daemon. In this mode you can run simple attacks or run scripts which can access all of the ZAP functionality. You can also now override any of the options defined in the configuration file via command line parameters.

More API support

The API has been extended to support even more of the ZAP functionality.

Internationalized help file

The help file has been internationalized and is in the process of being translated into many other languages viahttps://crowdin.net/project/owasp-zap-help. If you use ZAP in one of the many languages we support, then the help files will include all of the available translations for that language while defaulting back to English for phrases that have not yet been translated.

Languages with a significant amount of translated help pages include:
  • Bosnian
  • French
  • Japanese
  • Spanish

Keyboard shortcuts

All menu items can now be invoked via keyboard shortcuts. Defaults are defined for virtually all cases, but you can configure your own preferences in the Keyboard panel of the Options.

New UI options

There is a new option to change the display so that the selected tab takes up the full screen. This is useful when using ZAP on small screens. There is also an option to toggle the visibility of the tab names on an off to further conserve space.
Most of the UI lists have also been converted to tables, which allow you to change column widths and define exactly which columns are displayed, and how the tables are sorted.

More functionality moved to add-ons

More of the core functionality has been moved into add-ons which allows us to deliver updates dynamically via the ZAP Marketplace rather than requiring new full releases.
This includes the language packs, so translations made to the ZAP UI via https://crowdin.net/project/owasp-zap can be downloaded within ZAP or even automatically installed.

New and improved active and passive scanning rules

Many of the release quality active and passive scanning rules have been improved. There are new alpha and beta quality rules and many rules have been promoted from alpha to beta and from beta to release quality.

Other miscellaneous changes and additions

  • A new option to stop individual scan rules without stopping the whole scan
  • A new toolbar button that allows you to quickly and easily record Zest scripts.
  • A new group for sharing ZAP scripts (http://groups.google.com/group/zaproxy-scripts) has been created.
  • The ability to spider applications based on source control metadata (SVN and Git) exposed via a web server
  • The ability to force breaks from within Proxy scripts

To keep up to date with ZAP related news follow @zaproxy on twitter.

Wednesday, April 9, 2014

Open Source Showcase Project Demo Opportunity at AppSec EU 2014!

AppSec EU 2014 is just a few months off, and OWASP is looking for projects to participate in the Open Source Showcase. The Open Source Showcase is a unique event module that allows project leaders and/or project contributors to showcase their work in a demo setting and gain exposure for their projects. The Showcase affords a more personal view of projects between attendees and Leaders.

The guidelines for submitting to the Open Source Showcase are simple: the Open Source Showcase is open to ANY project - not just OWASP projects. The only requirement for submission is that the project must be licensed under an approved Open Source License. All open source projects are encouraged to apply to take part in the Open Source Showcase at AppSec EU 2014 in Cambridge, UK. If you are interested, please apply using our application form. If you require more information, please contact Samantha Groves (Samantha.Groves@owasp.org). The application form can be found here: http://goo.gl/8iIUNw.

See you in Cambridge!