OWASP iGoat Tool Project - Restart

OWASP iGoat Tool Project

Project Leader: Swaroop Yermalkar (@swaroopsy)

Github Link

iGoat Mailing List

iGoat is a learning tool for iOS developers (iPhone, iPad, etc.) and mobile app pentesters. It was inspired by the WebGoat project, and has a similar conceptual flow to it. As such, iGoat is a safe environment where iOS developers can learn about the major security pitfalls they face as well as how to avoid them. It is made up of a series of lessons that each teach a single (but vital) security lesson.

The lessons are laid out in the following steps:

1. Brief introduction to the problem.
2. Verify the problem by exploiting it.
3. Brief description of available remediations to the problem.
4. Fix the problem by correcting and rebuilding the iGoat program.

*Step 4 is optional, but highly recommended for all iOS developers. Assistance is available within iGoat if you don't know how to fix a specific problem.

iGoat Version 3.0 Release

1. Updated SQLCipher to latest version
2. Removed project specific compilation warnings
3. Removed crashing code for server side exercises.
4. Updated project details in project github page.
5. Added multiple exercises including:
• Broken Cryptography
• Insecure Storage in Plist
• Insecure Storage in NSUserDefaults
• Side Channel Data Leaks via Device Logs
• Cross Site Scripting

Requirements:

To build and run iGoat, you'll need a Mac running OS X (real or virtual machine), with XCode installed. Best thing about iGoat is you can run it on iOS Simulator and also on iPhone / iPad / iPod.

Call for contributors:

We invite the OWASP community to download and try iGoat, and we welcome your suggestions for improvements. We're always looking for willing participants to contribute to the project as well! To contribute to iGoat project, please contact Swaroop (swaroop.yermalkar@owasp.org or @swaroopsy )

How to contribute?

• You can add new exercises (Oauth Attacks, Crypto Attacks, Third Party Library Issues etc)
• Testing iGoat on iPhone, iPad and checking if any issues
• Remove compilation warnings
• Suggest us new attacks
• Writing blogs / article about iGoat
• Spreading iGoat :)

Screenshots:

1. Broken Cryptography

In this exercise, you're going to identify insecure mechanism for storing sensitive data locally. You will observe encryption key hard coded in code using which you can decrypt sensitive data into plain text. For more information, Refer: (https://www.owasp.org/index.php/Mobile_Top_10_2014-M6)

Please provide feedback to Swaroop Yermalker or use the contact us form.

     

OWASP Project Review December 2016

OWASP is excited to announce that the following OWASP Projects have been submitted for review to graduate to the next level. All projects undergo evaluation to graduate from Incubator to Lab to Flagship status. Project reviews are done by request or flagged during each project's annual health check. The evaluation is based on defined criteria which attempt to gauge the project's quality, health (activeness), and stage within our incubator to lab to flagship continuum.

The review consists of an initial assessment done by the project leader and reviewed by Matt Tesauro which is then passed on to the volunteers in our OWASP Project Leaders for a peer review to finalize the results. Please follow the links for each review and fill out a feedback form for each of the OWASP Projects by December 26th.

We are looking for your feedback and look forward to your comments. You can find more information on Project Reviews here.

Incubator to Lab Status Project Review Report

Project Name: OWASP Security Knowledge Framework

Project Leader:  Glenn ten Cate

Project Web Page: https://www.owasp.org/index.php/OWASP_Security_Knowledge_Framework

Github: https://github.com/blabla1337/skf-flask

Please provide feedback here.

Lab to Flagship Status Project Review Report

Lab to Flagship Status

Project Name: OWASP Security Shepherd

Project Leader:  Mark Denihan

Github Link: https://github.com/OWASP/SecurityShepherd

Project Web Page:  https://www.owasp.org/index.php/OWASP_Security_Shepherd

Please provide feedback here

Incubator to Lab Status Project Review Report

Project Name: OWASP Seraphimdroid

Project Leaders: Nikola Milosevic, Kartik Kholi

OWASP Project Wiki Page: https://www.owasp.org/index.php/OWASP_SeraphimDroid_Project

Github URL: https://github.com/nikolamilosevic86/owasp-seraphimdroid

Please provide feedback here.

Incubator to Lab Status Project Review Report

Project Name: OWASP Security Logging Project

Project Leader:  Sytze van Koningsveld

Github page: https://github.com/javabeanz/owasp-security-logging

Project Web Page:  https://www.owasp.org/index.php/OWASP_Security_Logging_Project

Please provide feedback here.

If you have any questions please use our contact us form.