Tuesday, April 22, 2014
Thursday, April 17, 2014
OWASP is the foremost web application security non-profit organization in the world, with thousands of members globally, including some of the biggest names in the industry. The mission of OWASP is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks. All OWASP materials are free and open under an open source software license.
The UK Cambridge chapter invites you to join top security architects, developers, technology thought leaders, and executives from Fortune 500 firms to the OWASP AppSec Europe global conference taking place in Cambridge, UK from June 23-26, 2014. This conference is an opportunity to hear about the latest research on a myriad of topics related to web security, as well as establish connections between developers, security experts, and business leaders who are all stakeholders in ensuring applications are as secure as possible.
As part of AppSec EU, the conference organizers are looking for projects to participate in the Open Source Showcase. The Open Source Showcase is a unique event module that allows project leaders and/or project contributors to showcase their work in a demo setting and gain exposure for their projects without the need to conduct a full talk session. The showcase allows a more personal view of the project between attendees.
The guidelines for submitting to the Open Source Showcase are simple: the Open Source Showcase is open to ANY project - not just OWASP projects. The only requirement for submission is that the project must be licensed under an approved Open Source License.
All open source projects are encouraged to apply to take part in the Open Source Showcase at AppSec EU 2014 in Cambridge, UK. The application form can be found here: Submission Form.
If you have additional questions, please contact the AppSec EU 2014 Planning Team (firstname.lastname@example.org).
Wednesday, April 16, 2014
As some of you may know, OWASP has recently hired a very talented graphic design contractor, Hugo Costa, to help our community with their design related needs. As there are many different marketing pieces Hugo is able to develop, the Ops Team went ahead and put together a Design Menu of services to better outline the types of options our community can choose from.
The prices listed next to each item are the cost associated for the development of each piece. OWASP is encouraging projects, chapters, and outreach volunteers to use their funds to cover the cost of the designer’s time for development of each menu item. If your project or chapter does not have funds, then please let us know and we will attempt to find you resources for your design needs.
The price includes 3 rough sketches of the menu item, and 5 changes/edits to the chosen design. Then we will charge by the hour for additional changes. The current hourly rate is $15 USD/Hour. Please note that OWASP is not making any profit on the below prices or hourly rate, and passing along the rate and billing directly from the designer.
There are a good range of services that we are able to provide so we recommend having a read, and letting the staff know if you have questions about anything on the design menu. We are more than happy to help you with any design related question. Please submit your request or question via the Contact Us Form.
Tuesday, April 15, 2014
Some big news coming out of the OWASP iGoat Project! First, the OWASP iGoat Project has just released version 2.1, with the new release providing support for iOS 7.1. The newest features with the 2.1 version are:
- The overall look and feel has been updated to comply with iOS 7.x requirements, with the default target now being iOS 7.1, although 7.0 and 7.x should work too.
- The latest version of OpenSSL for building SQLcipher in the Local Data Storage lesson.
- Several NSInterger fields have been updated so they work properly on 64- and 32-bit builds.
- Updates to a couple of deprecated methods to the new 7.x replacement.
OWASP iGoat app continues to only be distributed as a self-contained Xcode project in source code. To run iGoat, you will need Xcode, which is free from Apple. You can run it for free on the iPhone Simulator included with Xcode, or install it on your iOS device, but the latter requires you to register and pay (USD$99/year) to be an Apple iOS Developer.
To go along with the new release, OWASP iGoat has also announced their new lead developer, Jonathan Carter. Along with the new lead developer, the prospect of new iGoat lessons is eminent. Volunteers are always encouraged to develop their own lessons and donate them to the iGoat Project.
The newest version of iGoat can be found here: https://code.google.com/p/owasp-igoat/wiki/NewDownloads?tm=2 and information about creating an iGoat lesson can be found here:https://code.google.com/p/owasp-igoat/w/list.
Thursday, April 10, 2014
As Chairman of the OWASP global board I’ve strove to bring a scalable structure to OWASP that allows us to continue growing and tackling application security. Over the past 3 years we’ve dramatically increased participation around the world, increased our funding which allows greater opportunities, built a full-time operations team to support our events and appointed an executive director for the foundation. Behind the scenes we’ve also focused heavily on maturing OWASP’s entity for legal and tax compliance, established annual budgeting and tracking, and created annual goals for the foundation that impacts operational focus and growth. All of these efforts setup OWASP to continue rapid growth around the world.
Today we have over 42,000 participants around the world who collaborate with OWASP through local chapter meetings (we have over 200 chapters in over 100 countries), events, projects, free trainings and more. OWASP was even recognized with an SC Magazine editor’s choice award this year.
All of these efforts are the result of the hard work and dedication of our community, operations team and all volunteers. As chairman I’ve tried to build systems and relationships to foster our open community and allow it to grow to meet these challenges.
Now it’s time for OWASP to make another turn. The need and importance for application security could never be greater. Every week there is a new breach announced impacting thousands of people. Every quarter we hear about a devastating flaw that has widespread security ramifications. OWASP needs to stand up to the challenge of tackling application security.
To rise to the growing challenges we face OWASP must shift course and focus on what makes us successful.
(1) OWASP is a group of doers
We must reward and recognize those that see a problem and tackle it. A list of to-do’s is interesting, but we can all talk about what we want to accomplish. The real power is a list of “have-dones” or more specifically, a list of items we have accomplished. Two quotes I’ve recently heard capture this well: “ideas are cheap, implementation is what matters” and "You know what's easy? Yelling on the internet. You know what's hard? Working with people to build things that last." -Christie Koehler
We all must identify the doers and reward them. Also, the correct response to someone suggesting “hey, why don’t you do x?” Is to say “great idea, please come and help us get that started” or, of course, you could hear that idea, be the doer, and add yet another item to your competed-items list.
(2) OWASP must take the fight to the enemy
Sitting on a hill and watching a battle does not make you a victor. We must take the fight to the enemy. The application security enemy has many faces: lack of security knowledge or tools to enable fast and secure development, insufficient tools and techniques to defend against attackers, and also popular libraries and frameworks with lingering vulnerabilities that cripple trust in the Internet when they are uncovered.
Over the next weeks I will personally be reaching out to groups developing critical elements of the web to offer our assistance in securing their open source products. In addition I’ll be working directly with different industry verticals so OWASP can integrate into their communities and bring security to medical, manufacturing, critical infrastructure and more. This is not a one-person effort – we’ll figure out how OWASP can foster effective relationships that scale and last in this area.
(3) The OWASP community is our driving force
The power of OWASP is in our diverse and talented community that brings together a wealth of skills and expertise. We must break down any walls that prevent participation. We need discussion methods that can support thousands of active contributors. Our community should be so easy to engage that an individual who attends their first OWASP chapter meeting in can go home and join our online discussion area to engage in projects, the wiki, and interact with our amazing community.
Further, our community must be inclusive and supportive. We must recognize that there are different approaches and seek to first understand before judging. We must seek to help those that are struggling and recognize that the ends don’t necessarily justify the means. There are many approaches to tackling a problem and the way we choose to interact with others reflects on our leadership and the value we bring to the OWASP community.
(4) OWASP must put our best foot forward and also be able to experiment, fail quickly, learn and try again
OWASP supports experimentation and research - we always have and always will. Just like a research group or a nimble company, we must be prepared to experiment, fail quickly, learn and try a new approach. Those that do so should be celebrated even if they are in the stages of experimenting, failing and repeating.
However, companies and professionals around the world also look to OWASP for solid guidance on application security. We must ensure that we identify our ideas, projects, and tools that are top notch and ready to be used by others. These ideas will have stood the test of time and have been carefully analyzed by our community. These premier or flagship projects must be well polished, maintained and a serve a true testament that the OWASP community can be proud of.
We may not be in that position today, but I believe by leveraging the combined power of our community and effectively using our available resources we can quickly move into this scenario.
Getting to OWASP.next
OWASP is bigger than you or me, a single project or voice - OWASP represents the vision of a future where applications can provide amazing services and features to the world while also being secure. This security extends to protect the application's users, data, critical components for application functionality and more. It is time for OWASP to ask how we can grow to meet these challenges, build the next 100,000 contributors to OWASP and scale our efforts to meet the obstacles before us.
You’ll see more material coming over the weeks to support the above items. I encourage all of you to ask and discuss how we can make OWASP the organization that is needed to tackle the growing threats to application security.
Chairman & Fellow OWASP'er
Posted by Michael Coates at 11:27 AM
OWASP ZAP 2.3.0 is now available : http://code.google.com/p/zaproxy/wiki/Downloads?tm=2
There are a large number of changes in this release, so this post will just give a high level overview of some of the most significant changes:
ZAP ‘lite’ version
For this release we are providing a ‘lite’ version of ZAP in addition to the ‘full’ version. This contains exactly the same core code, but it just includes fewer default add-ons. Of course, you can download all of the ‘missing’ add-ons from the ZAP marketplace to ‘upgrade’ the lite version to a full one.
The ‘lite’ version is aimed at people new to security who need less initial functionality which will hopefully be easier to get started with. It will also be suitable for people looking for a smaller download or those wishing to customize exactly which add-ons they install.
Support for client-side (browser) events
You can now view, intercept, manipulate, resend and fuzz client-side events. This includes postMessages, so you can now detect DOM based XSS vulnerabilities in postMessages. This is the first phase in a series of planned changes to support the testing of AJAX and HTML5 applications even more effectively.
Enhanced authentication support
ZAP's support for authentication has been completely revamped to easily handle complex types of authentication methods and scenarios. Support has also been added for user-defined scripts which allow you to handle custom authentication schemes. In addition, now ZAP understands and allows you to configure web applications' Users so various actions throughout ZAP can be performed from the point of view of defined users. To get started, check out the new Authentication and Users panels in the Session Properties for each of the defined Contexts.
Support for non standard apps
This release includes support for ‘single page’ applications and non standard key-value separators. You can now control these settings via the new Structure panel in the Session Properties.
New Input Vectors including user-defined scripts
ZAP supports new options for defining the input vectors i.e. the elements of a request that ZAP will attack. The new options are available in the Active Scan Input Vectors panel of the Options. Support has also been added for defining custom scripts that define new input vectors.
Scan policy - fine grained control
The scan policy now has a fine grained control, allowing you to tweak individual scanner rules. You can also define, load and save scan policies, allowing you to maintain a set of policies that work well in different circumstances.
In addition, by default ZAP will not now scan well-known service parameters (e.g. __VIEWSTATE) speeding up the overall scanning process. This is completely user configurable, allowing you to specify exactly which parameters ZAP should ignore.
Advanced Active Scan dialog
A new 'Advanced Active Scan' dialog allows you to specify exactly how you want the active scanner to function. It allows you to specify‘custom vectors’ that explicitly define which strings you want to attack. It also supports the option to scan as any of the Users you have defined for the application under test. Start an Advanced Active Scan via the Tools menu or via the Attack section of the right click popup menu.
Extended command line options
You can now run ZAP ‘inline’ i.e. without starting the ZAP UI or a daemon. In this mode you can run simple attacks or run scripts which can access all of the ZAP functionality. You can also now override any of the options defined in the configuration file via command line parameters.
More API support
The API has been extended to support even more of the ZAP functionality.
Internationalized help file
The help file has been internationalized and is in the process of being translated into many other languages viahttps://crowdin.net/project/owasp-zap-help. If you use ZAP in one of the many languages we support, then the help files will include all of the available translations for that language while defaulting back to English for phrases that have not yet been translated.
Languages with a significant amount of translated help pages include:
All menu items can now be invoked via keyboard shortcuts. Defaults are defined for virtually all cases, but you can configure your own preferences in the Keyboard panel of the Options.
New UI options
There is a new option to change the display so that the selected tab takes up the full screen. This is useful when using ZAP on small screens. There is also an option to toggle the visibility of the tab names on an off to further conserve space.
Most of the UI lists have also been converted to tables, which allow you to change column widths and define exactly which columns are displayed, and how the tables are sorted.
More functionality moved to add-ons
More of the core functionality has been moved into add-ons which allows us to deliver updates dynamically via the ZAP Marketplace rather than requiring new full releases.
This includes the language packs, so translations made to the ZAP UI via https://crowdin.net/project/owasp-zap can be downloaded within ZAP or even automatically installed.
New and improved active and passive scanning rules
Many of the release quality active and passive scanning rules have been improved. There are new alpha and beta quality rules and many rules have been promoted from alpha to beta and from beta to release quality.
Other miscellaneous changes and additions
- A new option to stop individual scan rules without stopping the whole scan
- A new toolbar button that allows you to quickly and easily record Zest scripts.
- A new group for sharing ZAP scripts (http://groups.google.com/group/zaproxy-scripts) has been created.
- The ability to spider applications based on source control metadata (SVN and Git) exposed via a web server
- The ability to force breaks from within Proxy scripts
To keep up to date with ZAP related news follow @zaproxy on twitter.
Wednesday, April 9, 2014
AppSec EU 2014 is just a few months off, and OWASP is looking for projects to participate in the Open Source Showcase. The Open Source Showcase is a unique event module that allows project leaders and/or project contributors to showcase their work in a demo setting and gain exposure for their projects. The Showcase affords a more personal view of projects between attendees and Leaders.
The guidelines for submitting to the Open Source Showcase are simple: the Open Source Showcase is open to ANY project - not just OWASP projects. The only requirement for submission is that the project must be licensed under an approved Open Source License. All open source projects are encouraged to apply to take part in the Open Source Showcase at AppSec EU 2014 in Cambridge, UK. If you are interested, please apply using our application form. If you require more information, please contact Samantha Groves (Samantha.Groves@owasp.org). The application form can be found here: http://goo.gl/8iIUNw.
See you in Cambridge!