Category:OWASP Project

From OWASP

An OWASP project is a collection of related tasks that have a defined roadmap and team members. OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team.

If you would like to start a new project please review the How to Start an OWASP Project guide. Please send an email to owasp@owasp.org to discuss project ideas and how they might fit into OWASP. All OWASP projects must be free and open and have their homepage on the OWASP portal. You can read all the guidelines in the Project Assessment Criteria.

Every project has an associated mail list. You can view all the lists, examine their archives, and subscribe to any of them on the OWASP Project Mailing Lists page.

1 Release Quality Projects
2 Beta Status Projects
3 Alpha Status Projects
4 Season of Code Projects

Release Quality Projects

Release quality projects are generally the level of quality of professional tools or documents. You can review all the detailed guidelines in the Project Assessment Criteria.

Tools	Documentation
OWASP WebGoat Project an online training environment for hands-on learning about application security OWASP WebScarab Project a tool for performing all types of security testing on web applications and web services	OWASP AppSec FAQ Project FAQ covering many application security topics OWASP Guide Project a massive document covering all aspects of web application and web service security OWASP Legal Project a project focused on contracting for secure software OWASP Testing Guide a project focused on application security testing procedures and checklists OWASP Top Ten Project an awareness document that describes the top ten web application security vulnerabilities

Tools

Documentation

OWASP WebGoat Project: an online training environment for hands-on learning about application security

OWASP WebScarab Project: a tool for performing all types of security testing on web applications and web services

OWASP AppSec FAQ Project: FAQ covering many application security topics

OWASP Guide Project: a massive document covering all aspects of web application and web service security

OWASP Legal Project: a project focused on contracting for secure software

OWASP Testing Guide: a project focused on application security testing procedures and checklists

OWASP Top Ten Project: an awareness document that describes the top ten web application security vulnerabilities

Beta Status Projects

Beta quality projects are complete and ready to use with documentation. You can review all the detailed guidelines in the Project Assessment Criteria.

Tools	Documentation
OWASP AntiSamy Project an API for validating rich HTML/CSS input from users without exposure to cross-site scripting and phishing attacks OWASP CAL9000 Project a JavaScript based web application security testing suite OWASP CSRFGuard Project a J2EE filter that implements a unique request token to mitigate CSRF attacks OWASP DirBuster Project DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers. OWASP Encoding Project a project focused on the development of encoding best practices for web applications. OWASP Enterprise Security API (ESAPI) Project a free and open collection of all the security methods that a developer needs to build a secure web application. OWASP LAPSE Project an Eclipse-based source-code static analysis tool for Java OWASP Live CD Education Project an educational supplement project containing tutorials, challenges and videos detailing the use of tools contained within the OWASP LiveCD - LabRat. OWASP Live CD Project a CD containing ready to use versions of application security analysis and testing tools OWASP .NET Research a project focused on helping .NET developers build secure applications OWASP Pantera Web Assessment Studio Project a project focused on combining automated capabilities with complete manual testing to get the best results OWASP Report Generator a project giving security professionals a way to report and keep track of their projects OWASP Site Generator a project allowing users to create dynamic sites for use in training, web application scanner testing, etc... OWASP SQLiX Project a project focused on the development of SQLiX, a full perl-based SQL scanner OWASP Tiger OWASP Tiger is a Windows application originally intended to be used for automating the process of testing various known ASP.NET security issues in hosted environments. However, it is much more versatile than that: it can help you construct and send a HTTP requests, receive and analyze the responses, match them against a set of conditions to produce alerts, notifications that something is wrong with the application(s) or service(s) being tested. OWASP WeBekci Project OWASP WeBekci is a web based ModSecurity 2.x management tool. WeBekci is written in PHP, Its backend is powered by MySQL and the frontend by XAJAX framework. OWASP WSFuzzer Project a project focused on the development of WSFuzzer, a full python-based Web Services SOAP fuzzer	OWASP CLASP Project a project focused on defining process elements that reinforce application security OWASP Code Review Project a project to capture best practices for reviewing code OWASP Tools Project The OWASP Tools Project's goal is to provide unbiased, practical information and guidance about application security tools.

Tools

Documentation

OWASP AntiSamy Project: an API for validating rich HTML/CSS input from users without exposure to cross-site scripting and phishing attacks

OWASP CAL9000 Project: a JavaScript based web application security testing suite

OWASP CSRFGuard Project: a J2EE filter that implements a unique request token to mitigate CSRF attacks

OWASP DirBuster Project: DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers.

OWASP Encoding Project: a project focused on the development of encoding best practices for web applications.

OWASP Enterprise Security API (ESAPI) Project: a free and open collection of all the security methods that a developer needs to build a secure web application.

OWASP LAPSE Project: an Eclipse-based source-code static analysis tool for Java

OWASP Live CD Education Project: an educational supplement project containing tutorials, challenges and videos detailing the use of tools contained within the OWASP LiveCD - LabRat.

OWASP Live CD Project: a CD containing ready to use versions of application security analysis and testing tools

OWASP .NET Research: a project focused on helping .NET developers build secure applications

OWASP Pantera Web Assessment Studio Project: a project focused on combining automated capabilities with complete manual testing to get the best results

OWASP Report Generator: a project giving security professionals a way to report and keep track of their projects

OWASP Site Generator: a project allowing users to create dynamic sites for use in training, web application scanner testing, etc...

OWASP SQLiX Project: a project focused on the development of SQLiX, a full perl-based SQL scanner

OWASP Tiger: OWASP Tiger is a Windows application originally intended to be used for automating the process of testing various known ASP.NET security issues in hosted environments. However, it is much more versatile than that: it can help you construct and send a HTTP requests, receive and analyze the responses, match them against a set of conditions to produce alerts, notifications that something is wrong with the application(s) or service(s) being tested.

OWASP WeBekci Project: OWASP WeBekci is a web based ModSecurity 2.x management tool. WeBekci is written in PHP, Its backend is powered by MySQL and the frontend by XAJAX framework.

OWASP WSFuzzer Project: a project focused on the development of WSFuzzer, a full python-based Web Services SOAP fuzzer

OWASP CLASP Project: a project focused on defining process elements that reinforce application security

OWASP Code Review Project: a project to capture best practices for reviewing code

OWASP Tools Project: The OWASP Tools Project's goal is to provide unbiased, practical information and guidance about application security tools.

Alpha Status Projects

Alpha quality projects are generally usable but may lack documentation or quality review. You can review all the detailed guidelines in the Project Assessment Criteria.

Tools	Documentation
OWASP CSRFTester Project gives developers the ability to test their applications for CSRF flaws OWASP Insecure Web App Project a web application that includes common web application vulnerabilities OWASP Interceptor Project a testing tool for XML web service and Ajax interfaces OWASP JBroFuzz Project a fuzzer application, supporting a number of automated security checks including basic cross site scripting checks (XSS) as well as basic SQL injection testing. OWASP Orizon Project a project focused on the development of a flexible code review engine OWASP PHP AntiXSS Library Project reduce cross-site scripting vulnerabilities by encoding your output OWASP Sprajax Project an open source black box security scanner used to assess the security of AJAX-enabled applications OWASP Stinger Project a project focus on the development of a centralized input validation mechanism which can be easily applied to existing or developmental applications OWASP Web 2.0 Project A place for advanced research of security in the Web 2.0 world OWASP Internationalization Project General guidelines to start a new translation project for OWASP site and projects OWASP Spanish Project First translation effort to make OWASP site and project completely available in Spanish language	OWASP AIR Security Project investigating the security of AIR applications OWASP AJAX Security Guide investigating the security of AJAX enabled applications OWASP Application Security Assessment Standards Project establish a set of standards defining baseline approaches to conducting differing types/levels of application security assessment OWASP Application Security Requirements OWASP Application Security Metrics Project identify and provide a set of application security metrics that have been found by contributors to be effective in measuring application security OWASP AppSensor Project a framework for detecting and responding to attacks from within the application OWASP Career Development Project The OWASP Career Development project is focused on helping application security professionals understand the job market, roles, career paths, and skills to work in the field. OWASP Certification Criteria Project OWASP Certification Project our challenge is to create a plan for certification: a set of OWASP Certification for Developers and Testers. OWASP Communications Project OWASP Flash Security Project investigating the security of Flash applications OWASP Honeycomb Project a comprehensive and integrated guide to the fundamental building blocks of application security OWASP Java Project a project focused on helping Java and J2EE developers build secure applications OWASP Logging Guide a project to define best practices for logging and log management OWASP PHP Project a project focused on helping PHP developers build secure applications OWASP Scholastic Application Security Assessment Project a project that is intended to be the first step towards integrating security requirements in academic course curriculum OWASP Validation Project a project that provides guidance and tools related to validation OWASP WASS Guide a standards project to develop more concrete criteria for secure applications OWASP Web Application Security Put Into Practice real-world web application security for Ruby on Rails, Apache and MySQL OWASP XML Security Gateway Evaluation Criteria a project to define evaluation criteria for XML Security Gateways OWASP Education Project a project to build educational tracks and modules for different audiences OWASP on The Move Project a project to match offer and demand regarding OWASP (related) presentations by speakers on web application security events or chapter meetings. OWASP Fuzzing Code Database a project to collect, share and compose statements used as code injections like SQL, SSI, XSS, Formatstring and as well directory traversal statements.

Tools

Documentation

OWASP CSRFTester Project: gives developers the ability to test their applications for CSRF flaws

OWASP Insecure Web App Project: a web application that includes common web application vulnerabilities

OWASP Interceptor Project: a testing tool for XML web service and Ajax interfaces

OWASP JBroFuzz Project: a fuzzer application, supporting a number of automated security checks including basic cross site scripting checks (XSS) as well as basic SQL injection testing.

OWASP Orizon Project: a project focused on the development of a flexible code review engine

OWASP PHP AntiXSS Library Project: reduce cross-site scripting vulnerabilities by encoding your output

OWASP Sprajax Project: an open source black box security scanner used to assess the security of AJAX-enabled applications

OWASP Stinger Project: a project focus on the development of a centralized input validation mechanism which can be easily applied to existing or developmental applications

OWASP Web 2.0 Project: A place for advanced research of security in the Web 2.0 world

OWASP Internationalization Project: General guidelines to start a new translation project for OWASP site and projects

OWASP Spanish Project: First translation effort to make OWASP site and project completely available in Spanish language

OWASP AIR Security Project: investigating the security of AIR applications

OWASP AJAX Security Guide: investigating the security of AJAX enabled applications

OWASP Application Security Assessment Standards Project: establish a set of standards defining baseline approaches to conducting differing types/levels of application security assessment

OWASP Application Security Requirements

OWASP Application Security Metrics Project: identify and provide a set of application security metrics that have been found by contributors to be effective in measuring application security

OWASP AppSensor Project: a framework for detecting and responding to attacks from within the application

OWASP Career Development Project: The OWASP Career Development project is focused on helping application security professionals understand the job market, roles, career paths, and skills to work in the field.

OWASP Certification Criteria Project

OWASP Certification Project: our challenge is to create a plan for certification: a set of OWASP Certification for Developers and Testers.

OWASP Communications Project

OWASP Flash Security Project: investigating the security of Flash applications

OWASP Honeycomb Project: a comprehensive and integrated guide to the fundamental building blocks of application security

OWASP Java Project: a project focused on helping Java and J2EE developers build secure applications

OWASP Logging Guide: a project to define best practices for logging and log management

OWASP PHP Project: a project focused on helping PHP developers build secure applications

OWASP Scholastic Application Security Assessment Project: a project that is intended to be the first step towards integrating security requirements in academic course curriculum

OWASP Validation Project: a project that provides guidance and tools related to validation

OWASP WASS Guide: a standards project to develop more concrete criteria for secure applications

OWASP Web Application Security Put Into Practice: real-world web application security for Ruby on Rails, Apache and MySQL

OWASP XML Security Gateway Evaluation Criteria: a project to define evaluation criteria for XML Security Gateways

OWASP Education Project: a project to build educational tracks and modules for different audiences

OWASP on The Move Project: a project to match offer and demand regarding OWASP (related) presentations by speakers on web application security events or chapter meetings.

OWASP Fuzzing Code Database: a project to collect, share and compose statements used as code injections like SQL, SSI, XSS, Formatstring and as well directory traversal statements.

Season of Code Projects

The projects placed in this category were sponsored by OWASP within its Seasons of Code and are still being developed.

Tools	Documentation
OWASP Skavenger Project Skavenger is a web application security assessment toolkit. It passively analyzes traffic logged by various MITM proxies as well as other sources and helps to identify various kinds of possible vulnerabilities. Skavenger's modular design allows the integration of custom scanning modules without any knowledge about the tool at all. This project was sponsored by OWASP Summer of Code.

Tools

Documentation

OWASP Skavenger Project: Skavenger is a web application security assessment toolkit. It passively analyzes traffic logged by various MITM proxies as well as other sources and helps to identify various kinds of possible vulnerabilities. Skavenger's modular design allows the integration of custom scanning modules without any knowledge about the tool at all. This project was sponsored by OWASP Summer of Code.