GSoC2019 Ideas

=OWASP Project Requests=

Tips to get you started in no particular order: * Read Google Summer of Code Program(GSOC)` * Read the GSoC SAT  * Read the GSOC Student Guidelines * Contact us through the mailing list or irc channel. * Check our github organization

OWASP-SKF (draft)
Idea 1:

Build lab examples and write-ups (how to test) for different vulnerabilities over different technology stacks. These challenges are to be delivered in Docker so they can be

easily deployed.

In the current situation the security knowledge framework ultimately presents a list of security controls with correlating knowledge base items that contain a description and

a solution. The new labs are used to give the software developers or application security specialists a more in depth understanding and approach on how to test the

vulnerabilities in their own code. The images that are pushed to the Github repository are already automatically build and pushed to a docker registry where the SKF users can easily pull the images from to get their
 * For example we have now around 20 lab challenges in Docker container build in Python:
 * A Local File Inclusion Docker app example:
 * https://github.com/blabla1337/skf-labs/tree/master/LFI
 * A write-up example:
 * https://owasp-skf.gitbook.io/asvs-write-ups/filename-injection

labs running. Of course they can download it and build it themselves from source by pulling the original repository.

Idea 2:

We want to extend the Machine learning chatbot functionality in SKF.
 * Create a desktop version of the chatbot. Where people can install the setup file on their local machine.
 * Extend the bots capability to do the google search(using web scraping) for the things which are not available in the database. So, it will have a wider scope of knowledge.
 * Extend the bot capability to reply what security controls should be followed from the ASVS and MASVS or other custom checklists that are present in SKF.
 * Extend the bot to different platforms like Facebook, telegram, slack etc.
 * Now the working chatbot implementation for example is only for Gitter

OWASP DefectDojo
OWASP DefectDojo is a popular open source vulnerability management tool, used as the backbone for security programs. It is easy to get started with and work on! We welcome volunteers of all experience levels and are happy to provide mentorship.

Option 1: Unit Tests - Difficulty: Easy Option 2: Feature Enhancement - Difficulty: Varies Option 3: Pull Request Review - Difficulty: Moderate - Hard
 * If you're new to programming, unit tests are short scripts designed to test a specific function of an application.
 * The project needs additional unit tests to ensure that new code functions properly.
 * The functionality of DefectDojo is constantly expanding.
 * Feature enhancements offer programming challenges for all levels of experience.
 * Test pull requests and provide feedback on code.

OHP (OWASP Honeypot)
OWASP Honeypot is an open source software in Python language which designed for creating honeypot and honeynet in an easy and secure way! This project is compatible with Python 2.x and 3.x and tested on Windows, Mac OS X and Linux.

Getting Start
It's best to start from GitHub wiki page, we are looking forward to add more modules and optimize the core.

Technologies
Currently we are using


 * Docker
 * Python
 * MongoDB
 * TShark
 * Flask
 * ChartJS
 * And more linux services

Expected Results
...

Roadmap
...

Students Requirements

 * Python
 * Packet Analysis
 * Docker
 * Database

Mentors and Leaders

 * [mailto:ali.razmjoo@owasp.org Ali Razmjoo] (Mentor & Project Leader)
 * [mailto:ehsan@nezami.me Ehsan Nezami] (Mentor)
 * [mailto:reza.espargham@owasp.org Reza Espargham](Mentor)
 * [mailto:abiusx@owasp.org Abbas Naderi] (Mentor)

OWASP Juice Shop
OWASP Juice Shop Project is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and Angular. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a "guinea pig"-application to check how well their tools cope with Javascript-heavy application frontends and REST APIs. The best way to get in touch with us is the community chat on https://gitter.im/bkimminich/juice-shop . You can also send PMs to the potential mentors (@bkimminich, @wurstbrot and @J12934) there if you like!

To receive early feedback please put your proposal on Google Docs and submit it to the OWASP Organization on Google's GSoC page in Draft Shared mode. Please pick juice shop as Proposal Tag to make them easier to find for us. Thank you!

Challenge Pack 2019
Brief Explanation:

Ideas for potential new hacking challenges are collected in GitHub issues labeled "challenge". This project could implement a whole bunch of challenges one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with additional ideas for challenges would be part of the project scope, as the list of pre-existing ideas might not be sufficient for a GSoC project.

Expected Results:
 * 10 or more new challenges for OWASP Juice Shop (including required functional enhancements to place the challenges)
 * Each challenge comes with full functional unit and integration tests
 * Each challenge is verified to be exploitable by corresponding end-to-end tests
 * Hint and solution sections for each new challenge are added to the "Pwning OWASP Juice Shop" ebook
 * Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

 Getting started: 
 * Get familiar with the architecture and code base of the application's rich Javascript frontend and RESTful backend
 * Get a feeling for the high code & test quality bar by inspecting the existing test suites and static code analysis results
 * Get familiar with the CI/CD process based on Travis-CI and several associated 3rd party services

Knowledge Prerequisites:
 * Javascript, Unit/Integration testing, experience with (or willingness to learn) Angular and NodeJS/Express, some security knowledge would be preferable.

Mentors:
 * Bjoern Kimminich - OWASP Juice Shop Project Leader
 * Timo Pagel - OWASP Juice Shop Project Collaborator
 * Jannik Hollenbach - OWASP Juice Shop Project Collaborator

Hacking Instructor
Brief Explanation:

TODO

Expected Results:

TODO

 Getting started: 

TODO

Knowledge Prerequisites:

TODO

Mentors:
 * Bjoern Kimminich - OWASP Juice Shop Project Leader

Your idea
Brief Explanation:

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

 Getting started 
 * Get in touch with Bjoern Kimminich

Expected Results:
 * A new feature that makes OWASP Juice Shop even better
 * Code follows existing styleguides and passes all existing quality gates regarding code smells, test coverage etc.

Knowledge Prerequisites:
 * Javascript, Unit/Integration testing, experience with (or willingness to learn) Angular and NodeJS/Express, some security knowledge would be preferable.

Mentors:
 * Bjoern Kimminich - OWASP Juice Shop Project Leader

OWASP-Securetea Tools Project (draft)
The purpose of this application is to warn the user (via various communication mechanisms) whenever their laptop accessed. This small application was developed and tested in python in Linux machine is likely to work well on the Raspberry Pi as well. - https://github.com/OWASP/SecureTea-Project/blob/master/README.md

Ideas 1 : Notify by Twitter (done) Securetea Dashboard / Gui (done)

Expect result : Securetea Protection /firewall Securetea Antivirus Notify by Whatsapp Notify by SMS Alerts Notify by Line Notify by Telegram

Mentors:

Ade Yoseman Putra Rejah Rehim