Difference between revisions of "MRB Scratchpad"

From OWASP
Jump to: navigation, search
(Back to Conference Page)
(Back to Conference Page)
Line 9: Line 9:
 
{| cellspacing="0" border="2"
 
{| cellspacing="0" border="2"
 
|- valign="middle"
 
|- valign="middle"
| height="60" align="center" colspan="6" style="background: rgb(64, 88, 160) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | <font size="5">'''Traning Day 1 - Nov 8th 2010'''</font>
+
| height="60" align="center" colspan="8" style="background: rgb(64, 88, 160) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | <font size="5">'''Traning Day 1 - Nov 8th 2010'''</font>
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | &nbsp;  
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | &nbsp;  
Line 17: Line 17:
 
| width="150" valign="middle" height="40" bgcolor="#b3ff99" align="center" | '''Room TBD'''
 
| width="150" valign="middle" height="40" bgcolor="#b3ff99" align="center" | '''Room TBD'''
 
| width="150" valign="middle" height="40" bgcolor="#BCA57A" align="center" | '''Room TBD'''
 
| width="150" valign="middle" height="40" bgcolor="#BCA57A" align="center" | '''Room TBD'''
 +
| width="150" valign="middle" height="40" bgcolor="#c0a0a0" align="center" | '''Room TBD'''
 +
| width="150" valign="middle" height="40" bgcolor="#ffdf80" align="center" | '''Room TBD'''
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" bgcolor="#7b8abd" | 09:00-12:00  
 
| width="72" valign="middle" bgcolor="#7b8abd" | 09:00-12:00  
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Day 1:<br>Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Day 1:<br>[[Assessing and Exploiting Web Applications with Samurai-WTF]]Class<br>Justin Searle & Mike Poor
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Day 1:<br>Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Day 1:<br>[[Leading the AppSec Initative ]]<br>Dave Wichers
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Day 1:<br>[[Remote Testing for Common Web Application Security Threats]]<br>David Rhoades
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Day 1:<br>[[Software Security Best Practices]]<br>Ben Tomhave
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | [[WebAppSec.php: Developing Secure Web Applications]]<br>Robert Zakon
 +
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | [[The Art of Exploiting SQL Injections]] <br>Sumit Siddharth
 +
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | [[Practical Web Security Overview]]<br>Zoltán Hornák
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | 12:00-13:00  
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | 12:00-13:00  
| valign="middle" height="40" bgcolor="#909090" align="center" colspan="5" | Lunch
+
| valign="middle" height="40" bgcolor="#909090" align="center" colspan="7" | Lunch
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" bgcolor="#7b8abd" | 13:00-17:00  
 
| width="72" valign="middle" bgcolor="#7b8abd" | 13:00-17:00  
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Day 1:<br>[[Assessing and Exploiting Web Applications with Samurai-WTF]]Class<br>Justin Searle & Mike Poor
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Day 1:<br>[[Leading the AppSec Initative ]]<br>Dave Wichers
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Day 1:<br>[[Remote Testing for Common Web Application Security Threats]]<br>David Rhoades
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Day 1:<br>[[Software Security Best Practices]]<br>Ben Tomhave
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | [[WebAppSec.php: Developing Secure Web Applications]]<br>Robert Zakon
<!-- Training Day 2 -->
+
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | [[The Art of Exploiting SQL Injections]] <br>Sumit Siddharth
 +
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | [[Practical Web Security Overview]]<br>Zoltán Hornák
 +
<!-- Training Day 1 -->
 
|}
 
|}
 
====Training 11/09====  
 
====Training 11/09====  
{| cellspacing="0" border="2"  
+
{| cellspacing="0" border="2"
 
|- valign="middle"
 
|- valign="middle"
| height="60" align="center" colspan="6" style="background: rgb(64, 88, 160) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | <font size="5">'''Training Day 2 - Nov 9th 2010'''</font>
+
| height="60" align="center" colspan="8" style="background: rgb(64, 88, 160) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | <font size="5">'''Traning Day 1 - Nov 8th 2010'''</font>
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | &nbsp;  
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | &nbsp;  
Line 47: Line 53:
 
| width="150" valign="middle" height="40" bgcolor="#b3ff99" align="center" | '''Room TBD'''
 
| width="150" valign="middle" height="40" bgcolor="#b3ff99" align="center" | '''Room TBD'''
 
| width="150" valign="middle" height="40" bgcolor="#BCA57A" align="center" | '''Room TBD'''
 
| width="150" valign="middle" height="40" bgcolor="#BCA57A" align="center" | '''Room TBD'''
 +
| width="150" valign="middle" height="40" bgcolor="#c0a0a0" align="center" | '''Room TBD'''
 +
| width="150" valign="middle" height="40" bgcolor="#ffdf80" align="center" | '''Room TBD'''
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" bgcolor="#7b8abd" | 09:00-12:00  
 
| width="72" valign="middle" bgcolor="#7b8abd" | 09:00-12:00  
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Day 2:<br>Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Day 1:<br>[[Assessing and Exploiting Web Applications with Samurai-WTF]]Class<br>Justin Searle & Mike Poor
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Day 2:<br>Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Day 1:<br>[[Leading the AppSec Initative ]]<br>Dave Wichers
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Day 1:<br>[[Remote Testing for Common Web Application Security Threats]]<br>David Rhoades
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Day 1:<br>[[Software Security Best Practices]]<br>Ben Tomhave
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | [[Software Security Remediation: How to Fix Application Vulnerabilities ]]<br>Dan Cornell
 +
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | TBD <br>
 +
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | [[Java Security Overview ]]<br>Zoltán Hornák
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | 12:00-13:00  
 
| width="72" valign="middle" height="40" bgcolor="#7b8abd" | 12:00-13:00  
| valign="middle" height="40" bgcolor="#909090" align="center" colspan="5" | Lunch
+
| valign="middle" height="40" bgcolor="#909090" align="center" colspan="7" | Lunch
 
|- valign="bottom"
 
|- valign="bottom"
 
| width="72" valign="middle" bgcolor="#7b8abd" | 13:00-17:00  
 
| width="72" valign="middle" bgcolor="#7b8abd" | 13:00-17:00  
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | Day 1:<br>[[Assessing and Exploiting Web Applications with Samurai-WTF]]Class<br>Justin Searle & Mike Poor
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | Day 1:<br>[[Leading the AppSec Initative ]]<br>Dave Wichers
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#a0c0e0" align="center" | Day 1:<br>[[Remote Testing for Common Web Application Security Threats]]<br>David Rhoades
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#b3ff99" align="center" | Day 1:<br>[[Software Security Best Practices]]<br>Ben Tomhave
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | Class<br>Instructor
+
| width="150" valign="middle" height="120" bgcolor="#BCA57A" align="center" | [[Software Security Remediation: How to Fix Application Vulnerabilities ]]<br>Dan Cornell
<!-- Training Day 2 -->
+
| width="150" valign="middle" height="120" bgcolor="#c0a0a0" align="center" | TBD <br>
 +
| width="150" valign="middle" height="120" bgcolor="#ffdf80" align="center" | [[Java Security Overview ]]<br>Zoltán Hornák
 +
<!-- Training Day 2 -->
 
|}
 
|}
 
====Plenary Day 1 - 11/10====  
 
====Plenary Day 1 - 11/10====  

Revision as of 17:14, 22 September 2010

468x60-banner-2010.gif

Registration | Hotel | Walter E. Washington Convention Center

Back to Conference Page

Training 11/08

Traning Day 1 - Nov 8th 2010
  Room TBD Room TBD Room TBD Room TBD Room TBD Room TBD Room TBD
09:00-12:00 Day 1:
Assessing and Exploiting Web Applications with Samurai-WTFClass
Justin Searle & Mike Poor
Day 1:
Leading the AppSec Initative
Dave Wichers
Day 1:
Remote Testing for Common Web Application Security Threats
David Rhoades
Day 1:
Software Security Best Practices
Ben Tomhave
WebAppSec.php: Developing Secure Web Applications
Robert Zakon
The Art of Exploiting SQL Injections
Sumit Siddharth
Practical Web Security Overview
Zoltán Hornák
12:00-13:00 Lunch
13:00-17:00 Day 1:
Assessing and Exploiting Web Applications with Samurai-WTFClass
Justin Searle & Mike Poor
Day 1:
Leading the AppSec Initative
Dave Wichers
Day 1:
Remote Testing for Common Web Application Security Threats
David Rhoades
Day 1:
Software Security Best Practices
Ben Tomhave
WebAppSec.php: Developing Secure Web Applications
Robert Zakon
The Art of Exploiting SQL Injections
Sumit Siddharth
Practical Web Security Overview
Zoltán Hornák

Training 11/09

Traning Day 1 - Nov 8th 2010
  Room TBD Room TBD Room TBD Room TBD Room TBD Room TBD Room TBD
09:00-12:00 Day 1:
Assessing and Exploiting Web Applications with Samurai-WTFClass
Justin Searle & Mike Poor
Day 1:
Leading the AppSec Initative
Dave Wichers
Day 1:
Remote Testing for Common Web Application Security Threats
David Rhoades
Day 1:
Software Security Best Practices
Ben Tomhave
Software Security Remediation: How to Fix Application Vulnerabilities
Dan Cornell
TBD
Java Security Overview
Zoltán Hornák
12:00-13:00 Lunch
13:00-17:00 Day 1:
Assessing and Exploiting Web Applications with Samurai-WTFClass
Justin Searle & Mike Poor
Day 1:
Leading the AppSec Initative
Dave Wichers
Day 1:
Remote Testing for Common Web Application Security Threats
David Rhoades
Day 1:
Software Security Best Practices
Ben Tomhave
Software Security Remediation: How to Fix Application Vulnerabilities
Dan Cornell
TBD
Java Security Overview
Zoltán Hornák

Plenary Day 1 - 11/10

Plenary Day 1 - Nov 10th 2010
  Offense (TBD) Defense (TBD) OWASP (TBD) Government (TBD)
07:30-08:50 Registration
08:50-09:00 Welcome and Opening Remarks
09:00-10:00 Keynote: Neal Ziring
National Secuirty Agency
Video | Slides
10:00-10:30 All about OWASP
OWASP Board
Video | Slides
10:30-10:45 Coffee Break
10:45-11:35 Python Basics for Web App Pentesters
Justin Searle

Video | Slides
Drive By Downloads: How To Avoid Getting A Cap Popped In Your App
Neil Daswani

Video | Slides
Don’t Judge a Website by its GUI – Read the Label!
Jeff Williams

Video | Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
11:35-11:45 Break
11:45-12:35 White and Black box testing of Lotus Domino Applications
Ari Elias-bachrach and Casey Pike

Video | Slides
Protecting Federal Government from Web 2.0 Application Security Risks
Sarbari Gupta

Video | Slides
The Secure Coding Practices Quick Reference Guide
Keith Turpin

Video | Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
12:35-1:35 Lunch
1:35-2:25 Pen Testing with Iron
Andrew Wilson

Video | Slides
Providing application-level assurance through DNSSEC
Suresh Krishnaswamy, Wes Hardaker and Russ Mundy

Video | Slides
OWASP ESAPI SwingSet
Fabio Cerullo

Video | Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
2:25-2:35 Break
2:35-3:25 Hacking Oracle From Web Apps
Sumit Siddharth

Video | Slides
GuardRails: A (Nearly) Painless Solution to Insecure Web Applications
Jonathan Burket, Patrick Mutchler, Michael Weaver and Muzzammil Zaveri

Video | Slides
Solving Real World Problems with ESAPI
Chris Schmidt

Video | Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
3:25-3:40 Coffee Break
3:40-4:30 wXf: Web Exploitation Framework
Ken Johnson and Seth Law

Video | Slides]
The Strengths of Combining Code Review with Application Penetration Testing
Dave Wichers

Video | Slides
OWASP ModSecurity Core Rule Set
Ryan Barnett

Video | Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
4:30-4:40 Break
4:40-5:30 Pen-Test Panel

Video | Slides
Botnet Resistant Coding: Protecting Your Users from Script Kiddies
Fabian Rothschild and Peter Greko

Video | Slides
Attack Detection and Prevention with OWASP AppSensor
Colin Watson

Video|Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
5:30-5:40 Break
5:40-6:30 A new approach to preventing injection attacks on the Web Application Stack
Ahmed Masud

Video | Slides
Open Source Web Entry Firewall
Ivan Buetler

Video | Slides
Hosted by DHS, DoD, NIST and NSA

Video | Slides
6:30-8:30 Cocktails and hors d'oeuvres in the EXPO Room (TBD)

Plenary Day 2 - 11/11

Plenary Day 2 - Nov 11th 2010
  Offense (TBD) New Frontiers (TBD) Metrics (TBD) Process (TBD)
07:30-08:55 Registration
08:55-09:00 Day 2 Opening Remarks
09:00-10:00 Keynote: Ron Ross
National Institute of Standards and Technology
Video | Slides
10:00-10:15 Coffee Break
10:15-11:05 Hacking SAP BusinessObjects
Joshua Abraham and Will Vandevanter

Video | Slides
Cloudy with a chance of hack!
Lars Ewe

Video | Slides
Secure Code Review: Enterprise Metrics
Richard Tychansky

Video | Slides
Application Portfolio Risk Ranking: Banishing FUD With Structure and Numbers
Dan Cornell

Video | Slides
11:05-11:15 Break
11:15-12:05 Deconstructing ColdFusion
Chris Eng and Brandon Creighton

Video | Slides
Declarative Web Security
Mozilla Foundation

Video | Slides
Federal CIO Panel

Video | Slides
Code Auditing Strategies
Andrew Wilson and John Hoopes

Video | Slides
12:05-12:15 Break Break
12:15-1:05 Friendly Traitor 2 Features are hot but giving up our secrets is not!
Kevin Johnson and Mike Poor

Video | Slides
Exploiting the media for fun and profit. Analysis of a new type of web application attacks through media files
Aleksandr Yampolskiy

Video | Slides
Microsoft's Security Development Lifecycle for Agile Development
Nick Coblentz

Video | Slides
1:05-2:05 Lunch
2:05-2:55 JavaSnoop: How to hack anything written in Java
Arshan Dabirsiaghi

Video | Slides
Life in the Clouds: a Service Provider's View
Michael Smith

Video | Slides
Measuring Security: 5 KPIs for Successful Web App Security Programs
Rafal Los

Video | Slides
Financial ServicesPanel

Video|Slides
2:55-3:05 Break
3:05-3:55 Hacking .NET Applications at Runtime: A Dynamic Attack
John McCoy

Video | Slides
Social Zombies Gone Wild: Totally Exposed and Uncensored
Kevin Johnson and Tom Eston

Video | Slides
Dealing with Web Application Security, Regulation Style
Andrew Weidenhamer

Video | Slides
3:55-4:10 Coffee Break
4:10-5:00 Unlocking the Toolkit: Attacking Google Web Toolkit
Ron Gutierrez

Video | Slides]
Smart Phones with Dumb Apps: Threat Modeling for Mobile Applications
Dan Cornell

Video | Slides
OWASP Broken Web Applications Project Update
Chuck Willis
Video | Slides
Implementing a Secure Software Development Program
Darren Death

Video | Slides
Smashing WebGoat for Fun and Research: Static Code Scanner Evaluation
Joshua Windsor and Joshua Pauli
Video | Slides
5:00-5:10 Break
5:10-6:00 Constricting the Web: Offensive Python for Web Hackers
Marcin Wielgoszewski and Nathan Hamiel

Video | Slides
Threats from Economical Improvement
Eduardo Neves

Video | Slides
Using Misuse Cases to Articulate Vulnerabilities to Stakeholders
Scott Mendenhall
Video|Slides
The Unintended Consequences of Beating Users with Carrot Sticks: Radical Thoughts on Security Reform
Benjamin Tomhave

Video | Slides
The Web Hacking Incident Database (WHID) Report
Ryan Barnett
Video | Slides
6:00-6:30 Closing Remarks/Prizes
The OWASP AppSec DC Team

Back to Conference Page