Difference between revisions of "OWASP Common Numbering Project"

From OWASP
Jump to: navigation, search
m (Minor correction or clarification - RM)
(Updated after telecon with Brad)
Line 20: Line 20:
 
*8-9 Detailed requirement identifier (minor)  
 
*8-9 Detailed requirement identifier (minor)  
 
*11-12 Document code (DG=Development Guide, TG=Testing Guide, CG=Code Review Guide, AR, ED, RM, OR, others reserved)  
 
*11-12 Document code (DG=Development Guide, TG=Testing Guide, CG=Code Review Guide, AR, ED, RM, OR, others reserved)  
*14-40 (Optional: DEPRECATED, or # for iterations, or legacy identifiers)
+
*14-40 (Optional: DEPRECATED, or # for iterations, or legacy identifiers)<br>
<br>
+
'''Note''': Position 5 should always be a dash (-). If specifying additional details beyond the minor detailed requirement identifier (position 8&9) then position 10 should always be a - (dash) as well.
+
 
+
<br>
+
 
+
== Primary OWASP CWVN Table (DRAFT)  ==
+
This table outlines the OWASP Common Web Vulnerability Numbering(CWVN)
+
 
+
{| class="prettytable"
+
|-
+
| <center>'''CWVN Number'''</center>
+
| <center>'''Description'''</center>
+
|-
+
| '''OWASP-0100'''
+
| '''Information Gathering'''
+
|-
+
| OWASP-0101
+
| Spiders, Robots and Crawlers
+
|-
+
| OWASP-0102
+
| Search Engine Discovery/Reconnaissance
+
|-
+
| OWASP-0103
+
| Identify application entry points
+
|-
+
| OWASP-0104
+
| Testing for Web Application Fingerprint
+
|-
+
| OWASP-0105
+
| Application Discovery
+
|-
+
| OWASP-0106
+
| Analysis of Error Codes
+
|-
+
|'''OWASP-0200'''
+
|'''Configuration Management Testing'''
+
|-
+
| OWASP-0201
+
| SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)
+
|-
+
| OWASP-0202
+
| DB Listener Testing
+
|-
+
| OWASP-0203
+
| Infrastructure Configuration Management Testing
+
|-
+
| OWASP-0204
+
| Application Configuration Management Testing
+
|-
+
| OWASP-0205
+
| Testing for File Extensions Handling
+
|-
+
| OWASP-0206
+
| Old, backup and unreferenced files
+
|-
+
| OWASP-0207
+
| Infrastructure and Application Admin Interfaces
+
|-
+
| OWASP-0208
+
| Testing for HTTP Methods and XST
+
|-
+
| OWASP-0209
+
| Insecure Cryptographic Storage
+
|-
+
|'''OWASP-0300'''
+
|'''Authentication Testing'''
+
|-
+
| OWASP-0301
+
| Credentials transport over an encrypted channel
+
|-
+
| OWASP-0302
+
| Testing for user enumeration
+
|-
+
| OWASP-0303
+
| Testing for Guessable (Dictionary) User Account
+
|-
+
| OWASP-0304
+
| Brute Force Testing
+
|-
+
| OWASP-0305
+
| Testing for bypassing authentication schema
+
|-
+
| OWASP-0306
+
| Testing for vulnerable remember password and pwd reset
+
|-
+
| OWASP-0307
+
| Testing for Logout and Browser Cache Management
+
|-
+
| OWASP-0308
+
| Testing for CAPTCHA
+
|-
+
| OWASP-0309
+
| Testing Multiple Factors Authentication
+
|-
+
| OWASP-0310
+
| Testing for Race Conditions
+
|-
+
|'''OWASP-0400'''
+
|'''Session Management'''
+
|-
+
| OWASP-0401
+
| Testing for Session Management Schema
+
|-
+
| OWASP-0402
+
| Testing for Cookies attributes
+
|-
+
| OWASP-0403
+
| Testing for Session Fixation
+
|-
+
| OWASP-0404
+
| Testing for Exposed Session Variables
+
|-
+
| OWASP-0405
+
| Testing for CSRF
+
|-
+
|'''OWASP-0500'''
+
|'''Authorization Testing'''
+
|-
+
| OWASP-0501
+
| Testing for Path Traversal
+
|-
+
| OWASP-0502
+
| Testing for bypassing authorization schema
+
|-
+
| OWASP-0503
+
| Testing for Privilege Escalation
+
|-
+
|'''OWASP-0600'''
+
|'''Business logic testing'''
+
|-
+
| OWASP-0601
+
| Testing for business logic
+
|-
+
|'''OWASP-0700'''
+
|'''Data Validation Testing'''
+
|-
+
| OWASP-0701
+
| Testing for Reflected Cross Site Scripting
+
|-
+
| OWASP-0702
+
| Testing for Stored Cross Site Scripting
+
|-
+
| OWASP-0703
+
| Testing for DOM based Cross Site Scripting
+
|-
+
| OWASP-0704
+
| Testing for Cross Site Flashing
+
|-
+
| OWASP-0705
+
| SQL Injection
+
|-
+
| OWASP-0706
+
| LDAP Injection
+
|-
+
| OWASP-0707
+
| ORM Injection
+
|-
+
| OWASP-0708
+
| XML Injection
+
|-
+
| OWASP-0709
+
| SSI Injection
+
|-
+
| OWASP-0710
+
| XPath Injection
+
|-
+
| OWASP-0711
+
| IMAP/SMTP Injection
+
|-
+
| OWASP-0712
+
| Code Injection
+
|-
+
| OWASP-0713
+
| OS Commanding
+
|-
+
| OWASP-0714
+
| Buffer overflow
+
|-
+
| OWASP-0715
+
| Incubated vulnerability Testing
+
|-
+
| OWASP-0716
+
| Testing for HTTP Splitting/Smuggling
+
|-
+
| OWASP-0717
+
| Unvalidated Redirects and Forwards
+
|-
+
|'''OWASP-0800'''
+
|'''Denial of Service Testing'''
+
|-
+
| OWASP-0801
+
| Testing for SQL Wildcard Attacks
+
|-
+
| OWASP-0802
+
| Locking User Accounts
+
|-
+
| OWASP-0803
+
| Testing for DoS Buffer Overflows
+
|-
+
| OWASP-0804
+
| User Specified Object Allocation
+
|-
+
| OWASP-0805
+
| User Input as a Loop Counter
+
|-
+
| OWASP-0806
+
| Writing User Provided Data to Disk
+
|-
+
| OWASP-0807
+
| Failure to Release Resources
+
|-
+
| OWASP-0808
+
| Storing too Much Data in Session
+
|-
+
|'''OWASP-0900'''
+
|'''Web Services Testing'''
+
|-
+
| OWASP-0901
+
| WS Information Gathering
+
|-
+
| OWASP-0902
+
| Testing WSDL
+
|-
+
| OWASP-0903
+
| XML Structural Testing
+
|-
+
| OWASP-0904
+
| XML content-level Testing
+
|-
+
| OWASP-0905
+
| HTTP GET parameters/REST Testing
+
|-
+
| OWASP-0906
+
| Malicious SOAP attachments
+
|-
+
| OWASP-0907
+
| Replay Testing
+
|-
+
| '''OWASP-1000'''
+
|'''AJAX Testing'''
+
|-
+
| OWASP-1001
+
| AJAX Vulnerabilities
+
|-
+
| OWASP-1002 
+
| AJAX Testing
+
|}
+
  
 
== Mapping to Legacy Testing Guide IDs  ==
 
== Mapping to Legacy Testing Guide IDs  ==
Line 277: Line 30:
 
| <center>'''New Common Ref.'''</center>
 
| <center>'''New Common Ref.'''</center>
 
|-
 
|-
| colspan="3" align="center" | '''Information Gathering'''
+
| align="center" colspan="3" | '''Information Gathering'''
 
|-
 
|-
 
| OWASP-IG-001  
 
| OWASP-IG-001  
| Spiders, Robots and Crawlers
+
| Spiders, Robots and Crawlers  
| OWASP-0101
+
| OWASP-'''&lt;put mapped ASVS&nbsp;4 digit # here&gt;'''-TG-IG-001
 
|-
 
|-
 
| OWASP-IG-002  
 
| OWASP-IG-002  
 
| Search Engine Discovery/Reconnaissance  
 
| Search Engine Discovery/Reconnaissance  
| OWASP-0102
+
|  
 
|-
 
|-
 
| OWASP-IG-003  
 
| OWASP-IG-003  
 
| Identify application entry points  
 
| Identify application entry points  
| OWASP-0103
+
|  
 
|-
 
|-
 
| OWASP-IG-004  
 
| OWASP-IG-004  
 
| Testing for Web Application Fingerprint  
 
| Testing for Web Application Fingerprint  
| OWASP-0104
+
|  
 
|-
 
|-
 
| OWASP-IG-005  
 
| OWASP-IG-005  
 
| Application Discovery  
 
| Application Discovery  
| OWASP-0105
+
|  
 
|-
 
|-
 
| OWASP-IG-006  
 
| OWASP-IG-006  
 
| Analysis of Error Codes  
 
| Analysis of Error Codes  
| OWASP-0106
+
|  
 
|-
 
|-
| colspan="3" align="center" | '''Configuration Management Testing'''
+
| align="center" colspan="3" | '''Configuration Management Testing'''
 
|-
 
|-
 
| OWASP-CM-001  
 
| OWASP-CM-001  
 
| SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)  
 
| SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)  
| OWASP-0201
+
|  
 
|-
 
|-
 
| OWASP-CM-002  
 
| OWASP-CM-002  
 
| DB Listener Testing  
 
| DB Listener Testing  
| OWASP-0202
+
|  
 
|-
 
|-
 
| OWASP-CM-003  
 
| OWASP-CM-003  
 
| Infrastructure Configuration Management Testing  
 
| Infrastructure Configuration Management Testing  
| OWASP-0203
+
|  
 
|-
 
|-
 
| OWASP-CM-004  
 
| OWASP-CM-004  
 
| Application Configuration Management Testing  
 
| Application Configuration Management Testing  
| OWASP-0204
+
|  
 
|-
 
|-
 
| OWASP-CM-005  
 
| OWASP-CM-005  
 
| Testing for File Extensions Handling  
 
| Testing for File Extensions Handling  
| OWASP-0205
+
|  
 
|-
 
|-
 
| OWASP-CM-006  
 
| OWASP-CM-006  
 
| Old, backup and unreferenced files  
 
| Old, backup and unreferenced files  
| OWASP-0206
+
|  
 
|-
 
|-
 
| OWASP-CM-007  
 
| OWASP-CM-007  
 
| Infrastructure and Application Admin Interfaces  
 
| Infrastructure and Application Admin Interfaces  
| OWASP-0207
+
|  
 
|-
 
|-
 
| OWASP-CM-008  
 
| OWASP-CM-008  
 
| Testing for HTTP Methods and XST  
 
| Testing for HTTP Methods and XST  
| OWASP-0208
+
|  
 
|-
 
|-
| colspan="3" align="center" | '''Authentication Testing'''  
+
| align="center" colspan="3" | '''Authentication Testing'''
 
|-
 
|-
 
| OWASP-AT-001  
 
| OWASP-AT-001  
 
| Credentials transport over an encrypted channel  
 
| Credentials transport over an encrypted channel  
| OWASP-0301
+
|  
 
|-
 
|-
 
| OWASP-AT-002  
 
| OWASP-AT-002  
 
| Testing for user enumeration  
 
| Testing for user enumeration  
| OWASP-0302
+
|  
 
|-
 
|-
 
| OWASP-AT-003  
 
| OWASP-AT-003  
 
| Testing for Guessable (Dictionary) User Account  
 
| Testing for Guessable (Dictionary) User Account  
| OWASP-0303
+
|  
 
|-
 
|-
 
| OWASP-AT-004  
 
| OWASP-AT-004  
 
| Brute Force Testing  
 
| Brute Force Testing  
| OWASP-0304
+
|  
 
|-
 
|-
 
| OWASP-AT-005  
 
| OWASP-AT-005  
 
| Testing for bypassing authentication schema  
 
| Testing for bypassing authentication schema  
| OWASP-0305
+
|  
 
|-
 
|-
 
| OWASP-AT-006  
 
| OWASP-AT-006  
 
| Testing for vulnerable remember password and pwd reset  
 
| Testing for vulnerable remember password and pwd reset  
| OWASP-0306
+
|  
 
|-
 
|-
 
| OWASP-AT-007  
 
| OWASP-AT-007  
 
| Testing for Logout and Browser Cache Management  
 
| Testing for Logout and Browser Cache Management  
| OWASP-0307
+
|  
 
|-
 
|-
 
| OWASP-AT-008  
 
| OWASP-AT-008  
 
| Testing for CAPTCHA  
 
| Testing for CAPTCHA  
| OWASP-0308
+
|  
 
|-
 
|-
 
| OWASP-AT-009  
 
| OWASP-AT-009  
 
| Testing Multiple Factors Authentication  
 
| Testing Multiple Factors Authentication  
| OWASP-0309
+
|  
 
|-
 
|-
 
| OWASP-AT-010  
 
| OWASP-AT-010  
 
| Testing for Race Conditions  
 
| Testing for Race Conditions  
| OWASP-0310
+
|  
 
|-
 
|-
| colspan="3" align="center" | '''Session Management'''  
+
| align="center" colspan="3" | '''Session Management'''
 
|-
 
|-
 
| OWASP-SM-001  
 
| OWASP-SM-001  
 
| Testing for Session Management Schema  
 
| Testing for Session Management Schema  
| OWASP-0401
+
|  
 
|-
 
|-
 
| OWASP-SM-002  
 
| OWASP-SM-002  
 
| Testing for Cookies attributes  
 
| Testing for Cookies attributes  
| OWASP-0402
+
|  
 
|-
 
|-
 
| OWASP-SM-003  
 
| OWASP-SM-003  
 
| Testing for Session Fixation  
 
| Testing for Session Fixation  
| OWASP-0403
+
|  
 
|-
 
|-
 
| OWASP-SM-004  
 
| OWASP-SM-004  
 
| Testing for Exposed Session Variables  
 
| Testing for Exposed Session Variables  
| OWASP-0404
+
|  
 
|-
 
|-
 
| OWASP-SM-005  
 
| OWASP-SM-005  
 
| Testing for CSRF  
 
| Testing for CSRF  
| OWASP-0405
+
|  
 +
|-
 +
| align="center" colspan="3" | '''Authorization Testing'''
 
|-
 
|-
| colspan="3" align="center" | '''Authorization Testing'''
 
|-
 
 
| OWASP-AZ-001  
 
| OWASP-AZ-001  
 
| Testing for Path Traversal  
 
| Testing for Path Traversal  
| OWASP-0501
+
|  
 
|-
 
|-
 
| OWASP-AZ-002  
 
| OWASP-AZ-002  
 
| Testing for bypassing authorization schema  
 
| Testing for bypassing authorization schema  
| OWASP-0502
+
|  
 
|-
 
|-
 
| OWASP-AZ-003  
 
| OWASP-AZ-003  
 
| Testing for Privilege Escalation  
 
| Testing for Privilege Escalation  
| OWASP-0503
+
|  
 +
|-
 +
| align="center" colspan="3" | '''Business logic testing'''
 
|-
 
|-
| colspan="3" align="center" | '''Business logic testing'''
 
|-
 
 
| OWASP-BL-001  
 
| OWASP-BL-001  
 
| Testing for business logic  
 
| Testing for business logic  
| OWASP-0601
+
|  
 +
|-
 +
| align="center" colspan="3" | '''Data Validation Testing'''
 
|-
 
|-
| colspan="3" align="center" | '''Data Validation Testing'''
 
|-
 
 
| OWASP-DV-001  
 
| OWASP-DV-001  
 
| Testing for Reflected Cross Site Scripting  
 
| Testing for Reflected Cross Site Scripting  
| OWASP-0701
+
|  
 
|-
 
|-
 
| OWASP-DV-002  
 
| OWASP-DV-002  
 
| Testing for Stored Cross Site Scripting  
 
| Testing for Stored Cross Site Scripting  
| OWASP-0702
+
|  
 
|-
 
|-
 
| OWASP-DV-003  
 
| OWASP-DV-003  
 
| Testing for DOM based Cross Site Scripting  
 
| Testing for DOM based Cross Site Scripting  
| OWASP-0703
+
|  
 
|-
 
|-
 
| OWASP-DV-004  
 
| OWASP-DV-004  
 
| Testing for Cross Site Flashing  
 
| Testing for Cross Site Flashing  
| OWASP-0704
+
|  
 
|-
 
|-
 
| OWASP-DV-005  
 
| OWASP-DV-005  
 
| SQL Injection  
 
| SQL Injection  
| OWASP-0705
+
|  
 
|-
 
|-
 
| OWASP-DV-006  
 
| OWASP-DV-006  
 
| LDAP Injection  
 
| LDAP Injection  
| OWASP-0706
+
|  
 
|-
 
|-
 
| OWASP-DV-007  
 
| OWASP-DV-007  
 
| ORM Injection  
 
| ORM Injection  
| OWASP-0707
+
|  
 
|-
 
|-
 
| OWASP-DV-008  
 
| OWASP-DV-008  
 
| XML Injection  
 
| XML Injection  
| OWASP-0708
+
|  
 
|-
 
|-
 
| OWASP-DV-009  
 
| OWASP-DV-009  
 
| SSI Injection  
 
| SSI Injection  
| OWASP-0709
+
|  
 
|-
 
|-
 
| OWASP-DV-010  
 
| OWASP-DV-010  
 
| XPath Injection  
 
| XPath Injection  
| OWASP-0710
+
|  
 
|-
 
|-
 
| OWASP-DV-011  
 
| OWASP-DV-011  
 
| IMAP/SMTP Injection  
 
| IMAP/SMTP Injection  
| OWASP-0711
+
|  
 
|-
 
|-
 
| OWASP-DV-012  
 
| OWASP-DV-012  
 
| Code Injection  
 
| Code Injection  
| OWASP-0712
+
|  
 
|-
 
|-
 
| OWASP-DV-013  
 
| OWASP-DV-013  
 
| OS Commanding  
 
| OS Commanding  
| OWASP-0713
+
|  
 
|-
 
|-
 
| OWASP-DV-014  
 
| OWASP-DV-014  
 
| Buffer overflow  
 
| Buffer overflow  
| OWASP-0714
+
|  
 
|-
 
|-
 
| OWASP-DV-015  
 
| OWASP-DV-015  
 
| Incubated vulnerability Testing  
 
| Incubated vulnerability Testing  
| OWASP-0715
+
|  
 
|-
 
|-
 
| OWASP-DV-016  
 
| OWASP-DV-016  
 
| Testing for HTTP Splitting/Smuggling  
 
| Testing for HTTP Splitting/Smuggling  
| OWASP-0716
+
|  
 +
|-
 +
| align="center" colspan="3" | '''Denial of Service Testing'''
 
|-
 
|-
| colspan="3" align="center" | '''Denial of Service Testing'''
 
|-
 
 
| OWASP-DS-001  
 
| OWASP-DS-001  
 
| Testing for SQL Wildcard Attacks  
 
| Testing for SQL Wildcard Attacks  
| OWASP-0801
+
|  
 
|-
 
|-
 
| OWASP-DS-002  
 
| OWASP-DS-002  
 
| Locking Customer Accounts  
 
| Locking Customer Accounts  
| OWASP-0802
+
|  
 
|-
 
|-
 
| OWASP-DS-003  
 
| OWASP-DS-003  
 
| Testing for DoS Buffer Overflows  
 
| Testing for DoS Buffer Overflows  
| OWASP-0803
+
|  
 
|-
 
|-
 
| OWASP-DS-004  
 
| OWASP-DS-004  
 
| User Specified Object Allocation  
 
| User Specified Object Allocation  
| OWASP-0804
+
|  
 
|-
 
|-
 
| OWASP-DS-005  
 
| OWASP-DS-005  
 
| User Input as a Loop Counter  
 
| User Input as a Loop Counter  
| OWASP-0805
+
|  
 
|-
 
|-
 
| OWASP-DS-006  
 
| OWASP-DS-006  
 
| Writing User Provided Data to Disk  
 
| Writing User Provided Data to Disk  
| OWASP-0806
+
|  
 
|-
 
|-
 
| OWASP-DS-007  
 
| OWASP-DS-007  
 
| Failure to Release Resources  
 
| Failure to Release Resources  
| OWASP-0807
+
|  
 
|-
 
|-
 
| OWASP-DS-008  
 
| OWASP-DS-008  
 
| Storing too Much Data in Session  
 
| Storing too Much Data in Session  
| OWASP-0808
+
|  
 +
|-
 +
| align="center" colspan="3" | '''Web Services Testing'''
 
|-
 
|-
| colspan="3" align="center" | '''Web Services Testing'''
 
|-
 
 
| OWASP-WS-001  
 
| OWASP-WS-001  
 
| WS Information Gathering  
 
| WS Information Gathering  
| OWASP-0901
+
|  
 
|-
 
|-
 
| OWASP-WS-002  
 
| OWASP-WS-002  
 
| Testing WSDL  
 
| Testing WSDL  
| OWASP-0902
+
|  
 
|-
 
|-
 
| OWASP-WS-003  
 
| OWASP-WS-003  
 
| XML Structural Testing  
 
| XML Structural Testing  
| OWASP-0903
+
|  
 
|-
 
|-
 
| OWASP-WS-004  
 
| OWASP-WS-004  
 
| XML content-level Testing  
 
| XML content-level Testing  
| OWASP-0904
+
|  
 
|-
 
|-
 
| OWASP-WS-005  
 
| OWASP-WS-005  
 
| HTTP GET parameters/REST Testing  
 
| HTTP GET parameters/REST Testing  
| OWASP-0905
+
|  
 
|-
 
|-
 
| OWASP-WS-006  
 
| OWASP-WS-006  
 
| Naughty SOAP attachments  
 
| Naughty SOAP attachments  
| OWASP-0906
+
|  
 
|-
 
|-
 
| OWASP-WS-007  
 
| OWASP-WS-007  
 
| Replay Testing  
 
| Replay Testing  
| OWASP-0907
+
|  
 +
|-
 +
| align="center" colspan="3" | '''AJAX Testing'''
 
|-
 
|-
| colspan="3" align="center" | '''AJAX Testing'''
 
|-
 
 
| OWASP-AJ-001  
 
| OWASP-AJ-001  
 
| AJAX Vulnerabilities  
 
| AJAX Vulnerabilities  
| OWASP-1001
+
|  
 
|-
 
|-
 
| OWASP-AJ-002  
 
| OWASP-AJ-002  
 
| AJAX Testing  
 
| AJAX Testing  
| OWASP-1002
+
|  
 
|}
 
|}
  
Line 568: Line 321:
 
| <center>'''Ref. Number'''</center>  
 
| <center>'''Ref. Number'''</center>  
 
| <center>'''Name'''</center>  
 
| <center>'''Name'''</center>  
| <center>'''New Common Ref.'''</center>  
+
| <center>'''New Common Ref.'''</center>
 
|-
 
|-
 
| A1  
 
| A1  
 
| Injection  
 
| Injection  
| OWASP-0705
+
| OWASP-0705  
OWASP-0706
+
OWASP-0706  
  
OWASP-0707
+
OWASP-0707  
  
OWASP-0708
+
OWASP-0708  
  
OWASP-0709
+
OWASP-0709  
  
OWASP-0710
+
OWASP-0710  
  
OWASP-0711
+
OWASP-0711  
 +
 
 +
OWASP-0712
  
OWASP-0712
 
 
|-
 
|-
 
| A2  
 
| A2  
 
| Cross Site Scripting  
 
| Cross Site Scripting  
 
| OWASP-0701  
 
| OWASP-0701  
OWASP-0702
+
OWASP-0702  
  
OWASP-0703
+
OWASP-0703  
  
 
OWASP-0704  
 
OWASP-0704  
Line 598: Line 352:
 
|-
 
|-
 
| A3  
 
| A3  
| Broken Authentication and Session Management
+
| Broken Authentication and Session Management  
| OWASP-0300
+
| OWASP-0300  
 +
OWASP-0400
  
OWASP-0400
 
 
|-
 
|-
 
| A4  
 
| A4  
Line 608: Line 362:
 
|-
 
|-
 
| A5  
 
| A5  
| Cross Site Request Forgery
+
| Cross Site Request Forgery  
 
| OWASP-0405
 
| OWASP-0405
 
|-
 
|-
| A6
+
| A6  
| Security Misconfiguration
+
| Security Misconfiguration  
| OWASP-0203
+
| OWASP-0203  
 +
OWASP-0204
  
OWASP-0204
 
 
|-
 
|-
| A7
+
| A7  
| Failure to Restrict URL Access
+
| Failure to Restrict URL Access  
 
| OWASP-0500
 
| OWASP-0500
 
|-
 
|-
| A8
+
| A8  
| Unvalidated Redirects and Forwards
+
| Unvalidated Redirects and Forwards  
 
| OWASP-0717
 
| OWASP-0717
 
|-
 
|-
| A9
+
| A9  
| Insecure Cryptographic Storage
+
| Insecure Cryptographic Storage  
 
| OWASP-0209
 
| OWASP-0209
 
|-
 
|-
| A10
+
| A10  
| Insufficient Transport Layer Protection
+
| Insufficient Transport Layer Protection  
 
| OWASP-0201
 
| OWASP-0201
 
|}
 
|}

Revision as of 13:24, 18 January 2010

Contents

Introduction

Here is the generally agreed-upon new numbering scheme. Additional explanatory text coming soon. Questions/Comments? Email Mike or Brad. .

OWASP-0600
OWASP-0600-DEPRECATED 
OWASP-0604
OWASP-0604-DEPRECATED
OWASP-0604-DG
OWASP-0604-DG-01
OWASP-0604-TG
OWASP-0604-TG-DV-005
OWASP-0604-TG-DV-005-DEPRECATED
0123456789012345678901234567890123456789
          1         2         3
  • 0-4 OWASP
  • 6-7 Detailed requirement identifier (major)
  • 8-9 Detailed requirement identifier (minor)
  • 11-12 Document code (DG=Development Guide, TG=Testing Guide, CG=Code Review Guide, AR, ED, RM, OR, others reserved)
  • 14-40 (Optional: DEPRECATED, or # for iterations, or legacy identifiers)

Mapping to Legacy Testing Guide IDs

Ref. Number
Test Name
New Common Ref.
Information Gathering
OWASP-IG-001 Spiders, Robots and Crawlers OWASP-<put mapped ASVS 4 digit # here>-TG-IG-001
OWASP-IG-002 Search Engine Discovery/Reconnaissance
OWASP-IG-003 Identify application entry points
OWASP-IG-004 Testing for Web Application Fingerprint
OWASP-IG-005 Application Discovery
OWASP-IG-006 Analysis of Error Codes
Configuration Management Testing
OWASP-CM-001 SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity)
OWASP-CM-002 DB Listener Testing
OWASP-CM-003 Infrastructure Configuration Management Testing
OWASP-CM-004 Application Configuration Management Testing
OWASP-CM-005 Testing for File Extensions Handling
OWASP-CM-006 Old, backup and unreferenced files
OWASP-CM-007 Infrastructure and Application Admin Interfaces
OWASP-CM-008 Testing for HTTP Methods and XST
Authentication Testing
OWASP-AT-001 Credentials transport over an encrypted channel
OWASP-AT-002 Testing for user enumeration
OWASP-AT-003 Testing for Guessable (Dictionary) User Account
OWASP-AT-004 Brute Force Testing
OWASP-AT-005 Testing for bypassing authentication schema
OWASP-AT-006 Testing for vulnerable remember password and pwd reset
OWASP-AT-007 Testing for Logout and Browser Cache Management
OWASP-AT-008 Testing for CAPTCHA
OWASP-AT-009 Testing Multiple Factors Authentication
OWASP-AT-010 Testing for Race Conditions
Session Management
OWASP-SM-001 Testing for Session Management Schema
OWASP-SM-002 Testing for Cookies attributes
OWASP-SM-003 Testing for Session Fixation
OWASP-SM-004 Testing for Exposed Session Variables
OWASP-SM-005 Testing for CSRF
Authorization Testing
OWASP-AZ-001 Testing for Path Traversal
OWASP-AZ-002 Testing for bypassing authorization schema
OWASP-AZ-003 Testing for Privilege Escalation
Business logic testing
OWASP-BL-001 Testing for business logic
Data Validation Testing
OWASP-DV-001 Testing for Reflected Cross Site Scripting
OWASP-DV-002 Testing for Stored Cross Site Scripting
OWASP-DV-003 Testing for DOM based Cross Site Scripting
OWASP-DV-004 Testing for Cross Site Flashing
OWASP-DV-005 SQL Injection
OWASP-DV-006 LDAP Injection
OWASP-DV-007 ORM Injection
OWASP-DV-008 XML Injection
OWASP-DV-009 SSI Injection
OWASP-DV-010 XPath Injection
OWASP-DV-011 IMAP/SMTP Injection
OWASP-DV-012 Code Injection
OWASP-DV-013 OS Commanding
OWASP-DV-014 Buffer overflow
OWASP-DV-015 Incubated vulnerability Testing
OWASP-DV-016 Testing for HTTP Splitting/Smuggling
Denial of Service Testing
OWASP-DS-001 Testing for SQL Wildcard Attacks
OWASP-DS-002 Locking Customer Accounts
OWASP-DS-003 Testing for DoS Buffer Overflows
OWASP-DS-004 User Specified Object Allocation
OWASP-DS-005 User Input as a Loop Counter
OWASP-DS-006 Writing User Provided Data to Disk
OWASP-DS-007 Failure to Release Resources
OWASP-DS-008 Storing too Much Data in Session
Web Services Testing
OWASP-WS-001 WS Information Gathering
OWASP-WS-002 Testing WSDL
OWASP-WS-003 XML Structural Testing
OWASP-WS-004 XML content-level Testing
OWASP-WS-005 HTTP GET parameters/REST Testing
OWASP-WS-006 Naughty SOAP attachments
OWASP-WS-007 Replay Testing
AJAX Testing
OWASP-AJ-001 AJAX Vulnerabilities
OWASP-AJ-002 AJAX Testing

Mapping to Top 10 2010 IDs

Ref. Number
Name
New Common Ref.
A1 Injection OWASP-0705

OWASP-0706

OWASP-0707

OWASP-0708

OWASP-0709

OWASP-0710

OWASP-0711

OWASP-0712

A2 Cross Site Scripting OWASP-0701

OWASP-0702

OWASP-0703

OWASP-0704

A3 Broken Authentication and Session Management OWASP-0300

OWASP-0400

A4 Insecure Direct Object References OWASP-0502
A5 Cross Site Request Forgery OWASP-0405
A6 Security Misconfiguration OWASP-0203

OWASP-0204

A7 Failure to Restrict URL Access OWASP-0500
A8 Unvalidated Redirects and Forwards OWASP-0717
A9 Insecure Cryptographic Storage OWASP-0209
A10 Insufficient Transport Layer Protection OWASP-0201

References

  • adding the (release) year into the numbering scheme can be problematic, because the document has a life cycle that goes over years ....
  • One should rather try to accommodate a versioning scheme that is human readable in the reference number as well (e.g. V02, or RevA, or...)

  • don't try to encode any information into the ID that is likely to change or be subject to debate. In the olden days of CVE, we used to have "CAN-1999-0067" which would change into "CVE-1999-0067" once the item was considered stable and sufficiently verified. That made the ID hard to use. Right now, OWASP-DV-001 encodes the term "data validation" in the DV acronym, but what happens if in a couple of years, some new and better term occurs, or the focus changes from validation to something else? (As an example, it's only recently that the "data validation" term itself has become popular.)
  • carefully consider the range of values that your ID space supports, and if possible, allow it to expand. CVE has a "CVE-10K" problem because we never expected that we would ever come close to tracking 10,000 vulnerabilities a year. Red Hat had to change their advisory numbering scheme a couple years ago. etc.
  • don't change the fundamental meaning of the ID once you've assigned it. This causes confusion, and more importantly, it immediately invalidates almost everyone's mappings to that ID - including people who you don't even know are using that ID.
  • closely monitor the mappings that get made. Typos and misunderstandings are rarely caught. People may make assumptions about what "the item" really is, based only on a quick scan of a short name or title. Since you're dealing with diverse sources, there are likely to be many-to-many relationships in dealing with mappings.
  • determine some kind of procedure for handling duplicates. They're gonna happen.
  • the more you distribute the process of creating and assigning IDs between multiple people, the more inconsistencies and duplicates you will wind up with. This may be unavoidable, since the job is usually bigger than one person.
  • determine some kind of procedure for deprecating IDs, i.e., "retiring" them and discouraging their use by others. This will probably happen for reasons other than duplicates. There should be some final record, somewhere, of what happened to the deprecated item - i.e., it shouldn't just disappear off the face of the earth.

Much of the discussion surrounding the establishment of "Common OWASP Numbering" can be found on the various OWASP mailing lists. (For your convenience here is a direct link to the OWASP Testing Guide Mailing List Archive.)