OWASP Newsletter 1
OWASP News – December 25th 2006 to December 31st 2006
Happy Holidays from all of us at OWASP!
I would like to take a moment to welcome you all to our first edition of the OWASP weekly newsletter and introduce myself. My name is Aaron Holmes and I have had the pleasure of maintaining the OWASP Autumn of Code 2006 Web Developer Project. It has been a rewarding and educational experience for myself, and I feel OWASP has benefited greatly by the many excellent projects which have been developed and advanced through the AoC 2006 program. With all this activity and excitement, we have decided that we should produce and distribute a weekly newsletter to keep everyone up to date on the direction of OWASP and our many great projects. We invite your feedback and news submissions which can be submitted to me directly by emailing email@example.com. Enjoy!
As previously noted there has been an amazing amount of progress and work being finalized with the AoC 2006 winding down. We’ve seen new releases from both the OWASP Report Generator and the OWASP Site Generator Projects, having been made possible by the hard work of AoC 2006 participant Mike de Libero and project coordinator Dinis Cruz. Please see the progress page for a complete listing of new features and fixes as well as the main Report Generator and Site Generator project pages for complete project descriptions and resources.
Other projects seeing considerable development through the AoC 2006 program are Web Scarab (a web application security testing tool), Web Goat (online application security training environment), CAL9000 (a collection of web application security testing tools), Live CD (CD containing ready to use versions of application security analysis and testing tools), Pantera (Web Assessment Studio), Testing Guide (security testing procedures and guides), and the OWASP .NET Tools Project.
Phew, those are a lot of projects! In next week’s newsletter we will take a deeper look within a few of the aforementioned projects and explain how they can benefit you.
Until next week, happy coding!
Aaron M. Holmes OWASP Weekly Newsletter Editor and Website Developer
Featured Project - OWASP WebScarab Project
WebScarab is a Java based framework for analysing applications that communicate using the HTTP and HTTPS protocols. WebScarab has several modes of operation that are activated through plugins. By default WebScarab operates as an intercepting proxy that allows the user to review and modify requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser.
Lastest additions to the WIKI
- New pages (or major updates)
- Presentations on Chapters:
- Dec 06, Chicago, Webapps In Name Only by Thomas Ptacek, Matasano Security, Token-less strong authentication for web applications: A Security Review by Cory Scott, ABN AMRO
- Dec 06, Helsinki,Analyzing Threats by Olli Wiren
- Nov 06, Phoenix, Discovering Web Application Vulnerabilities with Google CodeSearch by Jon Rose
- Oct 06, Rochester, The first of the OWASP top ten: unvalidated input, by Steve Buck
- Page edits
- OWASP Stinger Project and OWASP Validation Project
- Cross-Site Request Forgery
- Business Justification for Application Security Assessment
- OWASP Code Review Guide Table of Contents
- A Tale of Two Systems
- How to write a new WebGoat lesson
- How to test session identifier strength with WebScarab
- Source Code Analysis Tools
- Example of some cyber vandalism 
- OWASP Testing Project: Here are just a couple links from the 2nd version of the OWASP Testing Project whose ToC is here: [[OWASP Testing Guide v2 Table of Contents]
OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.
- Jan 17 (18:30h) - Denver chapter meeting
- Jan 15 (18:00h) - Rochester chapter meeting
- Jan 11 (18:00h) - Netherlands chapter meeting
- Jan 11 (18:30h) - Phoenix chapter meeting
- Jan 10 (18:00h) - Toronto chapter meeting
- Jan 9 (18:00h) - Washington DC (N. VA) chapter meeting
OWASP News Headlines (from owasp.org website)
- Jan 2 - The Best Security Books Reference OWASP - There are over 50 security books that reference OWASP. Many of the authors are contributing to OWASP, speaking at our conferences, and participating in our chapters. Some of the books just recommend OWASP, but many are structured around OWASP, and others have whole chapters dedicated to our tools.
- Nov 28 - JBroFuzz 0.3 Released - This version adds a more stable core, length updating for fuzzed POST requests and allows you to specify your own fuzz vectors in a separate file.
- Nov 26 - OWASP Report Generator 0.88 Released - A tool for security consultants that supports the documentation and reporting of security vulnerabilities discovered during security.
- Nov 26 - OWASP Site Generator v.70 Released - A tool that allows the creating of dynamic websites based on XML files and predefined vulnerabilities (some simple, some complex) for testing application security tools.
- Nov 14 - Three great new OWASP projects
- OWASP WSFuzzer Project A fuzzing tool for Web Services to support penetration testing efforts.
- OWASP Insecure Web App Project A realistic but insecure Java EE web application for use in learning and testing tools.
- Nov 12 - New OWASP App Security Search Engine - We're beta-testing a new Google-powered search engine for application security. The engine indexes the OWASP site and all the other sites dedicated to application security on the Internet.
- Nov 7 - OWASP Hits Two-Million Page Views - Thank you all for your support! We serve approximately 1/2 million page views every month.
Application Security News (from Owasp.org)
- Dec 13 - UCLA spins massive breach - Why not just say what measures you've really taken? Are all developers trained? Do you do code review and security testing? "Jim Davis, UCLA's chief information officer, said a computer trespasser used a program designed to exploit an undetected software flaw to bypass all security measures and gain access to the restricted database that contains information on about 800,000 current and former students, faculty and staff, as well as some student applicants and parents of students or applicants who applied for financial aid. 'In spite of our diligence, a sophisticated hacker found and exploited a subtle vulnerability in one of hundreds of applications,' Davis said in the statement."
- Dec 10 - MySpace and Apple mess - MySpace and Apple show how NOT to handle security incidents (see also How Not to Distribute Security Patches)
- Dec 2 - Oracle blames security researchers - "We do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing 'zero day' exploits, to be irresponsible." So the question on everybody's mind - is the Oracle Software Security Assurance program real? Or are David Litchfield and Cesar Cerrudo right that Emperor has no clothes?