|Join hundreds of other Developers and InfoSec professionals for Training, Sessions and Community at our first conference of 2019|
[AppSec Tel Aviv, May 26-30th]
This page should collect together any resources relating to Perl and OWASP or security in general.
It is perhaps odd that this page is so new:
- Perl has long been an open source language and often associated with the internet.
- It offers what seems to be a much under-used method of combating many sorts of exploit namely taint mode. This forces every "input" to the program to be checked for malign influences before it is allowed to effect the "outside" of the program.
Possible perl OWASP projects
- Perl ports of multi-language OWASP projects, for example AntiSamy.
- Review of CPAN modules according to OWASP standards, for example CGI::Application::Plugin::Authentication.
- A perl module to measure the strength of passwords.
- OWASP ESAPI Perl Project has been started.
- Perl security man page
- Perl Monks
- Security Issues in Perl Scripts by Jordan Dimov
An attempt to list and classify perl modules related to web security. This should lead on to discussion of vulnerabilities.
Authentication modules will often be framework specific so let's list those.
|| The same module also covers authorization via the concept of realms.
||Catalyst seems to have issues with taint mode.|
|CGI::Application||CGI::Application::Plugin::Authentication||CGI::Application::Plugin::Authorization||Not a very coherent framework, multiple authors|
|Mojolicious||Mojolicious::Plugin::Authentication - A plugin to make authentication a bit easier||
A lot of generic authentication modules can be found on CPAN.
I am not aware of anything generic.
Anything similar to AntiSamy should go here.
There is a discussion on this subject going on at PerlMonks:Dynamic HTML cleanup.
These are attempts to distinguish human and robot users. CAPTCHA is not perfect at this and is highly inaccessible.