The [Open Web & Application Security Project (OWASP)][1] is an international, open-source, application security project which supports the informed use of security technology via tools and information. [1]: http://www.owasp.org/
0
votes
0answers
82 views
What clubs exist for IT security? [closed]
I'm aware of OWASP, which has local chapters. Are there any other clubs, organizations, communities, or societies that:
focus on IT security
are open to the public
have nationwide, local chapters ...
4
votes
2answers
111 views
How dangerous are direct references to database keys?
An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows:
“A direct object reference occurs when a developer ...
0
votes
1answer
66 views
Understanding nibbles & encoding using owasp EnDe tool?
I'm using owasp EnDe web-based tool to understand nibbles and encoding in general. This online utility in my knowledge is the best free resource avaiable for anyone who is interested to learn encoding ...
0
votes
1answer
68 views
Is there something like the OWASP top 10 for BizTalk applications?
I'm familiar with the OWASP top 10, for web applications. Is there something simular for BizTalk applications?
1
vote
3answers
226 views
Testing Web Application Firewall Configuration (ModSecurity)
What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
7
votes
3answers
576 views
How to validate if a JavaScript library is secure?
I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
10
votes
3answers
205 views
Application security training for developers
I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
7
votes
5answers
392 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
0
votes
0answers
102 views
How to implement url encryption on .xsl page using OWASP ESAPI? [closed]
I am implementing url encryption on an .xsl page.
A Java servlet instantiates the following:
String myparameter = ESAPI.httpUtilities().encryptQueryString(request.getQueryString());
My xsl page ...
4
votes
2answers
302 views
Canonicalization & Output Encoding
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
If any potentially hazardous characters (<>"'%()&+\\'\") ...
4
votes
2answers
386 views
How to properly validate HTTP redirects?
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
Validate data from redirects (An attacker may submit malicious ...
1
vote
1answer
158 views
Exclude file names from mod_security patterns
I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.
For example, one problem ...
5
votes
3answers
157 views
How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio.
You can see the video at Real-time ...
3
votes
2answers
396 views
List of Top security risk/attack scenarios for android application
WHat are the possible security risk/attack scenarios for android application.
This is with regards to the OWASP top 10 Mobile Security threats discussed here:
...
3
votes
1answer
192 views
Is there a spreadsheet/template for Mapping WebServices Authorization Rules?
I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed.
In the past I have created a couple of these (some even ...
1
vote
0answers
3k views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
2
votes
1answer
375 views
Are .NET WebServices vulnerable to CSRF?
While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.
There isn't ...
6
votes
1answer
1k views
CSRF prevention in PHP
Two questions.
Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git:
https://www.owasp.org/index.php/PHP_CSRF_Guard
All I see on Git however is ...
6
votes
2answers
192 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
12
votes
6answers
791 views
Securely building a local pentest lab in a VM
I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
0
votes
1answer
159 views
Can't run the Mantra Framework [closed]
I've tried to run the OWASP Mantra Security Framework which comes with as the Portable Firefox on steroids (with the FireCAT extensions) but it runs in the same profile as my FF and actually ...
-3
votes
2answers
383 views
Web service that converts HTTP GET to POST?
Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST?
For example, I'd like to give someone the URL:
...
2
votes
1answer
459 views
Mod Security for apache2 blocks curl!
I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
6
votes
2answers
206 views
Concerns and Gotcha with Secure Programming Standards Development
I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
10
votes
2answers
374 views
Detecting website attack attempts
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
7
votes
2answers
968 views
How do I get started using ESAPI WAF?
I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
