Reaching out to .NET developers (in this case Nunit)

I just posted the text below to NUnit's main mailing list. This is something that I've wanting to do for a while, and finally I think that O2 is reaching a level of maturity that developers of other tools will find it interesting, and will adopt parts of it.

This is all part of the strategy of building bridges with developers, to add value to their world, and to allow us to speak the same language.

In this case, if we can get a good dialog with the NUnit folks, I would love to add 'security focussed Unit Tests' to the NUnit Community

"...
Hi, I'm the main developer of the OWASP O2 Platform (see http://o2platform.com and http://o2platform.wordpress.com) and I just wrote a blog post that you might find very interesting:

• Injecting O2 into another .NET Process (in this case NUnit.exe): http://o2platform.wordpress.com/2011/07/07/injecting-o2-into-another-net-process-in-this-case-nunit-exe/

O2 Platform is a .NET application that has a number of very powerful Reflection APIs. It also makes extensive use of Fluent APIs which you can see a published example here: fluentsharp.codeplex.com

As part of that PoC there is also an O2 Command Prompt that popups up which allows direct access to NUnit's Gui and memory objects. This would be very useful for NUnit developers since it would allow them to have direct access to the GUi controls without needing to recompile and execute the application.

Feel free to contact me if you have further questions or want to see a demo of this in action

Dinis
..."

Injecting O2 into another .NET Process (in this case NUnit.exe)

Here is an O2 script that I wrote while delivering O2 Training to a Company in Phoenix (as a PoC of how O2 could be further integrated into their SDL).

Check out this blog post for screenshots and the code that make this happen: http://o2platform.wordpress.com/2011/07/07/injecting-o2-into-another-net-process-in-this-case-nunit-exe/
In the past I also did the same for Fiddler, where I was able to modify its GUI and decouple a bunch of its windows.

Just to make this clear, with this technique you can take control of any .NET app and (from an O2 Script) completely manipulate its GUI (and features)

Dinis Cruz

IronJS looks very interresting

Need to take this for a test drive:

• https://github.com/fholm/IronJS
• https://github.com/fholm/IronJS/wiki
• https://github.com/fholm/IronJS/wiki/Creating-a-hosting-context
• http://ironjs.wordpress.com/
• http://newcome.wordpress.com/2010/05/25/embedding-ironjs/ and http://newcome.wordpress.com/2011/03/13/embedding-ironjs-part-ii/
• http://blog.dotsmart.net/2011/04/20/first-steps-with-ironjs-0-2/
• http://dotnet.dzone.com/articles/pumping-iron-javascript
• http://dlr.codeplex.com/

Javascript related and also interesting:

• http://newcome.wordpress.com/2010/05/08/node-net-node-js-implemented-in-javascript-on-the-net-runtime/
• http://wtfjs.com/

If you are looking for an WebAppSec job in Boston...

...here are a couple cool positions from SecurityInnovation

Posted today (1st July 2011) in http://news.ycombinator.com/item?id=2719028 by Joe Basirico ...

"...
Security Innovation's (http://securityinnovation.com) team of amazing hackers is hiring (Boston, MA).

I'm looking to hire a couple awesome security professionals for our Boston office.

We assess a wide range of really interesting technologies, from web apps to mobile to crypto. You have to have a true passion for security, most of the team does this on their off time and it's all we talk about.

If you dream in hex, clickjack for breakfast, exploit XSS, SQLi and CSRF for lunch, Buffer Overflows and Format String Vulns for Dinner and some AuthN/AuthZ hijacking for a midnight snack you're our kind of candidate.

You'll have time and budget to do research, go to and speak at conferences, and build tools that will change the internet (We helped develop Firesheep, if you remember that).

You can e-mail me directly: jbasirico at securityinnovation dot com for more information.

Check out our postings:

• http://securityinnovation.recruiterbox.com
• http://www.linkedin.com/jobs?viewJob=&jobId=171832
• http://www.linkedin.com/jobs?viewJob=&jobId=1718256

..."

14x O2 Scripts on: EC2, jQuery, VS CSProj, Notepad++ and O2 in Aspx

Here are 14 blog posts published in the last two months at the http://o2platform.wordpress.com blog covering the following topics: EC2, jQuery, VS CSProj, Notepad++ and O2 in Aspx

• Adding an O2 Menu to Notepad++ and 'listen' to menu selections
• Creating a custom version of 'O2 Quick Development Gui' environment (stand-alone and in aspx)
• Changing a reference/dll value of a VS CSproj file
• Removing C# class from C# file in multiple WSDL files
• Creating a jQuery DataTable using serialized JSON object
• Creating a jQuery jsTree using serialized JSON object
• Simple Windows UIAutomation example
• O2 Trick to complile with explict references
• Invoking jQuery from O2
• Trigger an Keypress event in IE
• New Amazon EC2 'image filtering focused' Extension Methods
• Script to view Amazon EC2 Images List
• Using the O2's Amazon EC2 API
• New Amazon EC2 .Net API 
• Solved the problem with decryping AmazonEC2 Instance's password

The ESTAPI idea

the ESTAPI (the Enterprise Security TESTING API) was an idea that pop-up a couple years ago at the OWASP AppSecEu in Poland.

Basically the idea is that what is more valuable to app/framework developers, is NOT another API that they have to bake into their product, BUT a set of Unit/Integration tests that they can use to validate what they are doing.

In this world ESAPI would be an example of what that could look like, BUT what would be the expectation is that app and framework developers implement the same 'behaviour/capability' into their code.

And then ESTAPI would be used to develop AND validate those capabilities.

Let's take a simple example: HtmlAttributeEncoding and JavascriptEncoding across the multiple ESAPI language implementation? (Java, .NET,PHP, etc...) Shouldn't ALL of them pass the same ESTAPI test? surely ALL should have the same behaviour right? (i.e. given the same input, provide the same output)

Same thing for the popular Java Frameworks (Spring, Struts, Tapestry, JSF, etc...). We should be using ESTAPI to measure (and understand) how those frameworks behave.

Of course that there are cases where the devs will chose to use the ESAPI.jar (& its dependencies), BUT my view for a while now, is that 'THAT esapi.jar' adoption should NOT be the first step in ESAPI usage. This 'adaption' COULD be one of the options later down the line, but the first step should be on a bunch of ESTAPI tests adapted to the targeted app.

What I also like about the ESTAPI idea, is that it will give drive (and push) the ESAPI team to really segment and separate the esapi.jar dependencies. Since it will be much easier (or practical) to write ESTAPI tests on single-focused JARs, with its dependencies injected (i.e. using DI)

Fluent Sharp is now available at NuGet and VS Gallery

Thanks to Daniel Brzozowski, O2's Fluent API is now available at NuGet and VS Gallery.

• NuGet Package: http://www.nuget.org/List/Packages/FluentSharp_O2
• VS Gallery: http://visualstudiogallery.msdn.microsoft.com/83b25558-5cbb-4966-bb89-ff3d65693109
• CodePlex home: http://fluentsharp.codeplex.com/

I wonder how many developers will this reach :)

FluentSharp - An API for .NET developers

Key to the OWASP O2 Platform environment is its ability to quickly write scripts and mini-tools. In fact I took that to such a level, that I now write O2 in O2 (i.e. without using VisualStudio).

At core of O2 Scripting there is an .NET development environment (by default in C# but any .NET language is supported), and since O2 is starting to be use independently by developers, I separated the O2 core into a new API which I'm calling FluentSharp (see CodePlex project http://fluentsharp.codeplex.com/):

The main http://fluentsharp.codeplex.com/ page contains an example of how this API works and the reasoning behind the 'Fluent' concept.

I expect developers to embrace this API since it can improve their productivity, while creating smaller and more readable code. The first place to start is to use FluentSharp to build Unit-Tests and Integration-Tests (which once created can be extended into Security Tests using O2 :)  )

Using O2 to exploit HacmeBank

Just posted this to the o2 mailing list:

Hi ..., no worries about being confused, O2 is VERY confusing for new users :)

On HacmeBank have you seen the O2 Scripts that automate a number of its exploits?

Here are a couple pointers for you to start:

• Main O2 page for hacmeBank: http://o2-ounceopen.com/wiki/HacmeBank
• The opensource version is here: http://code.google.com/p/owasp-hacmebank/
• O2 Scripts on HacmeBank
• http://code.google.com/p/o2platform/source/browse/trunk/#trunk%2FO2_Scripts%2F_Sample_Vulnerabilities%2FHacmeBank
• O2 BlackBox Analysis
• API with core HacmeBank functionality: http://code.google.com/p/o2platform/source/browse/trunk/O2_Scripts/_Sample_Vulnerabilities/HacmeBank/API_HacmeBank.cs
• http://o2-ounceopen.com/wiki/HacmeBank%5CUnit_Tests_for_Vulnerabilities
• http://code.google.com/p/o2platform/source/browse/trunk/O2_Scripts/_Sample_Vulnerabilities/HacmeBank/HacmeBank_BlackBox_Exploits.cs.o2see here the video of this in action http://www.youtube.com/watch?v=T2XVufhJLig&NR=1
• Here is a video on the current script that starts the local web servers: http://www.youtube.com/watch?v=vucYncGiClE&feature=related
• O2 WhiteBox/Source-Code Analysis
• http://o2-ounceopen.com/wiki/O2_.NET_AST_Scanner_-_HacmeBank_-_SQL_Injection_PoC with explanation here http://diniscruz.blogspot.com/2010/05/major-o2-milestone-complete.html . Also using this script is this BlackBox and whiteBox Poc of HacmeBank SQL injection vulnerability: http://www.youtube.com/watch?v=MdObVD53Iyg&feature=related
• http://o2-ounceopen.com/wiki/O2_.NET_AST_Scanner_-_HacmeBank_Example
• I also started writing an installer script for HacmeBank which I have not completed (see if you can complete it)

Other resources:

• Nice video on how to exploit HacmeBank WebServices using SoapUI: http://www.youtube.com/watch?v=KftIvpRk7oQ

For more ideas on where to start on O2 see http://diniscruz.blogspot.com/2010/07/o2-platform-ideas-on-where-to-start.html

Finally here is a exercise for you:

"...reuse this HacmeBank IE Automation script

public API_HacmeBank login(string userName, string password)

{

loginPage();

ie.field("txtUserName").value(userName);

ie.field("txtPassword").value(password);

ie.button("Submit").click();

return this;

}

on this script (instead of the Altoro SQLi)

http://code.google.com/p/o2platform/source/browse/trunk/O2_Scripts/_Sample_Vulnerabilities/Altoro/PoC%20-%20SQLi%20Vulns%20via%20FuzzDb%20with%20Screenshots.h2

(the SQLi script above will fuzz the login sequence and take a screenshot after each request
..."

Note that the scripts above are the ones that you will find on your local C:\O2\O2Scripts_Database\_Scripts folder

Let's Hack Google :)

Google just took another step in improving the state of their web applications: Rewarding Web Application Security Research. Kudos to them, and I hope this program is a great success.

This is a great development for WebAppSec (following on the footsteps of others like Mozilla)

Unfortunately this page also show how weak the OWASP brand is, since there is NO mention of OWASP on that page.

For the ones that keep worrying about 'abuses of the OWASP brand' , I am much more worried about the cases where it IS not used (like this one).And every-time we kick a fuzz about 'somebody XYZ is abusing the OWASP brand' is another sign we send to the outside world that we are a mess to deal with.

The way OWASP should measure success is by the opportunities that we are able to materialize. And our failures are the opportunities we miss. This was a good opportunity missed.

But we are not too late to join the party, so the interesting question is "What can we do, so that Google (and others) point to OWASP resources in pages like this?". We have good/amazing quality materials at owasp.org that could be referenced, and ideally we should also take the opportunity to add the 'how to fix it' angle (this would highlight the power that OWASP has since we can cover the: attack, detect, mitigate, fix and defend angles)

And if a new 'clean' website with only a couple owasp references is needed (with more details being provided via links to the main owasp.org website), then why don't we just do that!

Another interesting angle would be to use this type of public initiative as a sign of 'Security SDL maturity' by companies. So far, the data points to the fact that only companies that have a very solid SDL and security teams are confident enough to make this type of public statement (for example why isn't Sony doing the same thing :) ) . The Firefox crowd actually has good metrics on this (as presented at the Summit) and it would be great to explore more this concept/idea.

We need to give our clients 'scripts' not pdfs

At the end of our security engagements our 'Findings should be delivered as 'scripts', not as a big list in a pdf' (with links and screenshots). These scripts need to cover the entire spectrum of our analysis (i.e. from BlackBox to WhiteBox, from Browser Automation to Source-Code, etc...)

The scripts should allow the client (and the developers) to initially validate the findings, and then validate the fixes (or mitigations). Ideally these 'scripts' should be delivered as 'Unit Tests' and should cover a large number of exploit variations (for example for SQLi/XSS vulns, run through the respective FuzzDB payloads)

Mono team fired from Novell and Miguel starts a new company

With my O2 work focus of the last months I missed this big event (see details here http://tirania.org/blog/archive/2011/May-16.html)

There are a lot of interesting angles here (which I need to find the time to write about), and since O2 is an active used of the Mono Project, this is also a great opportunity to work together with them.

The other interesting angle is the funding and how even Mono who is a very popular and widely used project, still doesn't have a clear and easy to execute business model (which (in my view) is one of the current failings of Open Source at the moment)

Should the NHS IT Project go Open Source and what about its security?

As expected by many, the UK's NHS IT program is going downhill: http://www.computerweekly.com/blogs/public-sector/2011/05/nhs-it-system-condemned.html

I am on thread that asked the question 'should NHS be buying FOSS Code' and my initial reaction is YES!!

Here are my thoughts:

I think the FOSS (Free and Open Source Software) angle should be explored here, since if the source code of what was developed was released under a Free license the buyer (UK Gov and NHS) would have a lot more control over the technology developed.

And in a case like the NHS where one needs global standards implemented from the bottom up (i.e. adopted by each NHS practice), a core technology stack that is Free would give a LOT of independence to the local NHS practices (they could accept the 'mothership' packages or develop their own). Yes their might be some fragmentation but we would probably be much better than where we are today.

Note that the requirements of delivering such technology in such Open/Free way, would force the main/code developers to have strong engineering practices (namely in the areas of application interdependencies and deployment).

But I guess the first question is: How much FOSS is already included in this project? What technologies are they using?

I have to admit that I don't know a lot of details about this project, but it would be very weird it was all 'proprietary' technology.

Also, since my specially is Application Security, are you guys aware of any published information about the security reviews done to these applications? (my experience is that systems that 'struggle' to work as they were supposed to, are usually full of serious security vulnerabilities (since there is a moment where the mandate is '...just get it to work...' which usually means that 'application security' is moved even down on the priority scale))

More O2 Scripts on: .NET Dynamic Types, WSDL Web Services, HttpRequest Mocking for Unit Testing, .NET AST Search, Amazon EC2 and Wordpress

Here are O2 Platform developer's blog entries created in the last two weeks covering a wide range of topics:

• .NET Dynamic Types, 
• WSDL Web Services, 
• HttpRequest Mocking for Unit Testing 
• .NET AST Search
• Amazon EC2,
• Wordpress

These provide great examples of the power of O2 Scripting and the fact that I'm creating them while working on client's projects (and they are only a fraction of the scripts I wrote since there is a LOT more committed to the O2 SVN codebase (all were committed as scripts, which mean that they will be available to O2 users once the SVN rules are updated)

Script to fetch and present large number of Wordpress.com blog entries

O2 Script to automatically upload clipboard images to Wordpress.com

Trying to Decrypt Amazon EC2 password using BouncyCastle and it is not working

Scripting "O2 Tool - AST Search" to find Null references (.NET Static Analysis)

O2 Tool - AST Search (.NET Static Analysis)

Unit Test for HttpModule using Moq to wrap HttpRequest

Amazon EC2 Browser - Timer to Stop Instances

O2 Tool - Amazon EC2 Browser

Mocking HttpContext HttpRequest and HttpResponse for UnitTests (using Moq)

O2Script: Not Optimized fuzz string generator

O2 Script: consume webservices by using the WSDL's C#

O2 Script: Using Reflection to Invoke Bing Search Web Service

O2 Script: Dynamic creation of .Net Assemblies, Types, Methods, Properties and Fields

Blog posts on O2 scripts covering: JavaScript, OpenXML, GIT, PuttyGen, RDP, .NET Static Analysis

Here a couple more Blog Posts on O2 Scripting that I published recently at the O2 focused blog http://o2platform.wordpress.com:

• O2 Script: Util - Javascript Object viewer
• O2 Script: Manipulating RadioButtons
• O2 Script: Quick File Viewer
• Making HttpRequest QueryString and Form Editable
• O2 Script: loading data from an Xslx (OpenXml) file
• Decomposing an Lamba method used in an O2 Script
• O2 Script: Installing TortoiseSVN and ProcessExplorer
• O2 Script: Creating a Git Clone using TortoiseGIT
• O2 Script: adding the SSH Key to GitHub
• O2 Script: automating PuttyGen to create Public and Private Keys
• O2 Script: Automating TortoiseGit installation
• Custom O2 for .NET Static Analysis
• O2 Script: Testing for RDP server
• Running Javascript in O2's IE Automation environment

If you want a way to start on your C# based O2 scripting activities, documenting some of these scripts, would be a great activity :)  This would really help you to understand how they work.

Working with SI on Team Mentor and OWASP projects

In a model very similar to the contracts I had previously with Ounce Labs and ABN AMRO, I recently signed a professional services contract with Security Innovation

This is quite an exciting opportunity for me. Not only I'm going to be working with great people, the TeamMentor project has lots of potential and the SI guys seem very interested in O2.

Here are my areas of responsibilities (verbatim from my contract):

• TeamMentor Product Development - Taking full responsibility for the TeamMentor product
• TeamMentor Metrics - Understanding and visualizing how the product is currently used
• SI Community outreach - Representing SI in the industry
• Leadership of OWASP Projects: OWASP Exams, OWASP Certification, OWASP Academies, OWASP SDL Implementation project
• Presentations at OWASP , developer’s Conferences (TBD) or WebCasts (TBD)
• Blog and article creation
• O2 Integration with SI Product and services - Introduce SI teams to O2 capabilities and features

An interesting note, is the fact that this is one of the first times that my OWASP involvement is directly mapped into one of my contracts.

My initial focus is going to be on the TeamMentor product, which should keep me busy for the first month(s).

What is also VERY interesting 'from the point of view of Application Security', is that I am now going to be directly involved and responsible for an application's security (so if you find a vulnerability in TeamMentor please email it to me ASAP :) ).

This relationship will also (occasionally) put me in a position where I am representing an 'vendor'. This is going to force me to be very disciplined in my OWASP relationships, and I will want to take this opportunity to clarify the 'OWASP-rules-of-engagement' between commercial parties and OWASP (something that today is a very fuzzy area)

Let me know what you think of this, and (since it will change quite a bit) keep an eye on TeamMentor :)

O2 Script: DWR FunctionsViewer and Invoker

If you are using (or testing) DWR, you might find the O2 scripts I just published quite interesting and useful:

• Here is an initial blog post that explains the new GUI: http://o2platform.wordpress.com/2011/03/07/o2-script-dwr-functions-viewer-and-invoker
• Here is the API that processes the DWR Javascript interfaces and creates a number of O2 objects that allow its easy manipulation and invocation: DWR_API.cs

There are quite a number of powerful O2 techniques at play here. For example note the use of the HtmlAgilityPack to quickly fetch the details of a web page's links, or the use of Jint (Javascript Interpreter for .NET) to access the AST of the dynamically created DWR's Javascript pages (which contain the details of the java functions that can be involved on the server)

Note: DWR is a Java/Javascript AJAX-powerhouse Web Remoting technology (see http://directwebremoting.org for more details)

O2 Scripts: Adding sites to IE zone, Registy Editor, Workpress Editor, Downloading files

Recent blog posts on O2 Platform's developer's blog that show a number of O2 Scripts in action:

• Using WatiN as a browser automation engine
• O2 Method: Adding sites to IE trusted zones
• O2 Script Sequence: Creating a Windows Registry Viewer
• O2 Util: Add sites to IE trusted zone
• O2 Util: WordPress Editor 
• O2 Script: Downloading File

I'm happy to provide more details on these scripts, so just add a comment on where you have questions and I will answer it there

Couple blog posts on creating O2 Scripts and APIs

Here is a nice sequence of posts that shows how to go from one simple script to a full API (that is easily consumed from another O2 Script):

• O2 Script: Create XSD and Assembly from XML file
• Consuming extension method from external file
• Creating an API to be consumed by an O2 Script

Hopefully by the 3rd post it will make more sense how the APIs that are consumed from the O2 Scripting environment where created :)

Dinis Cruz

Open letter to WebAppSec Tool and Services vendors: Release your schemas and allow automation

I 'soft' published this letter before the OWASP Summit 2011 and I it is time it goes mainstream (note how there are already a number of signatures :) )

Note: The original can be found on the OWASP Website Open letter to WebAppSec Tool and Services vendors: Release your schemas and allow automation

-----------------------------------------------------------------------------------------

To WebAppSec vendors

This request is mainly focused on the commercial vendors of products and services of the following WebAppSec categories: Pen-testing, Code Review, BlackBox Scanning, WhiteBox Scanning and WAFs.

Other software/services categories, including equivalent Open Source tools, are more than welcomed to participate.

Open Letter

02/Feb/2010

Open letter to WebAppSec tool/services vendors: Release your schemas and allow automation

Dear vendor,

Although you provide a product or service that automates (as much as you can) the process of evaluating the security of a particular application, at the moment (Feb 2011) it is very hard to consume, consolidate, integrate and instrument your deliverables and technology.

Our industry (and clients) desperately need to move into a world where we are able to consolidate, analyse and present the results created by multiple tools/services. This would create a scenario where we (for example) are able to deliver to developers (as Unit Tests or Software-as-a-Service) 'complete and integrated' findings (i.e. security findings that contain both WhiteBox and BlackBox findings). We also need to be able to create WAF rules from the findings delivered, and must have the ability to integrate them with other technologies used through the Software Development LifeCycle (e.g. BugTracking, Change Control, Application Modelling/Design Tools, Threat Modelling tools, Knowledge-Base/ELearning solutions, etc...)

At the moment there are numerous companies and projects that are trying to achieve such integration (good luck on their endeavours), but we need an independent base we call all work from.

With this in mind, the following data and artifacts are requested from you and ALL product vendors in this space :

• The XSD (schemas) for ALL released versions of your product/service (starting with the most recent release and going back as far as possible)
• Sample XML files (or whatever format the data can be exported) of: vulnerable-by-design and Open Source web applications - To kickstart this process please deliver the results for the following applications:
  • OWASP WebGoat (Java),
  • HacmeBank - OWASP version (.Net),
  • MediaWiki (PHP),
  • NerdDinner (ASP.NET MVC),
  • PetStore (Struts/Spring version)]
  • PetStore (DWR version).
  • Other applications can be also provided at the discretion of the vendors (as long as it is possible to also scan those applications from other tools/services)
• Artifacts created during scanning (for example Internal representations of source code or web applications)
• Rules used during the scans (to allow the replication of findings and the creation of a core 'industry wide' set of rules)
• APIs that can be used to instrument and control your scanning engine (please provide as much documentation as possible on the currently supported ways to interact with your product)

With these materials (to be uploaded to a google code repository), the OWASP community will try to create the following standards (reusing as much as possible the great work done by others in this space (MITRE, CWE, NIST, OVAL, etc...):

• Open Findings Schema
• Open Rules Schema
• Open Application Artifacts Schema (which could also be called: Open Scan Targets Schema)
• Open Intermediate Representation Schema (abstraction layer of code and web assets)

The OWASP Summit 2011 represents a unique opportunity to make this happen, so please either provide the requested data yourselves, or allow your current clients to do so (without the thread of a lawsuit)

The undersigned below, urge you to join these effort and to active participate in this endeavour

-----------------------------------------------------------------------------------------

If you want to sign , please do it here (on OWASP website)

OWASP Summit 2011 Results

I'm very proud to announce the Summit 2011 Results, which you can download from here:

• Pdf Format (http://www.owasp.org/images/2/27/OWASP_Summit_2011_Results.pdf)
• Word Format (http://www.owasp.org/images/2/27/OWASP_Summit_2011_Results.docx)

As you can see by the Summit's highlights, we achieved an amazing amount of work during the 3 days we were together in Portugal!

Amazingly, we also had a great time, and created/consolidated an enormous amount of friendships/relationships. Just look at the the number of similes (and focused faces) that exist on the Summit's official photo album: https://picasaweb.google.com/owaspphotos/OWASPSummit

I would like to take this opportunity to thank the Summit organization team, the Working Session chairs, the 180 on-site participants and the 1000s remote participants, for working so hard and achieving so much.

Note that this is the first version of this document. There is work already underway to create a much more detailed and comprehensive version of this document, which will be released as a number of books (Summit 2011 Final Report, Browser Security Report 2011, etc...).

Please distribute this document/Press-Release as widely as possible.

Thanks

Register your interest in participating in the O2 Platform Working Session at the OWASP Summit

O2 users , please participate remotely on the O2 Working Session that will happen at the Summit. The time-slot and location of this session will depend on how many people are registered (both online and remotely) so if you are going to the Summit or can participate remotely, please register now!

If you are going to be at the Summit, you can add your name here: http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session063 (see 'Working Session Participants' section at the bottom)

If you are going to participate remotely, you can register here : https://spreadsheets.google.com/viewform?formkey=dEptc1BoTVJSQkxBSDhhNHdSaEN1Y3c6MQ (make sure you select the O2 Platform Working Session :) )

For reference, here are the current details of this O2 Platform Working Session (from http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session063):

Description:

This session will focus on exchanging experiences between O2 users and on how to make O2 easier to use and consume. There are a lot of areas that O2 can add value during security reviews, the problem most O2 users have is 'I know that it can be done, but how?'. Another key topic for discussion and debate is the 'No more security reports as PDFs concept' (where after a security engagement, clients should be given Unit Tests, not PDFs)

Objectives:

1. Define 'What is O2'
2. Map out easy ways to start using O2
3. Document success stories and 'real world' O2 usage

Deliverables:

1. Simple user’s guide that shows how to install, configure, and use O2 to do a few simple common things
2. Detailed workflows for the more complex features
3. Roadmap for the next version of O2

Fell free to edit the WIKI and add your ideas (if you have an O2 feature wish-list, now is a good time to document it).

Thanks and see you at this session...

Participate remotely on the OWASP Summit

The OWASP Summit is gearing up to be an amazing event.

If you are not able to make it in person to Portugal, then please make the time to participate remotely.

We will have at least 1 professional video/audio feed (provided by Portuguese web company sapo.pt) and most working sessions will have video/audio coverage (technology still to be decided)

If you are going to participate, PLEASE register your interests so that we can (try) to take your needs into account! (important if you are not on a GMT time zone).

Here is the registration form : https://spreadsheets.google.com/viewform?formkey=dEptc1BoTVJSQkxBSDhhNHdSaEN1Y3c6MQ

For reference, here are the main links:

• Home page: http://www.owasp.org/index.php/Summit_2011
• List of planned working sessions: http://www.owasp.org/index.php/Summit_2011_Working_Sessions
• List of confirmed attendees (160 at last count): http://www.owasp.org/index.php/Summit_2011_Attendee

Please distribute/blog/tweet this info to who you think might/should be interested :)

Thanks

list of application security links

A client asked me to recommend a list of application security links. So here they are:

• http://www.owasp.org/index.php/Feed - OWASP AppSec Feed (if you only follow one XML feed, follow this one)
• http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project - OWASP Top 10 Document (should be mandatory reading for everybody)
• http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project - Vulnerable Web Application in J2EE (designed as a learning tool)
• http://code.google.com/p/owasp-hacmebank/downloads/list - Vulnerable Web Application in .NET (designed as a banking application)
• http://www.owasp.org/index.php/OWASP_Testing_Project - OWASP Testing Guide (provides good foundation for Security focused testing)
• http://www.owasp.org/index.php/Category:OWASP_Legal_Project - Great document that shows an example of a what should exist (from a security point of view) on a software development contract
• http://www.opensamm.org/ - A Maturity Model based of what companies should be doing (this a type of SDL)
• http://bsimm.com/ - A Maturity Model based on what a number of large companies are doing
• http://blogs.msdn.com/b/sdl/archive/2011/01/26/only-16-security-practices-implementation-guidance-included.aspx - Good '16 steps to have an SDL' guidance from Microsoft
• http://o2platform.com , http://o2platform.wordpress.com/ - Info about the O2 Platform
• http://jeremiahgrossman.blogspot.com/ - Great application Security Blog (from WhiteHat founder)
• http://1raindrop.typepad.com/1_raindrop/ - Great application Security Bog

Keynote at OWASP IBWAS conference - lots of strong ideas

Last December I did a keynote at OWASP's IBWAS conference in Portugal where I presented a large number of ideas and solutions for the current state of the Web Application World:

You can:

• read it online using SlideShare
• see the video of the original presentation
• or download the presentation in pdf format

There are a lot of thought provoking ideas in there, and I don't expect that some of them will become reality any time soon. 

But here they are, so at least I'm doing my part.

Let me know what you think of these ideas, and ping me if you spot any online articles like this one: Portugal podia ser a 'Suíça do hacking' (in Portuguese)