OWASP annuncia che il 10 gennaio 2007 è stata completata la versione 2 della Testing Guide curata da Matteo Meucci, fondatore e presidente di OWASP-Italy. La guida è disponibile on line o in formato pdf (4,7 M zippato) e word (2,3 M zippato). OWASP Testing Guide v2 sarà presentata da Matteo Meucci nel seminario IsacaRoma del prossimo 25 gennaio 2007.
IsacaRoma Newsletter ha recentemene intervistato numerosi esponenti di OWASP Italy:

• Security ed information gathering – intervista a Carlo Pelliccioni di OWASP
• Intervista Alberto Revelli Technical Director di OWASP Italy ed autore di sqlninja
• Codice sicuro: intervista a Paolo Perego, thesp0nge, ideatore di OWASP Orizon
• Application security: intervista ad Antonio Parata di OWASP
• OWASP: i vincitori dell'Autumn of Code 2006
• Intervista a Matteo Meucci di Owasp Italia
• SMAU: OWASP, applicativi web vulnerabili
• Matteo Meucci: Web Application Security e il progetto OWASP (pdf zip,  2 M)
  

Indice del documento

• Foreward
• Why OWASP?
• Tailoring and Prioritizing
• The Role of Automated Tools
• Call to Action
• 1. Frontispiece
• Welcome to the OWASP Testing Guide
• About The Open Web Application Security Project
• 2. Introduction
• Principles of Testing
• Testing Techniques Explained
• 3. The OWASP Testing Framework
• Overview
• Phase 1 — Before Development Begins
• Phase 2: During Definition and Design
• Phase 3: During Development
• Phase 4: During Deployment
• Phase 5: Maintenance and Operations
• A Typical SDLC Testing Workflow
• 4 Web Application Penetration Testing
• 4.1 Introduction and objectives
• 4.2 Information Gathering
• 4.2.1 Testing for Web Application Fingerprint
• 4.2.2 Application Discovery
• 4.2.3 Spidering and googling
• 4.2.4 Testing for Error Code
• 4.2.5 Infrastructure configuration management testing
• 4.2.5.1 SSL/TLS Testing
• 4.2.5.2 DB Listener Testing
• 4.2.6 Application configuration management testing
• 4.2.6.1 File extensions handling
• 4.2.6.2 Old, backup and unreferenced files
• 4.3 Business logic testing
• 4.4 Authentication Testing
• 4.4.1 Default or guessable (dictionary) user account
• 4.4.2 Brute Force
• 4.4.3 Bypassing authentication schema
• 4.4.4 Directory traversal/file include
• 4.4.5 Vulnerable remember password and pwd reset
• 4.4.6 Logout and Browser Cache Management Testing
• 4.5 Session Management Testing
• 4.5.1 Analysis of the Session Management Schema
• 4.5.2 Cookie and Session Token Manipulation
• 4.5.3 Exposed Session Variables
• 4.5.4 Session Riding
• 4.5.5 HTTP Exploit
• 4.6 Data Validation Testing
• 4.6.1 Cross Site Scripting
• 4.6.1.1 HTTP Methods and XST
• 4.6.2 SQL Injection
• 4.6.2.1 Oracle Testing
• 4.6.2.2 MySQL Testing
• 4.6.2.3 SQL Server Testing
• 4.6.3 LDAP Injection
• 4.6.4 ORM Injection
• 4.6.5 XML Injection
• 4.6.6 SSI Injection
• 4.6.7 XPath Injection
• 4.6.8 IMAP/SMTP Injection
• 4.6.9 Code Injection
• 4.6.10 OS Commanding
• 4.6.11 Buffer overflow Testing
• 4.6.11.1 Heap overflow
• 4.6.11.2 Stack overflow
• 4.6.11.3 Format string
• 4.6.12 Incubated vulnerability testing
• 4.7 Denial of Service Testing
• 4.7.1 Locking Customer Accounts
• 4.7.2 Buffer Overflows
• 4.7.3 User Specified Object Allocation
• 4.7.4 User Input as a Loop Counter
• 4.7.5 Writing User Provided Data to Disk
• 4.7.6 Failure to Release Resources
• 4.7.7 Storing too Much Data in Session
• 4.8 Web Services Testing
• 4.8.1 XML Structural Testing
• 4.8.2 XML Content-level Testing
• 4.8.3 HTTP GET parameters/REST Testing
• 4.8.4 Naughty SOAP attachments
• 4.8.5 Replay Testing
• 4.9 AJAX Testing
• 4.9.1 AJAX Vulnerabilities
• 4.9.2 How to test AJAX
• 5. Writing Reports: value the real risk
• 5.1 How to value the real risk
• 5.2 How to write the report of the testing
• Appendix A: Testing Tools
• Appendix B: Suggested Reading
• Appendix C: Fuzz Vectors

Chi è Agatino Grillo?

Agatino Grillo, CISA, CISM, CISSP, fa parte del comitato direttivo di IsacaRoma. Precedentemente è stato nel comitato direttivo di AIEA. Ha scritto diversi articoli per IsacaRoma Newsletter.