Indice del documento

• Foreward
• Why OWASP?
• Tailoring and Prioritizing
• The Role of Automated Tools
• Call to Action
• 1. Frontispiece
• Welcome to the OWASP Testing Guide
• About The Open Web Application Security Project
• 2. Introduction
• Principles of Testing
• Testing Techniques Explained
• 3. The OWASP Testing Framework
• Overview
• Phase 1 — Before Development Begins
• Phase 2: During Definition and Design
• Phase 3: During Development
• Phase 4: During Deployment
• Phase 5: Maintenance and Operations
• A Typical SDLC Testing Workflow
• 4 Web Application Penetration Testing
• 4.1 Introduction and objectives
• 4.2 Information Gathering
• 4.2.1 Testing for Web Application Fingerprint
• 4.2.2 Application Discovery
• 4.2.3 Spidering and googling
• 4.2.4 Testing for Error Code
• 4.2.5 Infrastructure configuration management testing
• 4.2.5.1 SSL/TLS Testing
• 4.2.5.2 DB Listener Testing
• 4.2.6 Application configuration management testing
• 4.2.6.1 File extensions handling
• 4.2.6.2 Old, backup and unreferenced files
• 4.3 Business logic testing
• 4.4 Authentication Testing
• 4.4.1 Default or guessable (dictionary) user account
• 4.4.2 Brute Force
• 4.4.3 Bypassing authentication schema
• 4.4.4 Directory traversal/file include
• 4.4.5 Vulnerable remember password and pwd reset
• 4.4.6 Logout and Browser Cache Management Testing
• 4.5 Session Management Testing
• 4.5.1 Analysis of the Session Management Schema
• 4.5.2 Cookie and Session Token Manipulation
• 4.5.3 Exposed Session Variables
• 4.5.4 Session Riding
• 4.5.5 HTTP Exploit
• 4.6 Data Validation Testing
• 4.6.1 Cross Site Scripting
• 4.6.1.1 HTTP Methods and XST
• 4.6.2 SQL Injection
• 4.6.2.1 Oracle Testing
• 4.6.2.2 MySQL Testing
• 4.6.2.3 SQL Server Testing
• 4.6.3 LDAP Injection
• 4.6.4 ORM Injection
• 4.6.5 XML Injection
• 4.6.6 SSI Injection
• 4.6.7 XPath Injection
• 4.6.8 IMAP/SMTP Injection
• 4.6.9 Code Injection
• 4.6.10 OS Commanding
• 4.6.11 Buffer overflow Testing
• 4.6.11.1 Heap overflow
• 4.6.11.2 Stack overflow
• 4.6.11.3 Format string
• 4.6.12 Incubated vulnerability testing
• 4.7 Denial of Service Testing
• 4.7.1 Locking Customer Accounts
• 4.7.2 Buffer Overflows
• 4.7.3 User Specified Object Allocation
• 4.7.4 User Input as a Loop Counter
• 4.7.5 Writing User Provided Data to Disk
• 4.7.6 Failure to Release Resources
• 4.7.7 Storing too Much Data in Session
• 4.8 Web Services Testing
• 4.8.1 XML Structural Testing
• 4.8.2 XML Content-level Testing
• 4.8.3 HTTP GET parameters/REST Testing
• 4.8.4 Naughty SOAP attachments
• 4.8.5 Replay Testing
• 4.9 AJAX Testing
• 4.9.1 AJAX Vulnerabilities
• 4.9.2 How to test AJAX
• 5. Writing Reports: value the real risk
• 5.1 How to value the real risk
• 5.2 How to write the report of the testing
• Appendix A: Testing Tools
• Appendix B: Suggested Reading
• Appendix C: Fuzz Vectors

Chi è Agatino Grillo?