OWASP Live CD:An open environment for web application security. Eoin Keary & Rahim Jina email@example.com firstname.lastname@example.org
Presentation Overview Who are we? What's the OWASP Live CD about? Tools Plugins Examples How can I get involved?
About us (Rahim & Eoin) Our Varied IT Backgrounds Software Development , Pen Testing, Application Security design & review, Code review, CISSP, CISA, Certified ASS, Contributors to many OWASP projects Member of OWASP Global Board Member of Ireland chapter.
Project History and Goals Started as a Summer of Code 2008 project GOAL: Make application security tools and documentation easily available and easy to use Compliment's OWASP goal to make application security visible Design goals Easy for users to keep updated Easy for project lead to keep updated Easy to produce releases (maybe quarterly) Focused on just application security – not general pen testing
General goals going forward Showcase great OWASP projects Provide the best, freely distributable application security tools/documents in an easy to use package Ensure that the tools provided are easy to use as possible Continue to document how to use the tools and how the modules were created Align the tools with the OWASP Testing Guide v3 to provide maximum coverage
Navigation • Mount a usb key for saving your work • This is automatic.
Available Tools Significant tools: Examples:
Special features... Firefox Add-ons there are a few
More on Tools Recon Menu: Scanners Menu:
W3af • The framework should work on all platforms supported by Python, particularly, w3af has been tested on Linux, Windows XP, Windows Vista and OpenBSD. • Phases supported: • Discovery: Discovery plugins have only one responsibility, finding new URLs, forms, and other “injection points”. • Audit: Audit plugins take the injection points found by discovery plugins and send specially crafted data to all of them in order to find vulnerabilities. • Exploit/Attack: Used to exploit vulnerabilities found by audit plugins.
W3af: Web Application Attack Audit Framework auditxsrfhtaccessMethodssqlisslCertificatefileUploadmxInjection genericlocalFileIncludeunSSLxpathosCommandingremoteFileIncludedavssievalbuffOverflowxssxstblindSqliformatStringpreg_replaceglobalRedirectLDAPiphishingVectorfrontpageresponseSplitting grepdotNetEventValidationpathDisclosurecodeDisclosureblankBodymetaTagsmotwprivateIPdirectoryIndexingsvnUsersssnfileUploadstrangeHTTPCodehashFindgetMailshttpAuthDetectwsdlGreper newlinepasswordProfilingdomXssajaxfindCommentshttpInBodystrangeHeaderslangerrorPages ExploitsqlmaposCommandingShellxssBeeflocalFileReaderrfiProxyremoteFileIncludeShelldavShellevalfileUploadShellsql_webshell collectCookiesstrangeParameters error500 objectscreditCards oracle feeds Also…………. audit, discovery,output ,mangle, bruteforce, evasion
W3af: integration • Virtual daemon: • Virtual daemon, allows you to use metasploitpayloads • Fast Exploit: can use tools to within w3af to perfrom exploit, example SQLMap • Command Shell: Ala metasploit integration.
More on Tools Proxies Menu: Metasploit Menu:
Fuzzing – What is? • Fuzz testing or fuzzing is a software testing technique that provides invalid, unexpected, or random data to the inputs of a program. If the program fails (for example, by crashing or failing built-in code assertions), the defects can be noted. - wikipedia
Documentation available OWASP Documents Testing Guide v2 & v3 CLASP Top 10 for 2007 (2010 to be included) Top 10 for Java Enterprise Edition AppSec FAQ Books CLASP, Top 10 2007, Top 10 + Testing + Legal, WebGoat and Web Scarab, Guide 2.0, Code Review Others WASC Threat Classification, OSTTMM 3.0 & 2.2
Support Modules OWASP Branding Module Subversion client JRE 6 update 6 Python 2.5.2 Ruby 1.8.1 Graphviz tidy GnuTLS wget, host, dig, openssl, grep, whois
Builder vs Breaker Builder is where the ROI is But …..breaking is really fun.Builder tools coming in future releases. (Thanks Top Gear!)
A little bit of code review Code review Metrics
A little bit on code review Transactional Analysis
Crawling Code Risk Based Approach Http Request Strings Requests from external sources are obviously a key area of a security code review. We need to ensure that all HTTP requests received are data validated for composition, max and min length, and if the data falls with the realms of the parameter white-list. Bottom-line is this is a key area to look at and ensure security is enabled. request.accepttypes request.browser request.files request.headers request.httpmethod request.item request.querystring request.form request.cookies HTML Output Here we are looking for responses to the client. Responses which go unvalidated or which echo external input without data validation are key areas to examine. Many client side attacks result from poor response validation. XSS relies on this somewhat. response.write <% = HttpUtility HtmlEncode request.certificate request.rawurl request.servervariables request.url request.urlreferrer request.useragent request.userlanguages request.IsSecureConnection request.TotalBytes request.BinaryRead
A little bit of code review Scope-Context-Surface • Data/Input Validation of data from all untrusted sources. • Authentication • Session Management • Authorization • Cryptography (Data at rest and in transit) • Error Handling /Information Leakage • Logging /Auditing • Secure Code Environment • Browser input • Cookies • Property files • External processes • Data feeds • Service responses • Flat files • Command line parameters • Environment variables
A little bit of code review Defining Risk
OWASP Education Project Natural ties between these projects Already being used for training classes Need to coordinate efforts to make sure critical pieces aren't missing from the OWASP Live CD Training environment could be customized for a particular class thanks to the individual modules Student gets to take the environment home As more modules come online, even more potential for cross pollination Builder tools/docs only expand its reach Kiosk mode?
How can you get involved? Join the mail list Announcements are there – low traffic Download an ISO or VM Complain or praise Suggest improvements Submit a bug to the Google Code site Create deb package of a tool How I create the debs will be documented, command by command and I'll answer questions gladly Suggest missing docs or links Do a screencast of one of the tools being used on the OWASP Live CD
What else is out there? LabRat v2.1 (Previous OWASP Live CD) 404 for ISO link Samurai WTF (Web Testing Framework) Slightly fewer tools overall Unique to Samurai: WebShag & MoinMoin Wiki Ubuntu based live CD, looks really nice No .deb packages for most of the tools Currently development release http://samurai.intelguardians.com/ Login info is samurai / samurai Backtrack – has some web app tools
Learn More OWASP Site:http://www.owasp.org/index.php/Category:OWASP_Live_CD_Projector just look on the OWASP project page (release quality)http://www.owasp.org/index.php/Category:OWASP_Projector Google “OWASP Live CD” Download & Community Site:http://AppSecLive.org