AppSec Europe 2014

1. Re-thinking the concept of OWASP University Supporter
2. Expand the concept of the OWASP Student Chapters.
3. Establish and expand the OWASP University Challenge. 
4. Suggested application security curriculum.
5. Discuss and establish the concept of OWASP Academic Advocate.
6. Promote participation of OWASP projects into the Google Summer of Code program

2. Project overview, goals and objectives.

3. Review of challenges faced by the team, case studies.

4. Brainstorming session on what should be the focus of our efforts.

5. Identify what needs to be secured.

• 
  Insecure file storage
  
  


• 
  Keychain attacks
  
  


• 
  Insecure transport security
  
  


• 
  Run-time attacks
  
  


• 
  Cycript
  
  


• 
  Injection attacks
  
  


• 
  IPC handlers
  
  


• 
  Man-in-the-middle attacks
  
  


• 
  Defeating jailbreak and other defensive detection and prevention routines
  
  Attendees will gain theoretical and practical experience of:
  
  

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in iOS Apps
  
  


• 
  How to hack UIWebviews, IPC handlers, client-side SQL databases, the
  
  keychain and the App runtime
  
  


• 
  Real-world, 2014 techniques used to defeat real Apps on iOS7!
  
  


• Knowledge of defensive and remedial advice

• 
  Theory
  
  


• 
  Introduction to the Android security model
  
  


• 
  Black box assessment approach
  
  


• 
  Reverse engineering applications
  
  


• 
  Introduction to Android malware
  
  


• 
  Android Man-in-the-Middle
  
  


• 
  Stolen device reviews
  
  


• 
  Analysis/Assessment/Attack and Defence
  
  


• 
  IPC end points
  
  


• 
  JavaScript Bridges
  
  


• 
  Mobile Substrate
  
  


• 
  File permission attacks
  
  


• 
  Tap jacking
  
  


• 
  Android Sandbox 
  
  

• OWASP Top-10 and OWASP projects - how to use within your organisation


• Risk management and threat modelling methods (OWASP risk analysis, ISO-27005,...)


• Benchmarking & Maturity Models


• Security Strategy


• Organisational Design and managing change for global information security programs


• SDLC


• Training: OWASP Secure Coding Practices - Quick Reference Guide, Development Guide, Training tools for developers


• Measuring & Verification: ASVS (Application Security Verification Standard) Project, Code Review Guide, Testing Guide


• Development & Operation: Libraries and Frameworks (ESAPI (Enterprise Security API), AppSensor, ...), Threat assessments using OWASP Cornucopia

• how to effectively build and run a global information security function


• strengthening web and application security using OWASP projects


• improving web & application security for organisations from green-field level to very sophisticated security organisations 

• 
  Introduction to Web Application Security Assessment (Chapters 1-3)
  
  


• 
  Automating Bespoke Attacks: Practical hands-on experience with Burp
  
  Suite (Chapter 13)
  
  


• 
  Application mapping and bypassing client-side controls (Chapters 4-5)
  
  


• 
  Failures in Core Defense Mechanisms: Authentication, Session
  
  Management, Access Control, Input Validation (Chapters 6-8)
  
  


• 
  Injection and API flaws: (Chapters 9-10)
  
  


• User-to-User Attacks (Chapters 12-13)

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in web applications
  
  


• 
  How to hack using LDAP, XPath, SOAP, HTTP Parameter Pollution (HPP), and HPI
  
  


• 
  Real-world, 2012 techniques in SQL Injection against Oracle, MySQL and MSSQL
  
  


• 
  The real risk: how to turn XSS/CSRF vulnerabilities into full account compromise
  
  


• 
  Harnessing new technologies such as HTML5, NoSQL, and Ajax
  
  


• 
  New attack types and techniques: Bit Flipping, Padding Oracle, Automated
  
  Access Control checking
  
  


• How to immediately recognise and exploit Logic Flaws

• Understand the problem of Injection Flaws 


• Learn a variety of advanced exploitation techniques which hackers use 


• learn how to fix these problems 

• 
  checking for special SSL settings
  
  


• 
  check multiple servers at a time
  
  


• 
  customizing the results
  
  


• 
  using private SSL-libraries
  
  


• 
  customizing o-saft itself
  
  


• or simple debugging of various SSL connection problems.

• 
  openssl (1.0.1e or newer)
  
  


• 
  perl (5.8 or newer), on windows system Strawberry perl is recommended
  
  


• 
  Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
  
  

1. Collect a number of bad coding examples to show readers code they should avoid writing.
2. Collect a number of good coding examples to show readers how security code should be written.
3. Collect the above for Java, PHP and C# languages, plus possibly C/C++, Ruby, Python, Perl, etc.. 
4. Raise awareness of the ongoing Code Review Guide and encourage OWASP members to participate in the project.

• 
  Insecure file storage
  
  


• 
  Keychain attacks
  
  


• 
  Insecure transport security
  
  


• 
  Run-time attacks
  
  


• 
  Cycript
  
  


• 
  Injection attacks
  
  


• 
  IPC handlers
  
  


• 
  Man-in-the-middle attacks
  
  


• 
  Defeating jailbreak and other defensive detection and prevention routines
  
  Attendees will gain theoretical and practical experience of:
  
  

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in iOS Apps
  
  


• 
  How to hack UIWebviews, IPC handlers, client-side SQL databases, the
  
  keychain and the App runtime
  
  


• 
  Real-world, 2014 techniques used to defeat real Apps on iOS7!
  
  


• Knowledge of defensive and remedial advice

• 
  Theory
  
  


• 
  Introduction to the Android security model
  
  


• 
  Black box assessment approach
  
  


• 
  Reverse engineering applications
  
  


• 
  Introduction to Android malware
  
  


• 
  Android Man-in-the-Middle
  
  


• 
  Stolen device reviews
  
  


• 
  Analysis/Assessment/Attack and Defence
  
  


• 
  IPC end points
  
  


• 
  JavaScript Bridges
  
  


• 
  Mobile Substrate
  
  


• 
  File permission attacks
  
  


• 
  Tap jacking
  
  


• 
  Android Sandbox 
  
  

• OWASP Top-10 and OWASP projects - how to use within your organisation


• Risk management and threat modelling methods (OWASP risk analysis, ISO-27005,...)


• Benchmarking & Maturity Models


• Security Strategy


• Organisational Design and managing change for global information security programs


• SDLC


• Training: OWASP Secure Coding Practices - Quick Reference Guide, Development Guide, Training tools for developers


• Measuring & Verification: ASVS (Application Security Verification Standard) Project, Code Review Guide, Testing Guide


• Development & Operation: Libraries and Frameworks (ESAPI (Enterprise Security API), AppSensor, ...), Threat assessments using OWASP Cornucopia

• how to effectively build and run a global information security function


• strengthening web and application security using OWASP projects


• improving web & application security for organisations from green-field level to very sophisticated security organisations 

• 
  Introduction to Web Application Security Assessment (Chapters 1-3)
  
  


• 
  Automating Bespoke Attacks: Practical hands-on experience with Burp
  
  Suite (Chapter 13)
  
  


• 
  Application mapping and bypassing client-side controls (Chapters 4-5)
  
  


• 
  Failures in Core Defense Mechanisms: Authentication, Session
  
  Management, Access Control, Input Validation (Chapters 6-8)
  
  


• 
  Injection and API flaws: (Chapters 9-10)
  
  


• User-to-User Attacks (Chapters 12-13)

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in web applications
  
  


• 
  How to hack using LDAP, XPath, SOAP, HTTP Parameter Pollution (HPP), and HPI
  
  


• 
  Real-world, 2012 techniques in SQL Injection against Oracle, MySQL and MSSQL
  
  


• 
  The real risk: how to turn XSS/CSRF vulnerabilities into full account compromise
  
  


• 
  Harnessing new technologies such as HTML5, NoSQL, and Ajax
  
  


• 
  New attack types and techniques: Bit Flipping, Padding Oracle, Automated
  
  Access Control checking
  
  


• How to immediately recognise and exploit Logic Flaws

• Understand the problem of Injection Flaws 


• Learn a variety of advanced exploitation techniques which hackers use 


• learn how to fix these problems 

• 
  checking for special SSL settings
  
  


• 
  check multiple servers at a time
  
  


• 
  customizing the results
  
  


• 
  using private SSL-libraries
  
  


• 
  customizing o-saft itself
  
  


• or simple debugging of various SSL connection problems.

• 
  openssl (1.0.1e or newer)
  
  


• 
  perl (5.8 or newer), on windows system Strawberry perl is recommended
  
  


• 
  Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
  
  

Understanding of SAMM is a prerequisite for participation in this OWASP summit session.

Please check PDF file for location 

1. Present the official OWASP YouTube channel
2. Involve project leaders to promote their content

• 
  Insecure file storage
  
  


• 
  Keychain attacks
  
  


• 
  Insecure transport security
  
  


• 
  Run-time attacks
  
  


• 
  Cycript
  
  


• 
  Injection attacks
  
  


• 
  IPC handlers
  
  


• 
  Man-in-the-middle attacks
  
  


• 
  Defeating jailbreak and other defensive detection and prevention routines
  
  Attendees will gain theoretical and practical experience of:
  
  

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in iOS Apps
  
  


• 
  How to hack UIWebviews, IPC handlers, client-side SQL databases, the
  
  keychain and the App runtime
  
  


• 
  Real-world, 2014 techniques used to defeat real Apps on iOS7!
  
  


• Knowledge of defensive and remedial advice

• 
  Theory
  
  


• 
  Introduction to the Android security model
  
  


• 
  Black box assessment approach
  
  


• 
  Reverse engineering applications
  
  


• 
  Introduction to Android malware
  
  


• 
  Android Man-in-the-Middle
  
  


• 
  Stolen device reviews
  
  


• 
  Analysis/Assessment/Attack and Defence
  
  


• 
  IPC end points
  
  


• 
  JavaScript Bridges
  
  


• 
  Mobile Substrate
  
  


• 
  File permission attacks
  
  


• 
  Tap jacking
  
  


• 
  Android Sandbox 
  
  

• 
  Introduction to Web Application Security Assessment (Chapters 1-3)
  
  


• 
  Automating Bespoke Attacks: Practical hands-on experience with Burp
  
  Suite (Chapter 13)
  
  


• 
  Application mapping and bypassing client-side controls (Chapters 4-5)
  
  


• 
  Failures in Core Defense Mechanisms: Authentication, Session
  
  Management, Access Control, Input Validation (Chapters 6-8)
  
  


• 
  Injection and API flaws: (Chapters 9-10)
  
  


• User-to-User Attacks (Chapters 12-13)

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in web applications
  
  


• 
  How to hack using LDAP, XPath, SOAP, HTTP Parameter Pollution (HPP), and HPI
  
  


• 
  Real-world, 2012 techniques in SQL Injection against Oracle, MySQL and MSSQL
  
  


• 
  The real risk: how to turn XSS/CSRF vulnerabilities into full account compromise
  
  


• 
  Harnessing new technologies such as HTML5, NoSQL, and Ajax
  
  


• 
  New attack types and techniques: Bit Flipping, Padding Oracle, Automated
  
  Access Control checking
  
  


• How to immediately recognise and exploit Logic Flaws

• Understand the problem of Injection Flaws 


• Learn a variety of advanced exploitation techniques which hackers use 


• learn how to fix these problems 

• 
  XML Schema and WS-Policy
  
  


• 
  WS-Addressing und WS-Addressing Spoofing
  
  


• 
  XML Parsing (DOM vs SAX)
  
  


• 
  XML-specific Denial-of-Service Attacks
  
  


• 
  XML Security and WS-Security
  
  ◦ Why not SSL/TLS?
  
  


• 
  XML Signature
  
  ◦ ID-based and XPath-based XML Signatures
  
  ◦ XMLSignatureWrappingAttacks
  
  


• 
  XML Encryption
  
  ◦ Attacks on symmetric encryption
  
  ◦ Attacks on asymmetric encryption
  
  


• 
  WS-Attacker
  
  


• 
  SAML-based Single-Sign On
  
  ◦ Attacks 
  
  

• 
  A laptop with a recent version of “Virtual Box“ (the virtual machine will be provided). VMWare and other virtualization software should also work but cannot be supported. 
  
  

• 
  PHP Platform Security
  
  


• 
  The PHP Application Risk Landscape
  
  


• 
  Secure Design Principles
  
  


• 
  Defensive Programming Techniques in PHP
  
  


• Secure PHP Architecture and Configuration

• 
  Comprehend the PHP Platform
  
  


• 
  Appreciate the Risks Affecting PHP Applications
  
  


• 
  Write Secure Web Applications Using PHP
  
  


• 
  Design and Architect Secure PHP Applications
  
  


• Configure Your PHP Applications Securely

• 
  Insecure file storage
  
  


• 
  Keychain attacks
  
  


• 
  Insecure transport security
  
  


• 
  Run-time attacks
  
  


• 
  Cycript
  
  


• 
  Injection attacks
  
  


• 
  IPC handlers
  
  


• 
  Man-in-the-middle attacks
  
  


• 
  Defeating jailbreak and other defensive detection and prevention routines
  
  Attendees will gain theoretical and practical experience of:
  
  

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in iOS Apps
  
  


• 
  How to hack UIWebviews, IPC handlers, client-side SQL databases, the
  
  keychain and the App runtime
  
  


• 
  Real-world, 2014 techniques used to defeat real Apps on iOS7!
  
  


• Knowledge of defensive and remedial advice

• 
  Theory
  
  


• 
  Introduction to the Android security model
  
  


• 
  Black box assessment approach
  
  


• 
  Reverse engineering applications
  
  


• 
  Introduction to Android malware
  
  


• 
  Android Man-in-the-Middle
  
  


• 
  Stolen device reviews
  
  


• 
  Analysis/Assessment/Attack and Defence
  
  


• 
  IPC end points
  
  


• 
  JavaScript Bridges
  
  


• 
  Mobile Substrate
  
  


• 
  File permission attacks
  
  


• 
  Tap jacking
  
  


• 
  Android Sandbox 
  
  

• 
  Introduction to Web Application Security Assessment (Chapters 1-3)
  
  


• 
  Automating Bespoke Attacks: Practical hands-on experience with Burp
  
  Suite (Chapter 13)
  
  


• 
  Application mapping and bypassing client-side controls (Chapters 4-5)
  
  


• 
  Failures in Core Defense Mechanisms: Authentication, Session
  
  Management, Access Control, Input Validation (Chapters 6-8)
  
  


• 
  Injection and API flaws: (Chapters 9-10)
  
  


• User-to-User Attacks (Chapters 12-13)

• 
  How to quickly and efficiently pinpoint and exploit vulnerabilities in web applications
  
  


• 
  How to hack using LDAP, XPath, SOAP, HTTP Parameter Pollution (HPP), and HPI
  
  


• 
  Real-world, 2012 techniques in SQL Injection against Oracle, MySQL and MSSQL
  
  


• 
  The real risk: how to turn XSS/CSRF vulnerabilities into full account compromise
  
  


• 
  Harnessing new technologies such as HTML5, NoSQL, and Ajax
  
  


• 
  New attack types and techniques: Bit Flipping, Padding Oracle, Automated
  
  Access Control checking
  
  


• How to immediately recognise and exploit Logic Flaws

• Understand the problem of Injection Flaws 


• Learn a variety of advanced exploitation techniques which hackers use 


• learn how to fix these problems 

• 
  XML Schema and WS-Policy
  
  


• 
  WS-Addressing und WS-Addressing Spoofing
  
  


• 
  XML Parsing (DOM vs SAX)
  
  


• 
  XML-specific Denial-of-Service Attacks
  
  


• 
  XML Security and WS-Security
  
  ◦ Why not SSL/TLS?
  
  


• 
  XML Signature
  
  ◦ ID-based and XPath-based XML Signatures
  
  ◦ XMLSignatureWrappingAttacks
  
  


• 
  XML Encryption
  
  ◦ Attacks on symmetric encryption
  
  ◦ Attacks on asymmetric encryption
  
  


• 
  WS-Attacker
  
  


• 
  SAML-based Single-Sign On
  
  ◦ Attacks 
  
  

• 
  A laptop with a recent version of “Virtual Box“ (the virtual machine will be provided). VMWare and other virtualization software should also work but cannot be supported. 
  
  

• 
  PHP Platform Security
  
  


• 
  The PHP Application Risk Landscape
  
  


• 
  Secure Design Principles
  
  


• 
  Defensive Programming Techniques in PHP
  
  


• Secure PHP Architecture and Configuration

• 
  Comprehend the PHP Platform
  
  


• 
  Appreciate the Risks Affecting PHP Applications
  
  


• 
  Write Secure Web Applications Using PHP
  
  


• 
  Design and Architect Secure PHP Applications
  
  


• Configure Your PHP Applications Securely

OWASP NINJA-PingU is a high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin integration. For more information on OWASP NINJA-PingU, check out the project’s wiki page here: https://www.owasp.org/index.php/OWASP_NINJA_PingU_Project

OWASP PCI Toolkit is a c# Windows form project, that will help you to scope the PCI-DSS requirements for your System Components. Beta version of this tool will be released May 2014. The OWASP PCI Toolkit page can be found here: https://www.owasp.org/index.php/Category:OWASP_PCI_Project
 

Hackademic Challenges Project implements realistic scenarios with known vulnerabilities in a safe, controllable environment. Users can attempt to discover and exploit these vulnerabilities in order to learn important concepts of information security through the attacker's perspective. Currently, there are 10 web application security scenarios available. https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project

OWASP WTE is an enhancement of the original OWASP Live CD Project and expands the offering from a static Live CD ISO image to a collection of sub-projects. Its primary goal is to make application security tools and documentation easily available and easy to use. More information on the OWASP WTE project can be found here: https://www.owasp.org/index.php/OWASP_Web_Testing_Environment_Project

OWASP ZAP, or Zed Attack Proxy is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually. More information on OWASP ZAP can be found on the project page here: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

OWASP Bywaf, a web application penetration testing framework (WAPTF). It consists of a command-line interpreter and a set of plugins. More information on OWASP Bywaf can be found on the project’s wiki page here: https://www.owasp.org/index.php/OWASP_Bywaf_Project

Adversaries today are technically advanced, structured around an underground governed by market forces, and using paradigm shifts in technology to compromise more victims. We examine techniques for identifying, anonymizing, and sharing threat intelligence and discuss use cases ranging from DDOS to malware where this approach can speed response times and prevent breaches.

1. 
   The OWASP Global CTF 2013
   
   


2. 
   IRISScon 2013 Cyber Security Challenge
   
   


3. 
   The OWASP EU Tour 2013 Online CTF
   
   


4. 
   Source Conference CTF
   
   


5. 
   The OWASP LATAM 2013 Tour Online CTF
   
   


6. 
   The OWASP Ireland AppSec 2012 CTF
   
   

OWASP NINJA-PingU is a high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin integration. For more information on OWASP NINJA-PingU, check out the project’s wiki page here:https://www.owasp.org/index.php/OWASP_NINJA_PingU_Project

OWASP PCI Toolkit is a c# Windows form project, that will help you to scope the PCI-DSS requirements for your System Components. Beta version of this tool will be released May 2014. The OWASP PCI Toolkit page can be found here: https://www.owasp.org/index.php/Category:OWASP_PCI_Project

OWASP WTE is an enhancement of the original OWASP Live CD Project and expands the offering from a static Live CD ISO image to a collection of sub-projects. Its primary goal is to make application security tools and documentation easily available and easy to use. More information on the OWASP WTE project can be found here: https://www.owasp.org/index.php/OWASP_Web_Testing_Environment_Project

OWASP ZAP, or Zed Attack Proxy is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually. More information on OWASP ZAP can be found on the project page here:https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

ThreadFix is a software vulnerability aggregation and management system that helps organizations aggregate vulnerability data, generate virtual patches, and interact with software defect tracking systems. More information on the ThreadFix project can be found here: https://github.com/denimgroup/threadfix/

OWASP OWTF, the Offensive (Web) Testing Framework, is an OWASP+PTES-focused try to unite great tools and make pen testing more efficient. For more information about the OWASP OWTF Project, check out the project’s wiki page here: https://www.owasp.org/index.php/OWASP_OWTF

OWASP Python Security Project aims at creating a hardened version of python that makes it easier for security professionals and developers to write applications more resilient to attacks and manipulations. More information about the OWASP Python Security Project can be found here:https://www.owasp.org/index.php/OWASP_Python_Security_Project

WebGoatPHP is a deliberately insecure web application developed using PHP to teach web application security. It offers a set of challenges based on various vulnerabilities listed in OWASP. In each challenge the user must exploit the real vulnerability to demonstrate their understanding. The application is a realistic teaching environment and supports four different modes.This projetc is part of the PHP security framework, sponsored by Google Summer of Code 2014.Websites:

•  http://webgoatphp.com/  
• https://www.owasp.org/index.php/OWASP_PHP_Security_Project 

• 
  Looking for the same link on HTTP traffic (complementary to ModSecurity CRS rules)
  
  


• 
  Blocking traffic from within the organization to the attacker web application
  
  


• 
  Correlating similar attacks as same distributed attack campaign 
  
  

The history of anonymous communications on the Internet dates back to the early 80's but since then there have been dramatic changes in how anonymous communication systems have been built and how they have been used. In this talk I will describe some of these key changes, and what has motivated them. These include the web taking over from email as the major means of communications, and users of anonymous communication systems prioritising censorship-resistance over privacy. The growing popularity of anonymous communication systems has also led to commercial and political realities effecting how projects are run and software is designed. In particular, I will discuss how the Tor software has changed, and the Tor project evolved in this environment. I will conclude by summarising what might be the future for anonymous communication systems and how they may have to adapt themselves to changing circumstances.

• What is the optimal OpenSAMM maturity level for your organisation? 


• At which level to implement OpenSAMM in the organisation: at company, business unit or development team level? 


• How to integrate OpenSAMM activities in agile development? 


• How to apply OpenSAMM on suppliers or outsourced development? 


• What metrics does OpenSAMM provide to manage your secure development life cycle? 

• 
  How to effectively communicate and manage security requirements in such a dynamic environment?
  
  


• 
  How to perform rigorous security testing when software is deployed multiple times per day?
  
  


• How to integrate security processes into the existing continuous integration/deployment environments?

CSP is a valuable defence against XSS and other attacks on web applications. This talk provides an introduction to the technology, why it's needed, how it works and also provides some hints on overcoming a few of the challenges presented by using CSP in the real world.