[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [WEB SECURITY] RE: Environment for testing WebApp Security Scanners
- From: "Jeff Robertson" <jeff.robertson@xxxxxxxxxxxxxxxxxx>
- Subject: RE: [WEB SECURITY] RE: Environment for testing WebApp Security Scanners
- Date: Thu, 24 Aug 2006 08:09:08 -0400
------_=_NextPart_001_01C6C776.473386BD
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
"Real-life" programs meaning applications intended for actual use, not =
just for security benchmarking? Wouldn't you want to fix the vulns you =
find in those, thereby ruining their value as benchmarks?
-----Original Message-----
From: Enis Karaarslan [mailto:enis.karaarslan@ege.edu.tr]
Sent: Thu 8/24/2006 3:08 AM
To: Evans, Arian; rwp@gmx.de
Cc: websecurity@webappsec.org; webappsec@securityfocus.com
Subject: Re: [WEB SECURITY] RE: Environment for testing WebApp Security =
Scanners
=20
Hello all,
I am currently working on web/web application security issues in
enterprise networks as an academic study. I think, the fundamental =
problem
(especially in campus networks), there is usually no "network =
awareness".
In enterprise networks, hundreds of different web servers and different
web applications can be present, where usually nobody knows detailed =
info
about web servers and applications running on them.
Maybe most of you know,
For security testing environment there is Stanford Securibench, which is =
a
set of open source real-life programs to be used as a testing ground for
static and dynamic security tools. Release .91a focuses on Web-based
applications written in Java.
http://suif.stanford.edu/~livshits/securibench/
There are many web/ web application security scanners. If anyone =
intrested
in this subject and also for a joint work, s/he is always welcome.
Enis Karaarslan
Ege University
> I added the WASC list, since many folks there are sensitive
> to this same subject.
>
>> -----Original Message-----
>> From: Ren=E9 Palige [mailto:rwp@gmx.de]
>>
>> I?m currently working on my bachelor thesis which is about
>> the development of a testsuite for different Web Application
>> Security Scanners. My goal is to provide an environment
>
> This, I discovered, was very challenging. When I post the OWASP
> Tools v3, one section of it is going to be about my trials and
> tribulations, mistakes, misfires and general stupidity in trying
> to scientifically, systematically evaluate tools, which culminated
> in the HEWA2 book.
>
> No one has done a good job at this, most reviews are just plain
> crap (sorry, everyone, it's the truth; if there's a good review
> to defend please step up to the plate).
>
> I have been holding off releasing v3 (which is a narrative doc)
> until I can put it out for peer review before making a final,
> hard, PDF. (should I just post to the list and let everyone chime
> in?...I'm afraid to do this b/c some of it is _not_nice_) I hope
> someone will wikify the end product.
>
>>I?m planning to use OWASPs WebGoat as some kind of groundwork.
>
> Not bad, but you will need more. Unless your thesis is "how
> effectively do webappscanner vendors code to detect issues
> in WebGoat?"
>
>>Would it be best to focus on "real-life scenarios"?
>
> That's what I fell upon. It's a bit more realistic.
>
> You get no tautology from the scanner vendors. You get real
> use-case scenarios, and a story to tell.
>
>> Or rather to cover as many
>> aspects of a special class of vulnerabilities as possible?
>
> This, also, I tackled, and have an evolving-complexity XSS
> generator; I have a couple of types now and continue to add
> more as time permits, and it is use specifically to generate
> XSS-vuln pages of varying filter/encoding complexity.
>
> It really should be in SiteGenerator (owasp.net) but it helps
> me make sure I'm not misunderstanding something to force myself
> to write complicated mistakes out by hand. :)
>
> Maybe I'll just rip the scanner eval story and post just that.
>
> Very cool, we need some smart grad work here.
>
> Arian J. Evans
>
>
> =
-------------------------------------------------------------------------=
---
> The Web Security Mailing List:
> http://www.webappsec.org/lists/websecurity/
>
> The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/archive/
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
>
>
-------------------------------------------------------------------------=
---
The Web Security Mailing List:=20
http://www.webappsec.org/lists/websecurity/
The Web Security Mailing List Archives:=20
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
------_=_NextPart_001_01C6C776.473386BD
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.5.7650.28">
<TITLE>RE: [WEB SECURITY] RE: Environment for testing WebApp Security =
Scanners</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=3D2>"Real-life" programs meaning applications =
intended for actual use, not just for security benchmarking? Wouldn't =
you want to fix the vulns you find in those, thereby ruining their value =
as benchmarks?<BR>
<BR>
-----Original Message-----<BR>
From: Enis Karaarslan [<A =
HREF=3D"mailto:enis.karaarslan@ege.edu.tr";>mailto:enis.karaarslan@ege.edu=
.tr</A>]<BR>
Sent: Thu 8/24/2006 3:08 AM<BR>
To: Evans, Arian; rwp@gmx.de<BR>
Cc: websecurity@webappsec.org; webappsec@securityfocus.com<BR>
Subject: Re: [WEB SECURITY] RE: Environment for testing WebApp =
Security Scanners<BR>
<BR>
Hello all,<BR>
<BR>
I am currently working on web/web application security issues in<BR>
enterprise networks as an academic study. I think, the fundamental =
problem<BR>
(especially in campus networks), there is usually no "network =
awareness".<BR>
In enterprise networks, hundreds of different web servers and =
different<BR>
web applications can be present, where usually nobody knows detailed =
info<BR>
about web servers and applications running on them.<BR>
<BR>
Maybe most of you know,<BR>
For security testing environment there is Stanford Securibench, which is =
a<BR>
set of open source real-life programs to be used as a testing ground =
for<BR>
static and dynamic security tools. Release .91a focuses on Web-based<BR>
applications written in Java.<BR>
<A =
HREF=3D"http://suif.stanford.edu/~livshits/securibench/";>http://suif.stan=
ford.edu/~livshits/securibench/</A><BR>
<BR>
There are many web/ web application security scanners. If anyone =
intrested<BR>
in this subject and also for a joint work, s/he is always welcome.<BR>
<BR>
Enis Karaarslan<BR>
Ege University<BR>
<BR>
> I added the WASC list, since many folks there are sensitive<BR>
> to this same subject.<BR>
><BR>
>> -----Original Message-----<BR>
>> From: Ren=E9 Palige [<A =
HREF=3D"mailto:rwp@gmx.de";>mailto:rwp@gmx.de</A>]<BR>
>><BR>
>> I?m currently working on my bachelor thesis which is about<BR>
>> the development of a testsuite for different Web =
Application<BR>
>> Security Scanners. My goal is to provide an environment<BR>
><BR>
> This, I discovered, was very challenging. When I post the OWASP<BR>
> Tools v3, one section of it is going to be about my trials and<BR>
> tribulations, mistakes, misfires and general stupidity in =
trying<BR>
> to scientifically, systematically evaluate tools, which =
culminated<BR>
> in the HEWA2 book.<BR>
><BR>
> No one has done a good job at this, most reviews are just plain<BR>
> crap (sorry, everyone, it's the truth; if there's a good review<BR>
> to defend please step up to the plate).<BR>
><BR>
> I have been holding off releasing v3 (which is a narrative doc)<BR>
> until I can put it out for peer review before making a final,<BR>
> hard, PDF. (should I just post to the list and let everyone =
chime<BR>
> in?...I'm afraid to do this b/c some of it is _not_nice_) I =
hope<BR>
> someone will wikify the end product.<BR>
><BR>
>>I?m planning to use OWASPs WebGoat as some kind of =
groundwork.<BR>
><BR>
> Not bad, but you will need more. Unless your thesis is =
"how<BR>
> effectively do webappscanner vendors code to detect issues<BR>
> in WebGoat?"<BR>
><BR>
>>Would it be best to focus on "real-life =
scenarios"?<BR>
><BR>
> That's what I fell upon. It's a bit more realistic.<BR>
><BR>
> You get no tautology from the scanner vendors. You get real<BR>
> use-case scenarios, and a story to tell.<BR>
><BR>
>> Or rather to cover as many<BR>
>> aspects of a special class of vulnerabilities as possible?<BR>
><BR>
> This, also, I tackled, and have an evolving-complexity XSS<BR>
> generator; I have a couple of types now and continue to add<BR>
> more as time permits, and it is use specifically to generate<BR>
> XSS-vuln pages of varying filter/encoding complexity.<BR>
><BR>
> It really should be in SiteGenerator (owasp.net) but it helps<BR>
> me make sure I'm not misunderstanding something to force myself<BR>
> to write complicated mistakes out by hand. :)<BR>
><BR>
> Maybe I'll just rip the scanner eval story and post just that.<BR>
><BR>
> Very cool, we need some smart grad work here.<BR>
><BR>
> Arian J. Evans<BR>
><BR>
><BR>
> =
-------------------------------------------------------------------------=
---<BR>
> The Web Security Mailing List:<BR>
> <A =
HREF=3D"http://www.webappsec.org/lists/websecurity/";>http://www.webappsec=
.org/lists/websecurity/</A><BR>
><BR>
> The Web Security Mailing List Archives:<BR>
> <A =
HREF=3D"http://www.webappsec.org/lists/websecurity/archive/";>http://www.w=
ebappsec.org/lists/websecurity/archive/</A><BR>
> <A =
HREF=3D"http://www.webappsec.org/rss/websecurity.rss";>http://www.webappse=
c.org/rss/websecurity.rss</A> [RSS Feed]<BR>
><BR>
><BR>
<BR>
<BR>
<BR>
<BR>
-------------------------------------------------------------------------=
---<BR>
The Web Security Mailing List:<BR>
<A =
HREF=3D"http://www.webappsec.org/lists/websecurity/";>http://www.webappsec=
.org/lists/websecurity/</A><BR>
<BR>
The Web Security Mailing List Archives:<BR>
<A =
HREF=3D"http://www.webappsec.org/lists/websecurity/archive/";>http://www.w=
ebappsec.org/lists/websecurity/archive/</A><BR>
<A =
HREF=3D"http://www.webappsec.org/rss/websecurity.rss";>http://www.webappse=
c.org/rss/websecurity.rss</A> [RSS Feed]<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>
------_=_NextPart_001_01C6C776.473386BD--
Brought to you by http://www.webappsec.org
Search this site
|