OWASP Projects Dashboard 2.0
From OWASP
Main
| Projects Using Template 2.0 | Templates 2.0 | Project Reviews' Dashboard 2.0 | Project Reviewers' Database | Assessment Criteria v2.0 |
| Projects Modules & Training |
| Projects Main Page | |
| Orphaned Projects | Inactives |
| OWASP Project Inventory | |
| OWASP Global Projects Committee's Blog |
| OWASP Project Manager Activity Reports |
| Projects Still Using Template 1.0 | Templates 1.0 | Assessment Criteria v1.0 |
Projects 2.0/By Set Up Date Order [Contributors]
Projects 2.0/By Alphabetic Order [Purpose]
| Project | Purpose |
| OWASP Academy Portal Project | Creation of a Portal to offer academic material in usable blocks, lab's, video's and forum. |
| OWASP Alchemist Project | Alchemist enables a software development team in realization of highly secure and defensible application with built-in defenses/controls against security‐related design, coding and implementation flaws.
Alchemist is focused to present this solution by architecting a real-life high stakes application with security built into it right from the inception, step-by-step as it falls under an SDLC. The current exercise is targeted at demonstrating this on a J2EE based web application that is developed using Spring framework. Spring framework was chosen due to its widespread adoption in the financial products. However, it is important note that Alchemist is not limited to J2EE or more specifically Spring framework. The idea is to demonstrate the upper spectrum of security practices that are often neglected or are done in bits and pieces by picking a well known widely adopted technology. Since the emphasis is on security architecture and defensibility, the future road-map is to demonstrate the same for applications built using other leading programming languages and frameworks. Although this project is more than useful for existing/already developed applications, Alchemist is not the ideal solution to retrofit security into existing applications. It is aimed at offering more to applications that are at least in development, most in design phase. Allowing for language-specific differences, Alchemist builds this application with a strong foundation of security architecture that covers following main practices:
|
| OWASP Application Security Assessment Standards Project | *The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed and what level of assessment is appropriate based on business requirement.
|
| OWASP Application Security Program for Manager | *Create an OWASP Roadmap for the world wide Companies Type
|
| OWASP Application Security Skills Assessment | The OWASP Application Security Skills Assessment (OWASP ASSA) is an online multiple-choice quiz built to help individuals understand their strengths and weaknesses in specific application security skills with the aim of enabling them to focus their training in the most efficient and appropriate manner.
Upon completion of the quiz, for each question, it will tell the quiz taker whether they had the correct or incorrect answer, a discussion of the question, the specific application security areas the question focused on, a discussion about the correct an incorrect answers, and links to further references. |
| OWASP Application Security Verification Standard Project | The primary aim of the OWASP Application Security Verification Standard (ASVS) Project is to normalize the range in the coverage and level of rigour available in the market when it comes to performing Web application security verification using a commercially-workable open standard. The standard provides a basis for testing application technical security controls, as well as any technical security controls in the environment, that are relied on to protect against vulnerabilities such as Cross-Site Scripting (XSS) and SQL injection. This standard can be used to establish a level of confidence in the security of Web applications. The requirements were developed with the following objectives in mind:
|
| OWASP Application Security Requirements Project | *The intent of this project is to assemble a useful base of generic/common web application security requirements that could be used in most projects.
|
| OWASP AppSensor Project | Real Time Application Attack Detection and Response
Overview
The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into an existing application. Current efforts are underway to create the AppSensor tool which can be utilized by any existing application interested in adding detection and response capabilities.
|
| OWASP ASIDE Project | ASIDE is an abbreviation for Assured Software Integrated Development Environment. It is an Eclipse Plugin which is a software tool primarily designed to help students write more secure code by detecting and identifying potentially vulnerable code and providing informative fixes during the construction of programs in IDEs. ASIDE may be useful by professional developers as well. |
| OWASP Best Practices: Use of Web Application Firewalls | Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself - and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. |
| OWASP Browser Security ACID Tests Project | |
| OWASP Browser Security Project | |
| OWASP Cheat Sheets Project | This project was created to provide a concise collection of high value information on specific security topics. These cheat sheets were created by multiple application security experts and provide excellent security guidance in an easy to read format. |
| OWASP Cloud ‐ 10 Project | Goal of the project is to maintain a list of top 10 security risks faced with the Cloud Computing and SaaS Models. List will be maintained by input from community, security experts and security incidences at cloud/SaaS providers. |
| OWASP Codes of Conduct | To create and maintain OWASP Codes of Conduct. In order to achieve our mission, OWASP needs to take advantage of every opportunity to affect software development everywhere. At the OWASP Summit 2011 in Portugal, the idea was created to try to influence educational institutions, government bodies, standards groups, and trade organizations. We set out to define a set of minimal requirements for these organizations specifying what we believe to be the most effective ways to support our mission. We call these requirements a “code of conduct” to imply that these are normative standards, they represent a minimum baseline, and that they are not difficult to achieve. |
| The OWASP "Green Book" | This effort envisages to create and maintain The OWASP Application Security Code of Conduct for Government Bodies/The OWASP "Green Book". |
| The OWASP "Blue Book" | This effort envisages to create and maintain The OWASP Application Security Code of Conduct for Educational Institutions/The OWASP "Blue Book". |
| The OWASP "Yellow Book" | This effort envisages to create and maintain The OWASP Application Security Code of Conduct for Standards Groups/The OWASP "Yellow Book". |
| The OWASP "Purple Book" | This effort envisages to create and maintain The OWASP Application Security Code of Conduct for Trade Organizations/The OWASP "Purple Book". |
| The OWASP "Red Book" | This effort envisages to create and maintain The OWASP Application Security Code of Conduct for Certifying Bodies/The OWASP "Red Book". |
| OWASP Code Review Project | The code review guide is currently at release version 1.1 and the second best selling OWASP book in 2008. Many positive comments have been feedback regarding this initial version and believe it’s a key enabler for the OWASP fight against software insecurity. It has even inspired individuals to build tools based on its information. The combination of a book on secure code review and tools to support such an activity is very powerful as it gives the developer community a place to start regarding secure application development.
Going forward I hope to further integrate with the ASVS and other guides such as the testing and ASDR guides shall be perfromed for version 2.0. |
| OWASP Common Numbering Project | An exciting development, a new numbering scheme that will be common across OWASP Guides and References is being developed. The numbering is loosely based on the OWASP ASVS section and detailed requirement numbering. OWASP ASVS, Guide, and Reference project leads and contributors as well as the OWASP leadership plan to work together to develop numbering that would allow for easy mapping between OWASP Guides and References, and that would allow for a period of transition as Guides and References are updated to reflect the new numbering. This project will provide a centralized clearinghouse for mapping information. |
| OWASP CTF Project | The purpose of this Project is to create a competitive environment which can be used at conferences and to have fun and teach in a playful way the various mistakes which are made in regards to web applications. |
| OWASP Data Exchange Format Project | To define an open format for exchanging data between pentest tools. |
| OWASP Development Guide | The Development Guide provides practical guidance and includes J2EE, ASP.NET, and PHP code samples. The Development Guide covers an extensive array of application-level security issues, from SQL injection through modern concerns such as phishing, credit card handling, session fixation, cross-site request forgeries, compliance, and privacy issues. |
| OWASP Enterprise Application Security Project | Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guideline for EA security assessment. |
| OWASP ESAPI Objective - C Project | The OWASP ESAPI Objective-C is the Objective-C (Cocoa) implementation of ESAPI.
|
| OWASP ESAPI C++ Project | This is the C++ language version of the OWASP ESAPI.
|
| OWASP ESAPI C Project | This is the C language version of the OWASP ESAPI.
|
| OWASP ESAPI for ColdFusion/CFML Project | This is the ColdFusion/CFML language version of OWASP ESAPI.
|
| OWASP ESAPI Perl Project | Provides a Perl implementation of the OWASP Enterprise Security API. Once the major components have been written, this will be released on CPAN. |
| Owasp Esapi Ruby | The Owasp Esapi Ruby is a port for outstanding release quality Owasp Esapi project to the Ruby programming language. The idea is to build a Ruby gem (the standard ruby library archive format) containing the Esapi concepts implemented in Ruby classes so people using Ruby in their Rails application can have security into them. |
| OWASP ESAPI Swingset Demo Project | The ESAPI Swingset DEMO is a web application which demonstrates the many uses of the Enterprise Security API (ESAPI) |
| OWASP ESAPI Swingset Interactive Project | *This a web application which demonstrates common security vulnerabilities and asks users to secure the application against these vulnerabilities using the ESAPI library.
|
| OWASP Enhancing Security Options Framework (ESOP Framework) | Purpose of the framework is to provide a security layer to a given web application / web site via web service which can use the functions / modules to protect the site from following vulnerabilities:
|
| OWASP Exams Project | The OWASP Exams project will establish the model by which the OWASP community can create and distribute CC-licensed exams for use by educators. The purpose of the exams is to improve the effectiveness of OWASP training through the use of exams as a means of measurement and student progress tracking. The project will include creation of a set of CC-licensed exams, a model for exam usage, and a roadmap for future exam creation.
The exams may be distributed either in text format as well as in Moodle (an open source LMS) format so that they can be re-purposed for use in any system or an educator can use them directly in Moodle to administer exams to students. Ideally the exams will be tied to OWASP Academies learning blocks so that there is good learning and training content that can be used to motivate the usage of the exams. |
| OWASP Forward Exploit Tool Project | This projects aims to develop a tool to exploit Top 10 2010 - A10 - Unvalidated Forward vulnerability to bypass access control to protected Java application files (config, binary -source code, etc.). It aims also to automate the download of known files in Java Web applications. |
| OWASP German Language Project | |
| OWASP GoatDroid Project | *The OWASP GoatDroid Project pays homage to the OWASP WebGoat Project. It is a fully functional and self-contained environment for learning more about vulnerabilities and security issues for the Android platform.
|
| OWASP Hackademic Challenges Project | *The Hackademic Challenges is an open source project that can be used to test and improve one's knowledge of web application security.
|
| OWASP Hatkit Datafiddler Project | *The Datafiddler is a tool for performing advanced analysis of http traffic. It currently consists of two main views, one table-based and one tree-based. These views allow the user to study different aspects of the http traffic, with very high degree of configurability. The tool is also meant to be a framework which can utilize existing tools to analyze traffic post mortem (or real-time).
|
| OWASP Hatkit Proxy Project | *The Hatkit Proxy is an intercepting http/tcp proxy based on the Owasp Proxy, but with several additions. These additions are:
|
| HTMLReg | Converts malicious HTML/CSS into a safe form of HTML. |
| OWASP HTTP Post Tool | A tool for the purpose of performing web application security assessment around the availability concerns. |
| OWASP iGoat Project | The iGoat project aims to be a developer learning environment for iOS app developers. It was inspired by the OWASP WebGoat project in particular the developer edition of WebGoat.
Similar to WebGoat (developer), the user is presented with a series of lessons surrounding numerous vulnerabilities associated with iOS apps. The student exploits each vulnerability to validate its existence, and then he implements a remediation in the lesson's source code. Further, iGoat is designed and implemented modularly, similar conceptually to WebGoat's modular Java EE servlet model. It is intended to provide a foundational framework to build lessons on top of, starting with a core set of lessons provided in the first release. |
| OWASP JavaScript Sandboxes | To produce a simplified version of Javascript by using regular expressions to remove dangerous functionality and then use Javascript itself to evaluate the results. The goal is to allow normal web users to safely code javascript on a site without exposing sensitive information. This project has three 'sub'-projects: OWSP JSReg + OWASP HTMLReg + OWASP CSSReg.
MainWelcome to the OWASP Java Encoder Project Contextual Output Encoding is a computer programming technique necessary to stop [Cross Site Scripting]. This project is a Java 1.5 simple-to-use drop-in high-performance encoder class with little baggage. |
| OWASP Java Encoder Project | *This project is a simple-to-use drop-in encoder class with little baggage.
Use the Java Encoder ProjectThe general API pattern to utilize the Java Encoder Project is "Encode.forContextName(untrustedData)", where "ContextName" is the name of the target context and "untrustedData" in untrusted user input. For example, to use in a JSP<input type="text" name="data" value="<%= Encode.forHtmlAttribute(dataValue) %>" /> <textarea name="text"><%= Encode.forHtmlContent(textValue) %>" /> Generally Encode.forHtml(...) is safe but slightly less efficient for the above two contexts (since it encodes more characters than necessary). For JavaScript string data<button onclick="alert('<%= Encode.forJavaScriptAttribute(alertMsg) %>');">click me</button> <script type="text/javascript"> var msg = "<%= Encode.forJavaScriptBlock(message) %>"; alert(msg); </script> Again generally Encode.forJavaScript is safe for the above two context, but slightly less efficient since it encodes more characters. Other ContextsOther contexts can be found in the org.owasp.Encode class methods, including CSS strings, CSS urls, XML contexts, URIs and URI components. Build the Java Encoder Projectcheckout and run "mvn package" (using maven 2.0 or 3.0) |
| OWASP Java Project | The OWASP Java Project's goal is to enable Java and J2EE developers to build secure applications efficiently. |
| OWASP Java XML Templates Project | JXT is a fast and secure XHTML-compliant template language that runs on a model similar to JSP. JXT provides automatic context-aware encoding of data to make it easy to avoid OWASP Top Ten Project #2 web-application security risks Cross-site Scripting.
By providing automatic context aware escaping, JXT relieves the developer of having to think through the various contexts and appropriate escaping method required--allowing them to focus on coding the application. It also helps make the application more robust--it is easy to forget an escape after late night coding sessions after long hours. An additional benefit, perhaps not obvious at first, is that the automatic escaping provides for shorter syntax, and thus more readable code. |
| OWASP JBroFuzz Project | JBroFuzz is a stateless web application fuzzer for requests being made over HTTP and/or HTTPS. Its purpose is to provide a single, portable application that offers stable web protocol fuzzing capabilities. As a tool, it emerged from the needs of penetration testing. |
| JSReg | JSReg is a Javascript sandbox which converts code using regular expressions. |
| OWASP LAPSE Project | LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java EE Applications for common types of security vulnerabilities found in Web Applications. LAPSE was developed by Benjamin Livshits as part of the Griffin Software Security Project. The project's second push is being led by Pablo Martín Pérez, Evalues Lab ICT Security Researcher, developing LAPSE+, an enhanced version of LAPSE. |
| OWASP Mantra - Security Framework | Mantra is a security framework which can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges,maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks. |
| OWASP Mobile Security Project | Our primary focus is at the application layer. While we take into consideration the underlying mobile platform and carrier inherent risks when threat modeling and building controls, we are targeting the areas that the average developer can make a difference. Additionally, we focus not only on the mobile applications deployed to end user devices, but also on the broader server-side infrastructure which the mobile apps communicate with. We focus heavily on the integration between the mobile application, remote authentication services, and cloud platform-specific features. |
| OWASP Mobile Security Project - Mobile Threat Model | |
| OWASP ModSecurity Core Rule Set Project | ModSecurity is an Apache web server module that provides a web application firewall engine. The ModSecurity Rules Language engine is extrememly flexible and robust and has been referred to as the "Swiss Army Knife of web application firewalls." While this is certainly true, it doesn't do much implicitly on its own and requires rules to tell it what to do. In order to enable users to take full advantage of ModSecurity out of the box, we have developed the Core Rule Set (CRS) which provides critical protections against attacks across most every web architecture.
Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the CRS is based on generic rules which focus on attack payload identification in order to provide protection from zero day and unknown vulnerabilities often found in web applications, which are in most cases custom coded. |
| OWASP Myth Breakers Project | Similar to http://dsc.discovery.com/tv/mythbusters but for appsec, urban legends and assumptions regarding appsec will be tested and there'll be a set of examples that will prove the correctness/incorrectness of a statement related to the question. Every question will be answered in the mailing list and further, a page on the OWASP site will be created to report the results. Also anyone will be able to use the contents of the page/ml in OWASP conferences to spread the verb about what's an urban legend and what's not”. |
| OWASP NAXSI Project | *Naxsi (Nginx Anti Xss Sql Injection) is an open source, high performance, low rules maintenance, Web Application Firewall module for Nginx, the infamous web server and reverse-proxy.
|
| Opa | Usher in a new generation of web development tools and methodologies. |
| OWASP Open Review Project | *The OWASP Open Review Project (ORPRO) is a project to openly check open source libraries and software that are vital to most commercial and non-commercial apps around.
|
| OWASP OVAL Content Project | *The purpose of this project is to create OVAL content to enable any OVAL compatible tool find security issues which can be represented in a standard format.
|
| OWASP O2 Platform Project | Collection of Open Source modules that help Web Application Security Professionals to maximize their efforts and quickly obtain high visibility into an application's security profile.
NOTE: most of the O2 Platform content is still on the external website |
| OWASP Passw3rd Project | Store passwords in encrypted files with an easy to use command line interface, and utilities to use the passwords in code. In its simplest form, the keys are generated per environment with OS access controls while the password files are stored in SCM. |
| OWASP Portuguese Language Project | This project aims to coordinate and push foward the iniciatives developed to translate OWASP materials to Portuguese. |
| OWASP Related Commercial Services | *Controlled environment for commercial providers of ‘OWASP Related’ services to be exposed to the OWASP community Promote the development of professional services around OWASP,
|
| OWASP RFP-Criteria | Purpose of this project is to simply provide an objective list and a aggregate set of questions from companies to utilize when they issue a RFPs for web application security. |
| OWASP Secure Coding Practices - Quick Reference Guide | This document provides a quick high level reference for secure coding practices. It is technology agnostic and defines a set of general software security coding practices, in a checklist format, that can be integrated into the development lifecycle. Implementation of these practices will mitigate most common software vulnerabilities. |
| OWASP Secure Password Project | The majority of the world's authentication systems rely on a single-factor authentication mechanism: the password. A simple internet search yields thousands of pages dedicated to the topic of creating a secure password, but almost all of them are inherently flawed in that they recommend using either joining pieces of known information to compile a secure password or variations of character conversion schemes on commonly known words and phrases. The inherent problem with this approach is that if the pieces are known, then it is fairly trivial to compute the variations that compile the whole password.
This project will have a two pronged approach designed to put more nails in the single-factor method of authentication.
|
| OWASP Secure the Flag Competition Project | This project aims to create a different type of competition that encourages secure coding rather than hacking skills.
We've all heard of capture the flag competitions, Secure The Flag (STF) is different. STF is a developer focused competition where teams compete to develop the most secure application based on a series of software requirements. Some requirements are just there to set boundaries and standardize the game, some requirements are critical elements and MUST be implemented, other elements are optional and can get you bonus points, but be careful, bonus features are more risky! Teams will receive the requirements, along with a pre-configured VM (LAMP) several days before the competition to allow ample time to design and implement their systems. |
| OWASP Secure Web Application Framework Manifesto | The Secure Web Application Framework Manifesto is a document detailing a specific set of security requirements for developers of web application frameworks to adhere to. The goal is to help develop more secure applications from the start. The manifesto centers around the following beliefs:
|
| OWASP Security Baseline Project | This projects aims to benchmark the security of various enterprise security products/services against OWASP Top 10 risks. Comprehensive assessing security of enterprise products/services, the OWASP Security Baseline initiative will (eventually) lead to vendor-independent security certified solutions. |
| Security Ecosystem Project | Nobody (and no company) can build secure software by themselves. We have seen that vulnerability research can help to drive security forward in companies, but it’s a painful process. We envision a partnership between technology platform vendors and a thriving ecosystem focused on the security of their technology. The ecosystem will include researchers (both builders and breakers), tools, libraries, guidelines, awareness materials, standards, education, conferences, forums, feeds, announcements, and probably more. |
| OWASP Security Tools for Developers Project (STD) | Develop a reference implementation of open source tools integrated in an end to end development process. This will likely include a reference architecture, guidance and a reference implementation using open source tools. We will likely extend current open source tools or develop new tools where gaps exist. |
| OWASP SIMBA Project | SIMBA (Security Integration Module for Business Applications) is a User Access Management system that can be integrated with any business application. The purpose of the project is to secure an application fast and easy. Because SIMBA itself is generic it can be customized for every project. Many features are customizable e.g. designing your own authentication chain is easy and fast by using existing or newly created building blocks. A separate Flex manager application is available to manage the data, view the audit logs and configure parameters.
With the support of the OWASP (Open Web Application Security Project) community SIMBA is constantly improved so current security vulnerabilities are better supported and proactive work is done against future vulnerabilities. SIMBA is not vendor specific, developed in an international community and is supported by all major platforms. |
| OWASP Software Security Assurance Process | To outlines mandatory and recommended processes and practices to manage risks associated with applications. Software Security is equally dependent on people, processes and technology. The effectiveness of the OWASP Software Security Process is continuously measured and is improved through feedback, threat landscape changes, availability of new concepts and tools. Should be the framework to map Requirements, Dev and Testing guidelines for example. |
| OWASP Student Chapters Program | |
| OWASP Testing Project | *The OWASP Testing Guide includes a "best practice" penetration testing framework which users can implement in their own organizations and a "low level" penetration testing guide that describes techniques for testing most common web application and web service security issues. |
| OWASP Threat Modelling Project | |
| OWASP Uniform Reporting Guidelines | This project will complement the OWASP Testing Guide as well as the OWASP RFP Template. This is going to be a reporting template for vulnerability findings which will be free, base on industry best practices and hopefully will become the defacto standard. |
| OWASP VFW (Varnish FireWall) | The purpose of this project is to mitigate web applications threats using Varnish. Varnish (https://www.varnish-cache.org/) is a modern, very flexible and scalable reverse-proxy system which supports VCL, a wonderful domain-specific language to deal with HTTP (to handle headers, routing, rewrite and block requests, etc). Nowadays, many big Internet services are behind Varnish and we can bring some security policies to it.
In another words: Varnish as a Web Application Firewall; A kind of mod_security for Varnish; Varnish security filters. |
| OWASP WAF Project | The OWASP Web Application Firewall (WAF) Project is a ModSecurity endorsed Port of their Language Specification (Level 1) for Java and .NET based on the contribution to ESAPI-Java by Arshan Dabirsiaghi. |
| OWASP Watcher Project | Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as operational configuration issues. Watcher provides pen-testers hot-spot detection for vulnerabilities, developers quick sanity checks, and auditors PCI compliance auditing. It looks for issues related to mashups, user-controlled payloads (potential XSS), cookies, comments, HTTP headers, SSL, Flash, Silverlight, referrer leaks, information disclosure, Unicode, and more.
Major Features:
|
| OWASP WhatTheFuzz Project | An easy to use, easy to get started fuzzer for websites. |
| OWASP Web Application Security Accessibility Project | The practice points out to the fact that a seemingly secure web application does, in reality, protect interests of only a specific group of users. Interests of a great number of users are protected only partially or by no means. This project will focus extensively on the issue of web application security accessibility. |
| OWASP Web Browser Testing System Project | WBTS was built to quickly automate and test various browser and user-agents for security issues. It contains all the necessary services required for testing a browser. The following services are included: DNS, HTTP(S), Logging Services and support for VirtualHosts. |
| OWASP Web Testing Environment Project | |
| OWASP WebScarab NG Project | *WebScarab NG is a robust tool that assists the user in penetration test. This is a complete rewrite of the old WebScarab application, with a special focus on making the application more user-friendly. |
| OWASP WebScarab Project | WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols. It is written in Java, and is thus portable to many platforms. WebScarab has several modes of operation, implemented by a number of plugins. In its most common usage, WebScarab operates as an intercepting proxy, allowing the operator to review and modify requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser. WebScarab is able to intercept both HTTP and HTTPS communication. The operator can also review the conversations (requests and responses) that have passed through WebScarab.
You may also be interested in testing the Next Generation of WebScarab. |
| OWASP X5s Project | Active XSS testing and input/output encoding detection
x5s is a Fiddleraddon which aims to assist penetration testers in finding cross-site scripting vulnerabilities. This is not a point and shoot tool, it requires some understanding of how encoding issues lead to XSS, and it requires manual driving. It's main goal is to help you identify the hotspots where XSS might occur by:
|
| OWASP Zed Attack Proxy Project | This project, OWASP Zed Attack Proxy Project (ZAP), provides an easy to use integrated penetration testing tool for testing web applications.
It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who a new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
|
