1 / 11

WebGoat v5 Project: Autumn of Code 2006 Project

WebGoat v5 Project: Autumn of Code 2006 Project. Presenter: Dave Wichers OWASP Conferences Chair COO, Aspect Security dave.wichers@aspectsecurity.com WebGoat Project Lead: Bruce Mayhew webgoat@owasp.org. About the Speaker. Background IT Security Consultant for past 19 years

trevor-henry
Download Presentation

WebGoat v5 Project: Autumn of Code 2006 Project

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. WebGoat v5 Project: Autumn of Code 2006 Project Presenter: Dave Wichers OWASP Conferences Chair COO, Aspect Security dave.wichers@aspectsecurity.com WebGoat Project Lead: Bruce Mayhew webgoat@owasp.org

  2. About the Speaker • Background • IT Security Consultant for past 19 years • Focus on application security for past 9 years • Bachelor’s and Masters Degrees in Computer Science • CISSP, CISM • Aspect Security Founder and COO • Specialists in application security • Verify critical applications (~3 million LOC/month) • Enable companies to reliably produce secure code • OWASP Foundation • Coauthor of OWASP Top 10 • Member of OWASP Board • Conferences Chair for OWASP AppSec Conferences • Established OWASP as 501c3 not-for-profit in U.S.

  3. What’s a WebGoat • OWASP project with ~115,000 downloads • Deliberately insecure Java EE web application • Teaches common application vulnerabilities via a series of individual lessons

  4. History of WebGoat • Donated to OWASP by Aspect Security ~2002 • Project Lead is Bruce Mayhew • Started to receive outside contributions in 2005 • v5 produced as AoC 2006 project

  5. WebGoat Demonstrates Vulnerabilities • WebGoat uses “goatified” real world examples • Cross site scripting • SQL Injection • Command Injection • Forced Browsing • Access Control • Data, presentation, business, & environmental layers • Authentication • AJAX • WebServices • ….

  6. Picking up Steam… • Used by source code analysis and web application security scanning vendors for demos • Used by universities in security curriculum • Carnegie-Mellon • Using WebGoat as open source project option • University of Denver • Wouldn’t it be great if students contributed lessons as part of their class projects!! • OWASP Autumn 2006 and Spring of Code 2007 Projects • Used by many companies as a training tool • LOTS of emails from user community

  7. What’s New in 5.X • 5.0 – Autumn of Code 2006 Release • Many new lessons • AJAX, JSON, HTTP response splitting, CSRF, cache poisoning, log poisoning, XML & XPATH Injection, forced browsing • 5.1 (Goals – Summer 2007) • Servlet that allows attacks to post data • Posted data is pushed back to originating lesson • XSS Phishing attack • Improved lesson content • Enhanced Documentation (A SpoC 2007 project)

  8. Roadmap • Create database schema common to all lessons • Convert lessons to a common theme • HR System (WebGoat Financials) • Online Banking or Video Store • Make WebGoat more CBT like • Teach application security, not just demonstate how to attack • Convert lessons to JSPs for easier content editing

  9. Demos – Lets go through some lessons!!

  10. Q & Q U E S T I O N S A N S W E R S Questions and Answers A

  11. Share your ideas / Let us know you’re using it! Bruce Mayhew webgoat@owasp.org http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project http://code.google.com/p/webgoat/

More Related