Security - OWASP Top Ten testing - Revision history

Philip Lacey at 12:26, 4 May 2015

2015-05-04T12:26:49Z

Philip Lacey: Philip Lacey moved page OWASP testing to Security - OWASP Top Ten testing

2015-02-18T19:08:08Z

Philip Lacey moved page OWASP testing to Security - OWASP Top Ten testing

Philip Lacey at 19:07, 18 February 2015

2015-02-18T19:07:30Z

Thomas Glennon: Created page with "The OWASP Top Ten is a powerful awareness document for web application security. The OWASP Top Ten represents a broad consensus about what the most critical web application se..."

2015-01-22T13:31:12Z

Created page with "The OWASP Top Ten is a powerful awareness document for web application security. The OWASP Top Ten represents a broad consensus about what the most critical web application se..."

New page

The OWASP Top Ten is a powerful awareness document for web application security. The OWASP Top Ten represents a broad consensus about what the most critical web application security flaws are. Project members include a variety of security experts from around the world who have shared their expertise to produce this list.

It is urged for all companies to adopt this awareness document within their organization and start the process of ensuring that their web applications do not contain these flaws. Adopting the OWASP Top Ten is perhaps the most effective first step towards changing the software development culture within your organization into one that produces secure code.

At All n One we utalize the Linux based penetration testing operating system KALI. Kali OS comes loaded with lots of different testing tools. All n One use OWASP ZAP to allow us to find these OWASP issues and then mitigate against them. This process is conducted Monthly.

The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually. 

Some of ZAP's functionality: 
Intercepting Proxy 
Traditional and AJAX spiders 
Automated scanner 
Passive scanner 
Forced browsing 
Fuzzer 
Dynamic SSL certificates 
Smartcard and Client Digital Certificates support 
Web sockets support 
Support for a wide range of scripting languages 
Plug-n-Hack support 
Authentication and session support 
Powerful REST based API 
Automatic updating option 
Integrated and growing marketplace of add-ons 
 
Some of ZAP's features: 

Open source 
Cross platform 
Easy to install (just requires java 1.7) 
Completely free (no paid for 'Pro' version) 
Ease of use a priority 
Comprehensive help pages 
Fully internationalized 
Translated into a dozen languages 
Community based, with involvement actively encouraged 
Under active development by an international team of volunteers

← Older revision		Revision as of 12:26, 4 May 2015
Line 68:		Line 68:


−	[[Category:Security]]	+	[[Category:Topic:Security]]

@@ Line 1: / Line 1: @@
 The OWASP Top Ten is a powerful awareness document for web application security. The OWASP Top Ten represents a broad consensus about what the most critical web application security flaws are. Project members include a variety of security experts from around the world who have shared their expertise to produce this list.
 It is urged for all companies to adopt this awareness document within their organization and start the process of ensuring that their web applications do not contain these flaws. Adopting the OWASP Top Ten is perhaps the most effective first step towards changing the software development culture within your organization into one that produces secure code.
-At All n One we utalize the Linux based penetration testing operating system KALI. Kali OS comes loaded with lots of different testing tools. All n One use OWASP ZAP to allow us to find these OWASP issues and then mitigate against them. This process is conducted Monthly.
 The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
-Some of ZAP's functionality:<br/><br/>
+ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
-Intercepting Proxy <br/>
-Traditional and AJAX spiders <br/>
-Automated scanner <br/>
+Some of ZAP's functionality:
-Passive scanner <br/>
+* Intercepting Proxy
-Forced browsing <br/>
+* Traditional and AJAX spiders
-Fuzzer <br/>
+* Automated scanner
-Dynamic SSL certificates <br/>
+* Passive scanner
-Smartcard and Client Digital Certificates support <br/>
+* Forced browsing
-Web sockets support <br/>
+* Fuzzer
-Support for a wide range of scripting languages <br/>
+* Dynamic SSL certificates
-Plug-n-Hack support <br/>
+* Smartcard and Client Digital Certificates support
-Authentication and session support <br/>
+* Web sockets support
-Powerful REST based API <br/>
+* Support for a wide range of scripting languages
-Automatic updating option <br/>
+* Plug-n-Hack support
-Integrated and growing marketplace of add-ons <br/>
+* Authentication and session support
-<br/><br/>
+* Powerful REST based API
-Some of ZAP's features: <br/>
+* Automatic updating option
-Open source<br/>
+[[Category:Security]]

← Older revision	Revision as of 19:08, 18 February 2015
(No difference)