[Owasp-chicago] OWASP meeting: March 5th

Cory Scott cory at crazypenguin.com
Sat Feb 9 14:05:24 EST 2008

The next Quarterly Chicago OWASP Chapter meeting will take place on  
March 5th, 2008 at 6pm CDT.

We hope to see you at the ABN AMRO Plaza at 540 W. Madison, Downtown  
Chicago, 23rd floor. Please RSVP to jason{AT}wittys.com by Monday  
3/3/2008 if you plan to attend. Your name will need to be entered  
into the building's security system in order to gain access to the  


6:00 Refreshments and Networking
6:30 Integrating Security Into the QA Group - Taylor McKinley,  
Product Manager at Fortify Software
7:10 Web app penetration testing with scripting languages - Mike  
Tracy, Security Consultant at Matasano Security

Presentation abstracts

Integrating Security Into the QA Group

Until recently, Web Application Testing was left to security teams  
and ethical hackers who used advanced tools, such as Web application  
scanners, to analyze running Web applications. However, security  
groups are becoming overburdened by product releases, and many  
organizations are attempting to move security testing earlier in the  
development cycle. The QA group is a natural candidate, since it  
generally has the infrastructure in place to test applications for  
quality issues. However, for many organizations, integrating security  
into the QA group has been incredibly difficult. The process of  
running a security test is a learned skill, and not something one can  
teach a QA tester in a matter of days. On top of that, most security  
testing tools were designed for penetration testers (since they  
require an in-depth knowledge of application security theory) and are  
not generally usable by QA professionals. As a result, very few QA  
groups have successfully adopted security testing.

This talk will focus on a new technique for allowing QA teams to  
participate in the security process without any additional work or  

Web app penetration testing with scripting languages

We show how, with minimal scripting knowledge, using tools we're  
developing in-house and releasing to the public, the browser/proxy/ 
tool mechanisms we use to test web apps today can be enhanced. With a  
little scripting, your test tools can be customized to any project,  
handle Ajax sites, JSON documents, XML, and more.

We introduce PenTestConsole, a set of Ruby classes wrapped around an  
HTML parser (Hpricot), an XML parser (REXML), a deep spider, a fuzzer  
and classes that provide http functionality that would normally be  
used in a vulnerability assessment tool (forms, parameters, header  
manipulation, character encoding etc.). We started out by looking at  
URL transfer libraries (Curb Ruby bindings for libcurl and Ruby net/ 
http), parsers (Hpricot) and fully blown scraping tools (like  
Mechanize) and decided to create something new. We wanted a tool  
could range from fine-grained manipulation of user inputs to hit it  
with a hammer random acts of senseless garbage. We also wanted to be  
able to do combinatoric input reduction (pairwise for example) and  
header manipulation and tie it right into the tool.

We discuss how we leverage minimal programming effort to gain maximal  
improvement in testing, so that we're no longer held hostage by web  
app pen testing tools (no matter how good they are), and so that we  
can automate and accelerate tests.

More information about the Owasp-chicago mailing list