OWASP TESTING PROJECT
https://www.owasp.org/index.php/OWASP_Testing_Project
Currently at version 4
11 test categories
Over 100 unique app sec tests
Slide 11
Slide 11 text
NIST SP 800-115
Technical Guide to Information Security Testing and
Assessment
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialp
ublication800-115.pdf
STARTING OWTF
Create your testing directory
mkdir ~/pentest; cd ~/pentest
Create a virtualenv
source ~/.bashrc; workon owtf
Start the db
~/owtf/scripts/db_run.sh
Start OWTF
~/owtf/owtf.py
Login
http://127.0.0.1:8009
Slide 22
Slide 22 text
USING SESSIONS
Slide 23
Slide 23 text
CHOOSE YOUR WEAPON(S)
Select Targets, then click Run
Use the Search box to filter
Plugins by Code
OWTF – 121 plugins
PTES – 16 plugins
Slide 24
Slide 24 text
UNDERSTANDING PLUGINS
Three (3) additional types
WEB (active, external, grep, passive, semi-passive)
NET (active, bruteforce)
AUX (se, exploit, etc.)
Spend some time skimming the OWASP Testing Guide for a better understanding of plugin mappings/identifiers
Slide 25
Slide 25 text
ANALYZING RESULTS
Organized by plugin + criticality
Mapping code (e.g., OWTF-CM-008)
Mapping name (e.g., HTTP Methods and XST)
Pen test context (e.g., PUT, TRACE, WebDAV)
HTTP Request & Response
Browse button takes you to output files generated
during the test (if available)
Slide 26
Slide 26 text
SAVING YOUR ANALYSIS
Manual ranking
Info
Low
Medium
High
Critical
Tester can add notes
Slide 27
Slide 27 text
ADVANCED FILTER
Status (Aborted, Aborted by User, Successful)
Plugin Group (Web)
Mapping (NIST, OWASP_V3, OWASP_V4)
OWTF Rank (-1, 1, 2, 3, 4, 5)
Plugin Type (active, external, grep, passive, semi-passive)
Slide 28
Slide 28 text
TRANSACTION LOG
Link
Time (Duration)
HTTP Options
HTTP Status
URL
Slide 29
Slide 29 text
MANAGING WORKERS
Scanner process
PID
Target
Plugin
Type
Group
Pause, resume, & abort individual workers
Maximum of one plugin per target will be running at any moment in time
Slide 30
Slide 30 text
MANAGING WORKLISTS
One worklist contains one or more workers
Columns
Time estimate
Target
Plugin Group
Plugin Type
Plugin Name
Slide 31
Slide 31 text
TEST CASES
Slide 32
Slide 32 text
LET’S TALK WORKFLOW (AGAIN)
Add your target
Run your plugins
Analyze the scan results
Copy commands from web UI to CLI
Run command line tools
Analyze the results from the CLI tools
Add notes via the web UI
Generate (export) your report
Slide 33
Slide 33 text
TEST SSL/TLS CONFIG
Filter on ssl (or tls; same results)
Four (4) tests
Output saved to
/pentest_folder/owtf_review/…
Slide 34
Slide 34 text
TEST FOR XSS
Filter on cross site scripting (6 tests)
Also, cross site flashing
DOM-based, reflected, & stored
Slide 35
Slide 35 text
TEST FOR INJECTION FLAWS
Filter on injection (12 tests)
Why stop at SQLi?
SMTP
Code
Command
LDAP
XML
XPath
Slide 36
Slide 36 text
WHAT IF…?
Slide 37
Slide 37 text
A FEW FINAL COMMENTS
Slide 38
Slide 38 text
QUICK TIPS
You’ll need to install w3af in Kali
git clone https://github.com/andresriancho/w3af.git
git clone w3af
easy_install upgrade pip
dependencies (script in temp dir)
My UX has been a little buggy
Occasional HTTP 500 error (including first run)
Steer clear of the Default Session
Multiple runs against the same app may overwrite previous scan data
Contribute to the project!
Slide 39
Slide 39 text
YOUR HOMEWORK – TRIAL RUN
Study up on the OWASP Testing Guide
Identify the tests that are relevant to your app(s)
Run your first set of OWTF plugins
Validate and/or expand findings via command line
Add your comments and export your first OWTF report
Feed report findings into bug tracking system
Fix all the things!