OWASP Juice Shop – Achieving sustainability for open source projects

If you didn’t have the chance to be at the AppSecEU 2017 conference in Belfast or you didn’t make it to my talk there, here’s the official recording:

OWASP Juice Shop is a “shooting star” among broken web applications. To make sure it does not end as a “one-hit wonder”, the project embraces principles and techniques that enhance its sustainability, e.g. Clean Code, TDD, CI/CD, Quality Metrics and Mutation Testing.

In this session you will see how
– even a horrible language such as Javascript can be written in a maintainable manner
– a complete and reliable test suite eliminates the “fear of change”
– automation is a key to increased productivity – even for small open source projects
– free-for-open-source SaaS tools can improve your development process

Where is light, there is shadow! You will also learn
– about some limitations in the automation processes
– the pain keeping Javascript dependencies up to date
– why some 3rd party services had to be dropped

If the Internet gods are with us, we will even perform a production release of OWASP Juice Shop during the session!

You can find the original HTML5 slide deck at http://bkimminich.github.io/juice-shop/appseceu_2017.html. The slightly less fancy PDF-version is available on SlideShare:

Advertisements

OWASP 24/7 Podcast: The Juice Shop Project

During the AppSecEU 2017 conference I was interviewed by Mark Miller for the Less than 10 Minutes Series of the OWASP 24/7 Podcast:

I recommend to subscribe to the podcast, even though Mark deliberately butchers the project’s name as “Juice Box” in this and at least one other episode

Web Application Security Introduction

This is the minified introduction talk to Web Application Security derived from my Training Workshop slides (https://de.slideshare.net/BjrnKimminich/web-application-security-21684264) – It gives a short motivation why Web Application Security is a high priority today and then goes through three of the most prominent vulnerabilities of web apps: 
– SQL Injection 
– Cross Site Scripting (XSS) 
– Cross Site Request Forgery (CSRF) 
It will be explained how each of these technically work, what damage they can cause and how to avoid them in your own applications. The talk concludes with a summary of existing measures to increase application security and explains why none of these is a 100% solution. To keep you on the topic for a while after the talk, a “hacking homework” is presented where a vulnerable local web shop is supposed to be hacked in various ways. 

For a full-grown coverage of the topic feel free to check out my Web Application Security Training Workshop slide deck: https://de.slideshare.net/BjrnKimminich/web-application-security-21684264. 

/!\ Performing attacks on any website or server you do not own yourself is a crime in most countries!

Quo pertentas, OSS? – How Open Source can benefit from well-crafted Tests

 This talk illustrates how a suite of well-written tests can benefit any Open Source project on multiple levels*: 

  • improve maintainability of the code-base
  • help increase the truck factor** of the project
  • “after-the-fact” tests help understand existing code and serve as documentation
  • Behavior Driven Development (BDD) concepts can help create specification-like tests

The idea of adding BDD-style unit tests was introduced into the actively developed OWASP ZAP project end of 2012. It will be explained 

  • how the ZAP team approached this task initially
  • what the improvements for the project were so far
  • where we are going with automated testing in the future

Disclaimer: Some source code will definetely be shown during this talk, but you won’t need to be a Java expert to follow the story! Having some general programming experience is totally sufficient! 

*= surprisingly also works for proprietary software projects! 
**= number of contributors that could be (fatally) run over by a truck without effectively killing the project

Web Application Security Workshop

These are the slides to my 2-day “Web Application Security Training Workshop”. The workshop is intended for all IT staff involved in web application development, e.g. software engineers, system analysts, quality engineers or application administrators.

The goals of the workshop are:

  • Build security awareness for web applications
  • Get to know attack methods of hackers
  • Learn ways to discover security vulnerabilities
  • Learn the basics of secure web development

Day one starts with a motivation of the topic and then covers the most severe vulnerabilities of web applications based on the OWASP Top 10 list. The attacks on those vulnerabilities are discussed and can be tried out in several examples.

Day two starts with a two hour hacking contest where each participant attacks the locally installed BodgeIt store and tries to get as many points on the score card as possible. Next the Secure Software Development Lifecycle is briefly discussed in order to prevent security flaws as early as possible.


/!\ Performing attacks on any website or server you do not own yourself is a crime in most countries!