>> An introduction to OWASP.
Our learning objectives are to define what
the OWASP foundation is and its mission,
and describe some of the tools and resources OWASP
produces for web application security.
Now, when I first started out in
penetration testing and understanding
more about web applications,
OWASP was one of the first organizations I learned about.
When I was at Black Hat many years ago
OWASP Foundation was there, I spoke with them,
I became a member very early on because I
wanted to learn a lot more about
web application security,
and they seemed like the right place to go and
I've not been disappointed ever since.
There are tens of thousands of members
of this non-profit organization,
and its mission is to secure the web.
As you can see OWASP stands for
the Open Web Application Security Project.
It's not just Internet facing web applications,
they also deal with mobile security or
mobile applications as well.
If you've dealt with mobile applications,
there are many similarities between you browsing
to a site in a browser from your home computer,
or you going to a site or an application on your phone.
There are obviously differences between apps on
your phone and web applications
that you would access from your laptop,
but there are also similarities as well.
I think OWASP blends those
nicely because you don't want to forget
about the mobile component in
>> securing web applications.
>> Also it provides tools and resources
>> education, training.
>> Just to give you an example,
I took a training in the Spring of last year.
Put on by OWASP,
they had a whole bunch of workshops that they were
giving during the Summer of 2020.
Obviously virtual trainings because of COVID,
and I took one in
Cloud penetration testing which
I thought was a really great course.
I did have to pay for that.
It was discounted because I was a member of OWASP.
If you were not a member of OWASP you had to pay more,
but that's to say that OWASP does offer training.
It may be a non-profit,
but they still do collect money.
You have to pay to be a member,
you have to pay for trainings but they also
have some free things which we'll talk about later.
It's not just targeted towards penetration testing,
it's also targeted towards developers.
They want developers to know how to write secure code.
This is geared towards technologists or
people who are interested in technology.
Some of the projects obviously
OWASP top 10 needs no introduction,
that is why you are here.
We obviously delve a
lot more into this during this whole course,
but also they have these vulnerable web applications.
One of them is called WebGoat.
When I was going to graduate school at Carnegie Mellon,
when I was in my secure software course,
WebGoat was something that we looked at.
We looked at vulnerabilities and we
also looked at secure coding,
and how to prevent these vulnerabilities,
but web goat was the application that I learned on.
It's intentionally vulnerable,
it's geared towards developers.
We're going to look at Mutilidae when we
do our exercises here.
I think WebGoat does a good job of
walking people through the OWASP Top 10.
As far as walking people through
it hold your hand in a way.
I will not discount WebGoat at all,
I think it's beneficial.
It can certainly be helpful in
addition to doing this course,
is also looking at the WebGoat application.
The Zed Attack Proxy or ZAP
is something that's pre-installed in Kali, it's free.
If you look at Burp Suite,
which we'll look at both ZAP
and Burp Suite a little bit later,
ZAP is completely free,
whereas Burp Suite has
a Community Edition that is free and the pro edition,
which is paid for.
We'll look at ZAP a whole lot more later.
There's also the web security testing guide,
which is the Bible for
web application penetration testers.
If I want to look at how to test for SQL injections or
cross-site scripting or XML injections,
I can look at the web security testing guideline
as far as what I should be
looking for as a penetration tester to
test for this type of vulnerability.
We will be using this throughout this course.
There's also Juice Shop.
Like WebGoat, Juice Shop is
a intentionally vulnerable modern web application.
I like it better than WebGoat.
It has a whole bunch of vulnerabilities.
I don't think it just has the
top 10 I think it has more than that.
As you can see and more,
but if you're interested in
using a web application as a vulnerable,
I would highly recommend using
Juice Shop as well as WebGoat.
If you had to pick between the two,
I would choose Juice Shop.
There's also the mobile security testing guides.
Like we looked at the web security testing guide,
there is the mobile security testing guide,
and then we also have,
and there's the wasp on the cover of it,
the mobile app security requirements and verification,
which provides standards for mobile application security.
To be honest, mobile applications is not a strength of
mine but if I were to get involved
in more of the mobile application space,
I would definitely look at the resources
that OWASP has to provide.
Can you join OWASP?
Of course you can, but it will cost you.
I believe the current membership price for
an individual is $50,
it is $20 for students,
and there are also corporate memberships as well.
All of this goes towards
helping this non-profit organization,
and as I discussed earlier,
there are local chapters,
there's a local chapter near me,
the screenshot is taken from Sydney,
so they're literally all over
the world for the tens of thousands of members who
are in OWASP and they
provide free trainings if you become a member.
Like we talked about conferences, events.
I really have enjoyed my membership at
OWASP and think it was valuable,
$50 a year I don't think is
really that much in terms of the benefit that
I get out of it with my local chapter and also
all discounts that I get in trainings from OWASP.
In summary, we've defined what
the OWASP Foundation is and its mission,
and we've also described some of
the tools and resources OWASP
produces for web application security.