OWASP Developer Guide

OWASP Coraza is an enterprise-grade Web Application Firewall (WAF) framework written in Go. It is designed to enforce security policies and act as a first line of defense against HTTP attacks.

Key features include:

• Support for the ModSecurity seclang language.
• Full compatibility with the OWASP Core Rule Set (CRS).
• Ability to use both CRS and custom security policies.

Coraza is an active OWASP Production code project.

The OWASP Secure Coding Dojo is a training platform designed to teach developers how to recognize security flaws during code reviews.

Key features include:

• Attack/Defense Lessons: Lessons are structured as pairs where developers observe weaknesses by conducting an attack and then learn the associated software defenses after solving the challenge.
• Focus on Software Errors: Lessons are based on the MITRE most dangerous software errors (SANS 25), focusing on code errors rather than just attack techniques.
• Code Block Identification: Developers must identify insecure blocks of code within training modules.
• Progress Tracking: Includes a leaderboard for development teams to track progress.
• Customization: The platform can be customized to integrate with custom vulnerable websites and other Capture The Flag (CTF) challenges.

The OWASP Core Rule Set (CRS) is a collection of generic attack detection rules designed for use with ModSecurity-compatible Web Application Firewalls (WAFs). It provides the security policy that instructs the WAF engine to inspect incoming traffic for various attack categories, including those identified in the OWASP Top Ten, with the goal of minimizing false alerts.

Key Compatibility:

• WAF Engines: ModSecurity, OWASP Coraza, and other ModSecurity-compatible WAFs.
• Web Servers: Supports deployment for Apache, IIS, and Nginx.

OWASP secureCodeBox orchestrates various open-source security tools across multiple domains to provide a comprehensive view of threats and vulnerabilities. The supported domains and tools include:

• Container analysis: Trivy (vulnerability and SBOM scanning).
• Content Management System (CMS) analysis: CMSeeK (Joomla), Typo3Scan (Typo3), and WPScan (WordPress).
• Kubernetes analysis: Kube Hunter and Kubeaudit.
• Network analysis: Amass, doggo, Ncrack, Nmap, and Whatweb.
• Repository analysis: Git Repo Scanner, Gitleaks, and Semgrep.
• SSH/TLS scanning: SSH-audit and SSLyze.
• Web Application analysis: ffuf, Nikto, Nuclei, Screenshooter, and ZAP (Advanced web application & OpenAPI vulnerability scanner).

The OWASP Secure Headers Project (OSHP) provides guidance, best practices, and technical resources for using HTTP response headers to increase web application security. By implementing these headers, developers can instruct modern browsers to restrict certain types of preventable vulnerabilities.

OSHP provides:

• Explanations and usage guidance for specific response headers.
• Browser support information.
• Best practices and technical resources.
• Code snippets for implementing security headers.
• Links to analysis tools and development libraries.

OWASP SecurityRAT (Requirement Automation Tool) is a companion tool for the OWASP Application Security Verification Standard (ASVS). It automates the generation and management of security requirements for frontend, server, and mobile applications.

Key Capabilities:

• Requirement Generation: Creates an initial subset of ASVS requirements based on specific application attributes.
• Requirement Management: Stores requirements in a database to track status and updates throughout the development lifecycle.
• JIRA Integration: Provides integration with Atlassian JIRA to raise and track software issues related to security requirements.
• Compliance Testing Interface: Provides an API that allows for the creation of compliance automation tools (conceptually referred to as SecurityCAT).

OWASP Amass is a command line tool used for attack surface management, network mapping, and external asset discovery. It integrates various open-source information gathering tools and active reconnaissance techniques to provide information on an organization's websites and applications.

Security test teams use Amass to:

• Perform reconnaissance and enumeration.
• Determine what information a malicious actor might be able to obtain about an organization.
• Map attack surfaces during penetration testing.

The OWASP Security Culture project is a guide designed to help organizations create and nurture secure development practices throughout the application security development lifecycle. It provides practical advice and explanations to establish a positive security posture by integrating security activities into development teams.

Key topics covered by the project include:

• Why add security in development teams
• Setting maturity goals and Security team collaboration
• Security champions programs
• Activities such as Threat modeling and Security testing (SAST, DAST, IAST)
• Security related metrics to justify investment and track progress.

The OWASP Offensive Web Testing Framework (OWTF) is a penetration testing framework designed to organize and execute security test suites. It helps align penetration testing efforts with various security standards and guides, enabling more comprehensive and creative testing.

Key Characteristics:

• Extensibility: Easily configurable; users can add new tests or create plugins via configuration files.
• Targeted Use: Designed primarily for penetration testers with expertise in pen-testing environments and tools.
• Platform Support: Optimized for Kali Linux. It can be run on MacOS, but this requires manual modification of scripts and paths.

OWASP Threat Dragon is a diagrammatic tool designed for threat modeling applications, APIs, and software systems. It allows development teams to create and modify Data Flow Diagrams (DFDs) to provide context for threat modeling activities.

Key features include:

• Threat Storage: Identified threats are stored in a text-based file alongside the threat model diagram.
• Reporting: The tool can output the threat model diagram and associated threats as a PDF report for documentation and GRC (Governance, Risk, and Compliance) purposes.
• Methodology Support: It supports various threat categorization methodologies, including:
  • STRIDE
  • LINDDUN
  • PLOT4ai
  • CIA
  • DIE

OWASP Dependency-Track is an intelligent platform for Component Analysis, specifically designed to identify and reduce risk in the software supply chain. It achieves this by analyzing Software Bill of Materials (SBOM) exports, such as CycloneDX, and Vulnerability Exploitability Exchange (VEX) data.

Key capabilities include:

• Component Tracking: Monitors component usage across an entire organization's portfolio.
• Risk Identification: Detects known vulnerabilities by integrating with intelligence sources like the National Vulnerability Database (NVD) and GitHub advisories.
• Full-stack Support: Analyzes hardware, services, and software components.
• Integrations: Supports notification platforms (Slack, Microsoft Teams) and vulnerability aggregators (DefectDojo, Fortify).

OWASP Nettacker is a modular Python-based command line utility designed for automated network and vulnerability scanning. It is used for both internal and external security assessments, reconnaissance, and penetration testing.

Key capabilities include:

• Node Discovery: Scanning networks to discover nodes, servers, and subdomains.
• Service Identification: Identifying servers, services, and port numbers in use.
• Modular Scanning: Extending functionality via modules grouped into three domains:
  • Scan modules: For reconnaissance.
  • Vulnerability modules: For attempting specific exploits.
  • Brute force modules: For credential or access testing.

Nettacker is cross-platform and runs on Windows, Linux, and MacOS. It can be operated via the command line (ideal for scripting) or through a web browser interface for navigating results.