OWASP Albuquerque

Centennial Science and Engineering Library

Centennial Library is located on the University of New Mexico campus, near the corner of University Blvd. and Central Ave.

Public parking is across the stree on University Blvd. Street parking is available south of Central Ave.

The entrance is a small building that leads you underground.

A valid government-issued or student picture ID is required to enter the Centennial Science and Engineering Library. Have your photo ID ready to show at the downstairs turnstile.

Example

Put whatever you like here: news, screenshots, features, supporters, or remove this file and don’t use tabs at all.

OWASP ABQ is headed by two co-leaders. Our chapter year starts in August. In April or May, we should elect two new co-leaders to take over the following August.

What do chapter leaders do?

• reserve meeting space
• respond to inquiries
• update this web site
• maintain our discord server
• send reminders for meetings
• find speakers
• do presentations

Want to become a co-leader?

In a spring meeting, we’ll take nominations and vote on the new co-leaders. Please come to a meeting to find out more.

Using Fuzzing in Cybersecurity

Tuesday, July 23, 2024, at 4:30 pm

UNM Centennial Library, DEN2

Fuzzing is a technique to test programs with generated data. Its main goal is to detect crashes and non-expected failures. Radamsa is a general-purpose, black-box-oriented mutating fuzzer. In this talk, José will show examples of fuzzing using radamsa from basic command line tools to network services. We will also discuss some applications in cybersecurity of fuzzing involving automation of test cases.

Agenda:

• 4:30 Say Howdy
• 5:00: Using Fuzzing in Cybersecurity
• Upcoming events:
  • Around August 1: Albuquerque Software Social Club
  • September 19: INTERFACE Albuquerque
  • October 11: Tech Fest

Leadership Elections and Planning

Tuesday, July 16, 2024, at 5:30 pm

Bosque Brewing, 106 Girard Blvd SE, Unit B, Albuquerque, NM 87106

It’s time to plan activities for the next year! We need your ideas for future chapter activities. Please come by to say hello and tell us what you think OWASP ABQ should work on this year.

Interested in a leadership position? We will also elect 2 co-leaders for the next year. Find out more information in the Leadership section.

Agenda:

• 5:30 Meet and greet, beer and snacks
• 6:15: Pick 2 co-leaders
• Brainstorm for the upcoming year
• Upcoming events:
  • July 19-20: BSides Cybersecurity conference
    • 2-for-1 tickets! Student ticket price!
  • July 23: Using Fuzzing in Cybersecurity
  • Around August 1: Albuquerque Software Social Club
  • September 19: INTERFACE Albuquerque

Minutes:

• 4 attendees showed up.
• Everyone urged to come up with event ideas for the next year.
• Election results: 3 votes for Rose to be co-leader.
• Talked upcoming events listed above. We are excited about José’s talk next Tuesday!
• An OWASP participant will be speaking a BSides this Friday. Everyone is interested in attending; some have tickets already.
• Next OWASP meeting after next Tuesday will be in November or December.

Cross-Site Request Forgery Basics

Tuesday, April 30, 2024, at 5:30 pm

Cesar Chavez Community Center, Meeting Room

Franklin and Althea will discuss the basics of Cross-Site Request Forgery (CSRF), assuming as little knowledge of web development as possible. This will include a review of how web browsers load and render web pages by making HTTP requests to a web server, how cookies are used to authenticate requests, and how authenticated requests are spoofed in a CSRF attack. They will also discuss browser security mechanisms that facilitate CSRF prevention, and what a website designer can do to prevent these attacks. The talk will be followed by a lab exercise from Portswigger.

Please RSVP to [email protected]. If you want to participate in the lab exercise, please bring a personal computer and make an account on the Portswigger website before the event. It is also recommended (but not required) to install either Burp Suite Community Edition, or another web proxy of your choice.

Agenda:

• Meet and greet
• Featured presentation “Cross-Site Request Forgery Basics”
• Elect 2 co-leaders for next year
• Pitch ideas and recruit volunteers for future presentations

Code Eyeballing

Wednesday, March 27, 2024, at 4 pm

UNM Centennial Library, DEN2

Rose will guide us through a code review of a simple web application. Participants will be invited to eyeball code in the context of their favorite risk from OWASP Top 10; list issues; discuss remediation strategies; and prioritize remediations.

All activities can be completed by looking at code. But you can also test on your machine with Docker: deploy https://github.com/pzzd/docker-lamp and send a request to [email protected] for access to the web application repo.

Our space is limited to 16 people, so please RSVP to [email protected].

Agenda:

• Greetings and salutations
• Featured presentation “Code Eyeballing”
• Pitch ideas and recruit volunteers for future presentations

Basics of SQL injection

Monday, November 27, 2023, at 4 pm

UNM Centennial Library, DEN2

UNM student Franklin Pezzuti Dyer will discuss the basics of how databases might be used for web applications, how a web app can manipulate a database using SQL, and how this can leave an app open for attack if SQL commands are handled unsafely. The meeting will consist of a short introductory talk, followed by a lab session consisting of SQL injection exercises on deliberately vulnerable websites hosted by Portswigger.

If you would like to participate in the lab session, please come prepared with a Portswigger account, and a proxy of your choice installed. You will need this to capture, examine and modify HTTP packets. You could use Burp Suite (software by Portswigger, recommended) or an open-source alternative like mitmproxy.

Our space is limited to 16 people, so please RSVP to [email protected].

Agenda:

• Say Howdy
• Featured presentation “Basics of SQL injection”
• Pitch ideas and recruit volunteers for future presentations

Breaking into websites using misconfigurations

Thursday, October 26, 2023, at 4 pm

UNM Centennial Library, DEN2

Security research student Alex Adams will give a presentation about exploiting misconfigurations of the Google Authentication Toolkit in the wild. Learn about the Google Identity Toolkit API and common ways you might find it misconfigured. This talk will discuss some methods to spot issues with websites in general, common tools used by hackers for web penetration, and then go into a specific example of gaining unauthorized access to a website.

Agenda:

• Meet and greet
• Featured presentation “Breaking into websites using misconfigurations”
• Pitch ideas and recruit volunteers for future presentations

Code injection attacks

Wednesday, August 30, 2023, 3 pm - 6 pm

UNM Centennial Library, DEN2

Agenda:

• Get to know each other
• Pitch ideas for future meetings
  • We may have a future talk about network security.
  • Meeting time should be later, starting around 5 or 5:30.
• Informal presentation and discussion about code injection attacks at 4 pm. If you have thoughts or experience in this area, please come and share!
  • Putting up with input (A03:2021 - Injection)
  • Demo of SQL injection and reflected XSS using MAMP