GSoC2019 Ideas

OWASP Project Requests

Tips to get you started in no particular order:

OWASP-SKF

Idea 1 Improving the Machine Learning chatbot:

We want to extend the functionality of SKF Bot. (Security Knowledge Framework Chatbot):

Some improvements or the suggestions which we can do to improve the functionality are:

  1. Create a desktop version of the chatbot. Where people can install the setup file on their local machine.
  2. Create a Plugin or website bot which we can add in the website for better chat experience for the user.
  3. Extend the bots capability to do the google search (using web scraping) for the things which are not available in the database. So, it will have a wider scope of knowledge.
  4. Add basic conversation flow which makes SKF Bot friendly and provides the better user experience. Example: Replies to the general queries like How are you? What is your Name etc?
  5. Extend the bot capability to reply to what security controls should be followed from the ASVS and MASVS or other custom checklists that are present in SKF.
  6. Extend the bot to different platforms like Facebook, telegram, slack, Google Assistant etc. Existing chatbot implementation is on Gitter. You can test the bot by typing @skfchatbot on Gitter Community.

Getting started:

Knowledge Prerequisites:

Mentors and Leaders

Glenn ten Cate (Mentor, Project leader) Riccardo ten Cate (Mentor, Project leader) Priyanka Jain (Mentor)

Idea 2 Improving and building Lab challenges and write-ups:

Build lab examples and write-ups (how to test) for different vulnerabilities over different technology stacks. These challenges are to be delivered in Docker so they can be easily deployed.

In the current situation the security knowledge framework ultimately presents a list of security controls with correlating knowledge base items that contain a description and a solution. The new labs are used to give the software developers or application security specialists a more in depth understanding and approach on how to test the vulnerabilities in their own code.

The images that are pushed to the Github repository are already automatically build and pushed to a docker registry where the SKF users can easily pull the images from to get their labs running. Of course they can download it and build it themselves from source by pulling the original repository.

Idea 3 Addition of exploitation framework + labs + challenges and write ups

The proposal for SKF (Security Knowledge Framework) involves addition of “Exploit Development Framework” , the idea revolves around how does one start with Linux exploit development from basic string format attacks to advance buffer overflows.

The idea is to develop an addition (framework) which intergrates SKF, that now gives you an hands on experience for writing exploit code deployed over various containers with the help of dockers for easy and instant deployment.

The framework will involve a browser based environmental (shell) and inbuilt chat utility that will be guiding you on how to go from an absolute beginner with gdb basics to all the way to how to bypass various protections like ASLR/NX/Canaries on Linux environment.

Each challenge will have a dedicated container to easily maintain various challenges, also it will give you an option to connect to binary running on a particular port if you want to access it via your own machine, and also the source to the vulnerable code. This idea gives user a flexibility to experiment with the idea and even automate the attacks in python via socket programs or user intermediate framework like pwntools.

The whole idea of challenges isn’t limited to stack based buffer overflows, but includes various challenges like format string attacks, double frees, heap overflows and privilege escalations.

Total number will be deploying 20 challenges, the whole idea isn’t limited to exploit development but also to try out some very advance exploitation techniques like blind ROPs and lots of experimentation.

The whole add on also comes with a dedicated document with very well written ways to exploit challenges in various flavours like manual, automated, advanced.

Upon completion of labs and write ups the NLP model can be trained now to know not just web, but also all about various languages like C / C++ coding best practices and risk involved with calls like free (); puts(); and not just only tell the theory on why is it bad but also train you and guide you why it is bad and how you can write an exploit from a vulnerable code.

Upon completion of labs with ASLR turned off on (non ASLR) stages they can be turned on and lead to ROP with ASLR and even more challenging questions.

Mentors and Leaders

Glenn ten Cate (Mentor, Project leader) Riccardo ten Cate (Mentor, Project leader) Priyanka Jain (Mentor)

OWASP DefectDojo

OWASP DefectDojo is a popular open source vulnerability management tool and is used as the backbone for security programs. It is easy to get started with to work on! We welcome volunteers of all experience levels and are happy to provide mentorship.

Issue Tracking:

Enhancement and bugfixes are located in Github issues. This project could implement a whole bunch of new features one by one and release them over the course of several small releases.

Expected Results:

Getting started:

Knowledge Prerequisites:

Potential Mentors:

Option 1: Unit Tests - Difficulty: Easy

Option 2: Python3 Completion

Option 3: Scan 2.0 / Launch Containers

Scan 2.0 consists of automating the scanning orchestration within DefectDojo. Several proof of concepts exist for this using the AppSecpPipeline to launch containers and then push those finding into the appropriate product.

OHP (OWASP Honeypot)

OWASP Honeypot is an open source software in Python language which designed for creating honeypot and honeynet in an easy and secure way! This project is compatible with Python 2.x and 3.x and tested on Windows, Mac OS X and Linux.

Getting Start

It’s best to start from the GitHub wiki page, we are looking forward to adding more modules and optimize the core.

Technologies

Currently we are using

Expected Results

Students Requirements

Mentors and Leaders

OWASP Juice Shop

OWASP Juice Shop Project is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and Angular. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a “guinea pig”-application to check how well their tools cope with Javascript-heavy application frontends and REST APIs. The best way to get in touch with us is the community chat. You can also send PMs to the potential mentors (@bkimminich, @J12934 and @CaptainFreak) there if you like!

To receive early feedback please:

Feature Pack 2019

Brief Explanation:

Ideas for potential new functionality and “business” features are collected in GitHub issues labeled “feature”. This project could implement a whole bunch of new features one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with good additional ideas for features and new functionality in the proposal could make the difference between being selected or declined as a student for this project!

Expected Results:

Getting started:

Knowledge Prerequisites:

Potential Mentors:

Juice Shop Mobile

Brief Explanation:

A complete mobile client for Juice-Shop API which will serve a legit mobile experience for Juice-Shop user as well as a plethora of Mobile app vulnerabilities and challenges around them to solve. Should in the best case translate the idea of Juice Shop’s hacking challenges with a score board and success notifications into the mobile world.

Coming up with a sophisticated proposal (optimally even with a good initial sample implementation) could make the difference between being selected or declined as a student for this project!

Getting started

Expected Results:

Knowledge Prerequisites:

Potential Mentors:

Challenge Pack 2019

Brief Explanation:

Ideas for potential new hacking challenges are collected in GitHub issues labeled “challenge”. This project could implement a whole bunch of challenges one by one and release them over the course of several small releases. This would allow the student to work in a professional Continuous Delivery kind of way while bringing benefit to the Juice Shop over the duration of the project.

Coming up with good additional ideas for challenges in the proposal could make the difference between being selected or declined as a student for this project!

Expected Results:

Getting started:

Knowledge Prerequisites:

Potential Mentors:

Your idea

Brief Explanation:

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

Getting started

Expected Results:

Knowledge Prerequisites:

Mentors:

OWASP-Securetea Tools Project

The OWASP SecureTea Project is an application designed to help secure a person’s laptop or computer / server with IoT (Internet Of Things) and notify users (via various communication mechanisms), whenever someone accesses their computer / server. This application uses the touchpad/mouse/wireless mouse to determine activity and is developed in Python and tested on various machines (Linux, Mac & Windows). The software is still under development, and will eventually have it’s own IDS(Intrusion Detection System) / IPS(Instrusion Prevention System), firewall, anti-virus, intelligent log monitoring capabilities with web defacement detection, and support for much more communication medium.

Brief Explanation

We are looking any awesome idea to improve Securetea Project that is not on this list? We are expecting make this project will be useful to everyone to secure their Small IoT.

Idea

Below roadmap and expect results you can choose to improve Securetea Project . if any bugs please help to fix it

Roadmap

See Our Roadmap

Expect Results

Students Requirement

Mentors

OWASP OWTF

Offensive Web Testing Framework (OWTF is a project focused on penetration testing efficiency and alignment of security tests to security standards like the OWASP Testing Guide (v3 and v4), the OWASP Top 10, PTES and NIST. Most of the ideas below focus on rewrite of some major components of OWTF to make it more modular. OWTF is moving to a fresh codebase with a fully Docker testing and deployment environment. If you want to get a jumpstart, check out: new arch.

OWASP OWTF - Passive Online scanner improvements

Brief Explanation

OWTF allows many passive tests, such as those using third party websites like Google, Bing, etc. searches, as well as handy “Search for vulnerability” search boxes (i.e. Fingerprinting plugin). This feature involves the creation of a “script” that produces an interactive OWTF report with the intention of hosting it in the github.io site. The idea here is to have a passive, JavaScript-only interactive report available on the owtf.github.io site, so that people can try OWTF “without installing anything”, simply visiting a URL.

This would be a normal OWTF interactive report where the user can:

The passive online scanner, simply makes OWTF passive testing through third party websites more accessible to anybody, however it is the user that must

  1. click the link manually +
  2. do something bad with that afterwards +
  3. doing 1 + 2 WITHOUT permission :). Therefore this passive online scanner does not do anything illegal More information about why this is not illegal here (recommended reading!)

For background on OWASP OWTF please see: OWASP OWTF

Expected results:

Knowledge Prerequisite:

A good knowledge of JavaScript and writing ES6 compliant React/TypeScript is needed. Previous exposure to security concepts and penetration testing is not required but recommended and some lack of this can be compensated with pre-GSoC involvement and will to learn.

OWASP OWTF Mentors:

Contact: Abraham Aranguren or Viyat Bhalodia

OWASP OWTF - MiTM proxy interception and replay capabilities

Brief Explanation:

The OWTF man-in-the-middle proxy is written completely in Python (based on the excellent Tornado framework) and was benchmarked to be the fastest MiTM python proxy. However it lacks the useful and much need interception and replay capabilities of mitmproxy.

The current implementation of the MiTM proxy serves its purpose very well. Its fast but its not extensible. There are a number of good use cases for being extensible

Bonus:

Expected results:

Knowledge Prerequisite:

OWASP OWTF Mentors:

Contact: Abraham Aranguren Viyat Bhalodia Bharadwaj Machiraju OWASP OWTF Project Leaders

OWASP OWTF - Web interface enhancements

Brief Explanation:

The current web interface is a mixture of Tornado Jinja templates and ReactJS. A complete UI change to a stable ReactJS-based interface should be the deliverable for this project. Most of the hard part for the change has already been done and added in a separate branch at OWTF on GitHub

For background on OWASP OWTF please see: OWASP_OWTF

Expected results:

Knowledge Prerequisite:

OWASP OWTF Mentors:

Contact: Abraham Aranguren Viyat Bhalodia Bharadwaj Machiraju OWASP OWTF Project

OWASP OWTF - New plugin architecture

Brief Explanation:

The current plugin system is not very useful and it is painful to browse many plugins. Most of the plugins do have much code and most of is repeated - much refactoring needed there.

This issue is documented in detail at 905.

For background on OWASP OWTF please see: OWASP_OWTF

Expected results:

OWASP iGoat

Idea 1:

Completing OWASP iGoat documentation at docs.igoatapp.com and creating demo videos at for OWASP iGoat YouTube channel for learning purpose.

Idea 2:

Adding new challenge pack / CTF for iGoat. It should be one point solution for learning iOS app security

OWASP Seraphimdroid

OWASP Seraphimdroid is Android security and privacy app, with features to enhance user’s knowledge about security and privacy on their mobile device. If you are interested in this project and working on it during Google Summer of Code, please contact Nikola Milosevic and express your interest.

Idea 1: Anomaly detection of device state

The idea is that certain features of a device would be constantly monitored (battery use, internet usage, opp calls, etc.). Initially, the usual behaviour of the device would be learned. Later, anomalies normal behavior would be reported to the user. This should involve some explanations, such as which applications are causing an anomaly the device behaviors

Idea 2: On device machine learning of maliciousness of an app

Tensor-flow for on-device processing and some other libraries have been released that enable machine learning. We have previously applied a system, that based on permissions, is able to distinguish malicious apps from non-malicious. Now, we would like to learn also from other outputs and things one can monitor about application whether it can be malicious.

Idea 3: Enhansing privacy features

The vision of Seraphimdroid is to be aware of privacy threats. This may be achieved throug knowing which applications are using user accounts or other information that uthe user has on phone to send to the server, or just by knowing which applications may be doing it. Knowledgebase shouldbbeextending with the suggestions on how to improve privacy. Also, automated settings of various apps to use encryption should be proposed.

OWASP ZAP

The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. Previous GSoC students have implemented key parts of the ZAP core functionality and have been offered (and accepted) jobs based on their work on ZAP.

Active Scanning WebSockets

Brief Explanation:

ZAP has good support for websockets, and allows them to be intercepted, changed and fuzzed. Unfortunately it doesn’t currently support active scanning (automated attacking) of websocket traffic (messages). We would like to add active scanning support to websockets, ideally in a generic way which would allow us to reuse as many of our existing rules as are relevant. Adding additional websocket specific attacks would also be very useful. This project will be a continuation of the work that was started as part of last year’s GSoC.

Expected results:

Getting Started:

Knowledge Prerequisites:

Mentors:

Simon Bennetts and the rest of the ZAP Core Team

Automated Authentication Detection and Configuration

Brief Explanation:

Currently a user must manually configure ZAP to handle authentication, eg as per FAQformauth This is time consuming and error prone. Ideally ZAP would help detect login and registration pages and provide more assistance when configuring authentication, ideally being able to completely automate the task for as many sort of webapps as possible. This project will be a continuation of the work that was started as part of last year’s GSoC.

Expected results:

Getting Started:

Knowledge Prerequisites:

Mentors:

IoT Goat

IoT Goat will be a deliberately insecure firmware based on OpenWrt. The project’s goal is to teach users about the most common vulnerabilities typically found in IoT devices. The vulnerabilities will be based on the IoT Top 10 2018.

Idea 1: Insecure firmware web application ecosystem

Brief Explanation:

A vulnerable web application, and backend API/web services deployed in OpenWrt containing critical vulnerabilities showcasing the traditional IoT problems.

Getting Started:

Expected results:

Development of a simple web application user interface with web services and API’s deployed locally on the OpenWrt firmware. Documented challenges of how to discover and remediate web software security vulnerabilities. The insecure web application services must contain the following vulnerabilities to be used with the IoT testing guide:

Knowledge Prerequisites:

Idea 2: Insecure network services

Brief Explanation:

Deliberately insecure services configured within OpenWrt such as an miniupnp daemon configured with secure_mode off (Secure mode; client can only redirect an incoming port to the client itself (same IP as the request comes from), to demonstrate a port mapping attack where an attacker from inside the network exposes a service that typically should be behind a LAN to the internet).

Getting Started:

Expected results:

Documented challenges of how to discover and remediate insecure network service vulnerabilities. The network services can be inherently insecure or have insecure configurations that can be abused during the challenges.

Knowledge Prerequisites:

Idea 3: Insecure firmware build system

Brief Explanation:

Develop custom firmware builds of the latest OpenWrt version (18.06) demonstrating the process of incorporating debug services/tools, misconfigurations, and usage of vulnerable software packages.

Getting Started:

Expected results:

Knowledge Prerequisites:

Suggest your own ideas

You may suggest additional challenges or ideas that fit this project’s objectives.

Mentors and Leaders

OWASP Web Honeypot Project

The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Within this project, Anglia Ruskin University is leading the collection, storage and analysis of threat intelligence data.

OWASP_Honeypot_Project

Honeypot-Project on GitHub

Brief Explanation

The purpose of this part of the project is to capture intelligence on attacker activity against web applications and utilise this intelligence as ways to protect software against attacks. Honeypots are an established industry technique to provide a realistic target to entice a criminal, whilst encouraging them to divulge the tools and techniques they use during an attack. Like bees to a honeypot. These honeypots are safely designed to contain no information of monetary use to an attacker, and hence provide no risk to the businesses implementing them.

The project will create honeypots that the community can distribute within their own networks. With enough honeypots globally distributed, we will be in a position to aggregate attack techniques to better understand and protect against the techniques used by attackers. With this information, we will be in a position to create educational information, such as rules and strategies, that application writers can use to ensure that any detected bugs and vulnerabilities are closed.

Idea

Project progression:

Expect Results

Some of the ideas from last year’s summit

Students Requirements

Some of the skills we are looking for:

Mentors

Suggest your own ideas

You may suggest additional challenges or ideas that fit this project’s objectives.

OWASP Risk Assessment Framework

Tool projects aim to assessment more than one or many web application using owasp risk rating mathodologies.

RiskAssessmentFramework on GitHub

Idea 1:

make dashboard with database and can assess many website based owasp risk rating mathodologies, create graph and report in pdf,word & excel format.

Ideas 2 : Static Application Security Testing.

Students Requirements

Mentors