Baan Implementation: June 2020

Tuesday, June 30, 2020

FRANCIA 5: Gargantas Del Verdon II

20 de septiembre de 2017

Dedicamos todo el día a hacer un par de actividades en plena naturaleza por dentro de las Gargantas del Verdon. Empezamos haciendo una corta travesía de dos horas en kayak por su tramo inicial. Y a primera hora de la tarde hicimos un tramo de la larga excursión de Blanc Martel, que discurre por el mismo fondo de las gargantas.

Después de haber recorrido el día anterior las carreteras panorámicas de las Gargantas del Verdon para contemplar sus espectaculares paisajes, en esta jornada tocaba disfrutar de alguna de las muchas actividades de turismo activo que se puede hacer por la zona. Como el día anterior habíamos visto las gargantas desde miradores lejanos, nuestra intención era recorrer las gargantas por dentro de dos formas: haciendo kayak y senderismo. Por la mañana decidimos hacer el kayaking. Hay decenas de empresas que ofrecen alquiler de embarcaciones por todo el recorrido del río Verdon, y en nuestra zona estaban emplazadas en las orilla del lago Sainte-Croix. Lo mas interesante es escoger alguna de las pocas empresas emplazadas en la cabecera del lago, ya que permiten navegar no solo por el lago sino por un tramo de las gargantas, una experiencia totalmente única.

Nosotros escogimos Verdon Canoe, en la que el alquiler de 2 horas de un kayak para dos personas cuesta 25 €. Una cosa que nos gustó era que el kayak disponía de un bidón estanco para dejar los móviles a salvo y poderlos sacar para hacer alguna foto. Empezamos nuestra travesía con el kayak sobre las 10:30 h, hacía poco que habían abierto y apenas había gente en el agua. Remamos hacia la entrada de las Gargantas del Verdon y de sus altos acantilados. Una vez dentro de las gargantas la sensación era indescriptible; por mas que las habíamos visto el día anterior desde infinidad de miradores, estar navegando por el río rodeados completamente por los acantilados nos pareció impresionante. Además, la primera parte de la navegación la hicimos prácticamente solos, y con el silencio ese tipo de paisajes se disfruta mas. El río no llevaba apenas corriente, cosa que hacía muy fácil remar y avanzar. Nosotros lo hacíamos tranquilamente, para disfrutar plenamente de aquella maravilla.

Entrada de las gargantas

Navegando por el río

Disfrutando de nuestro kayaking

En unos tres cuartos de hora llegamos al final del tramo navegable de esa zona del río Verdon, marcado con una boya. Dimos la vuelta e iniciamos el regreso. Eran pasadas las 11 y las aguas del río se empezaban a llenar de embarcaciones. En la navegación de vuelta disfrutamos de nuevos paisajes que nos habían pasado inadvertidos al hacer la ida. Una vez que salimos de las gargantas, como nos sobraba tiempo estuvimos navegando un rato por el lago Sainte-Croix. Como sus orillas son llanas, navegar por allí no es ni mucho menos tan espectacular como hacerlo por dentro de las gargantas. Tras completar las 2 h regresamos a devolver el kayak. La experiencia nos encantó, seguramente una de las mejores de todo aquel viaje, así que la recomendamos al 100%.

Estrechos acantilados de las gargantas

Navegando entre acantilados

Remando un poco por el lago

Después del kayak tocaba el senderismo. La región de las Gargantas del Verdon está llena de posibilidades de excursionismo (se puede ver una lista aquí). Nosotros en un principio íbamos con la idea de hacer el Sentier du Pécheur, una popular excursión circular de unas 2-3 h que recorre un buen tramo del fondo de las gargantas. Pero la propietaria de nuestra casa de huéspedes nos avisó por la mañana que el sendero estaba cerrado, ya que éste atraviesa propiedades privadas y sus propietarios estaban cansados de ver tanta gente por sus tierras (a 2020 el sendero continua cerrado). Como alternativa nos dijo que podíamos hacer el Sentier Blanc Martel, también muy popular pero también mas largo y duro (7 h y 900 m de desnivel en total), aunque solo fuera un tramo. Es un sendero que va desde el Chalet de la Maline (en la Route des Crêtes, donde se deja el coche) hasta el parking del Tunnel du Baou. En temporada alta hay un servicio de navettes que te lleva desde allí al punto inicial. En aquella época no vimos rastro de aquel servicio y la falta de tiempo nos terminó de convencer de hacer solo un tramo del sendero, el que va del Tunnel du Baou hasta la Brèche Imbert, que son 7 km de los 12 del total de la excursión, evitando el tramo de mayor desnivel.

Así que volvimos a recorrer la carretera de la Route des Gorgues que habíamos hecho el día anterior. Cuando llegamos al parking del Tunnel du Baou estaba hasta arriba de coches, pero milagrosamente logramos encontrar un hueco para dejar el nuestro. Antes de empezar a caminar compartimos un kebab que habíamos comprado al pasar por La Palud-sur-Verdon. Eran sobre las 14 h cuando empezamos a caminar por el Blanc Martel. Desde allí el río atraviesa un estrecho congosto, por lo que el sendero discurre por varios túneles mas o menos largos, en los que conviene llevar una linterna. Al salir de ellos empezamos a disfrutar de los espectaculares paisajes de las gargantas, ya que el sendero discurre muy cerca del río. Estar en el fondo de las gargantas te hacía sentir muy pequeño. Además, esta parte de las gargantas es especialmente abrupta, con escarpados acantilados a lado y lado, mucho mas impresionante que la parte donde navegamos por la mañana.

Estrecho congosto al principio del sendero

Escarpados acantilados

Vistas cerca del Tunnel du Baou

Un poco mas adelante el sendero asciende de altitud y se interna en un bonito bosque de caducifolios. De vez en cuando, el bosque nos dejaba ver las maravillosas vistas que nos ofrecen las gargantas. Luego vimos que el río vuelve a llegar a otro estrecho congosto; para superarlo, esta vez el sendero serpentea hacia arriba por las faldas rocosas de la montaña, con unos tramos con algo de complicación. En esta parte vimos que había un cartel que decía que a partir de allí es de sentido único, y nosotros íbamos en contra dirección. Supusimos que esta restricción debía aplicarse en temporada alta, en la que debía haber muchos mas excursionistas (aquel día no nos cruzamos con muchos), así que continuamos. En muy poco espacio se superan unos 100 m de desnivel, para volver a bajar un poco después, llegando a un escarpado saliente esculpido por un meando del río Verdon. Este nuevo obstáculo se supera ascendiendo por unas inclinadas escaleras de hierro hasta la Brèche Imbert. Arriba hay un buen mirador, pero las vistas no son muy amplias: justo enfrente se encuentran el Balcon de la Mescla, uno de los miradores donde paramos el día anterior.

Fantásticas vistas a lo largo del Blanc Martel

Atravesando el bosque de caducifolios

Escaleras de suben a la Brèche Imbert

Vistas desde la Brèche Imbert

Habíamos tardado unas 2,5 h en llegar a la Brèche Imbert. Para que no nos pillara la noche, decidimos que no continuaríamos mas allá e iniciamos el regreso. Tardamos unas 2 h en volver nuevamente al parking del Tunnel du Baou, cuando ya empezaba a atardecer. La excursión nos encantó, poder caminar por dentro de las gargantas era una experiencia que nos hacía mucha ilusión hacer y cumplió con creces nuestras expectativas. El tramo de la excursión que hicimos no nos resultó extenuante ni complicado. Aunque hay que tener en cuenta que no hicimos el tramo con mas desnivel, el que va desde el Chalet de la Maline al fondo de las gargantas (300 m desde inicio si partes desde allí). Así que si no se quieren hacer las 7 h del Blanc Martel completo, nuestra variante es una opción recomendable.

El sendero Blanc Martel, una de las actividades más recomendables de las gargantas del Verdon

Volvimos al alojamiento a darnos una merecida ducha y a descansar un poco. Había sido un día muy productivo, con dos actividades geniales. Para cenar volvimos a Moustiers-Ste.-Marie, y comprobamos que todavía había menos restaurantes abiertos que el día anterior. Al final acabamos en Le Cantine, un pequeño restaurante familiar. Pedimos cerdo especiado y andouillette, una especie de salchicha hecha a base de tripas (intestino y estómago) de cerdo o ternera. El cerdo estaba bien, pero la salchicha de tripas no nos convenció demasiado. De postre pedimos una tabla de quesos muy buena, y los propietarios nos obsequiaron con un chupito de génépy, un licor hecho a base de artemisias. Junto con un par de copas de vino, la cena nos salió por 49,50 €.

Nuestra cena

< Anterior día	Siguiente día >
Francia 4: Gargantas del Verdon I	Francia 6: Villefranche sur Mer & Niza

Puedes leer el resto de entradas de este viaje aquí

17 Hacking Websites & forums - Underground hacker sites

NFOHump: Offers up-to-date .NFO files and reviews on the latest pirate software releases.
HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.
The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.
Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.
SecurityFocus: Provides security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
SecTools.Org: List of 75 security tools based on a 2003 vote by hackers.
Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
Hack Forums: Emphasis on white hat, with categories for hacking, coding and computer security.
Offensive Security Training: Developers of Kali Linux and Exploit DB, and the creators of the Metasploit Unleashed and Penetration Testing with Kali Linux course.
Makezine: Magazine that celebrates your right to tweak, hack, and bend any technology to your own will.
KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
Phrack Magazine: Digital hacking magazine.
Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.
DEFCON: Information about the largest annual hacker convention in the US, including past speeches, video, archives, and updates on the next upcoming show as well as links and other details.
Black Hat: The Black Hat Briefings have become the biggest and the most important security conference series in the world by sticking to our core value: serving the information security community by delivering timely, actionable security information in a friendly, vendor-neutral environment.
Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.

Friday, June 12, 2020

Reversing Some C++ Io Operations

In general decompilers are not friendly with c++ let's analyse a simple program to get familiar with it.
Let's implement a simple code that loads a file into a vector and then save the vector with following functions:

err
load
save
main

Lets identify the typical way in C++ to print to stdout with the operator "<<"

The basic_ostream is initialized writing the word "error" to the cout, and then the operator<< again to add the endl.

The Main function simply calls "vec = load(filename)" but the compiler modified it and passed the vector pointer as a parámeter. Then it bulds and prints "loaded " << size << " users".
And finally saves the vector to /tmp/pwd and print "saved".
Most of the mess is basically the operator "<<" to concat and print values.
Also note that the vectors and strings are automatically deallocated when exit the function.

And here is the code:

Let's take a look to the load function, which iterates the ifs.getline() and push to the vector.
First of all there is a mess on the function definition, __return_storage_ptr is the vector.
the ifstream object ifs is initialized as a basic_ifstream and then operator! checks if it wasn't possible to open the file and in that case calls err()
We see the memset and a loop, getline read a cstr like line from the file, and then is converted to a string before pushing it to the vector. lVar1 is the stack canary value.

In this situations dont obfuscate with the vector pointer vec initialization at the begining, in this case the logic is quite clear.

The function save is a bit more tricky, but it's no more than a vector iteration and ofs writing.
Looping a simple "for (auto s : *vec)" in the decompiler is quite dense, but we can see clearly two write, the second write DAT_0010400b is a "\n"

As we see, save implememtation is quite straightforward.

Thursday, June 11, 2020

Security Drift – The Silent Killer

Global spending on cybersecurity products and services is predicted to exceed $1 trillion during the period of five years, between 2017 to 2021, with different analysts predicting the Compound Annual Growth Rate (CAGR) at anywhere between 8 to 15%. It is not surprising to see this growth in spending, which is primarily driven by the evolving sophistication and volume of attacks as well as the

via The Hacker News

Insecurities Of WhatsApp's, Signal's, And Threema's Group Chats

Recently, the theoretical and practical analysis of secure instant messenger protocols received much attention, but the focus of prior evaluations mostly lay in one-to-one communication. In this blog post we want to presents the results of our work that focuses on group chat protocols of three major instant messenger applications; namely Signal, WhatsApp, and Threema.

In this blog post, we aim to focus on the practical impact and the found weaknesses identified by our analysis. The interested reader may also look into our paper for more details.

Our Aim and What We Were Looking For

End-to-end encryption protects the confidentiality of communication that is forwarded via central servers to the designated receivers. As a consequence, neither parties on the network route of the messages, nor the provider of the central server (e.g. the WhatsApp server) should be able to read any information out of the observation of the communication. In particular, no other user of the application should have access to the communication. Further it might be desirable to require that also the messages' integrity is end-to-end protected and that a sender is informed about the delivery state of sent messages.

Delivery state information in Signal (upper screenshot) and WhatsApp (lower screenshot)

In a two party scenario, this analysis is rather fixed to two components of the protocol: the key establishment between both parties and the communication channel protection using the established key (mostly consisting of an encryption algorithm and a scheme for providing integrity like MACs or signature schemes).

Regarded attackers

In a group setting, the same attackers apply (network, provider, other users). However the requirements for secure communication differ. It is further necessary that only group members can write to and read content from the group. Additionally, only administrators of the group are able to add new members.

In addition to these standard requirements, we also evaluated the protocols' security guarantees if the client's secrets were revealed (forward secrecy and future secrecy).

Our Approach

We analyzed the mentioned protocols by reading the source code and debugging the apps. We also used alternative open source implementations of Threema and WhatsApp as a help and we traced the network traffic. When using alternative implementations, we only took incoming traffic into account, which was generated by official applications. Thereby we extracted the protocol descriptions and evaluated them regarding the defined requirements.

Our Findings

In WhatsApp and Threema, the provider was able to manipulate the set of members. Threema only allowed the provider to rewind the set of members to a previous state. As a consequence previously removed members could have been added to the group again. The WhatsApp provider is able to arbitrarily manipulate the member set. Thereby further members and administrators can be added to the group. Since the authenticity of group manipulation is not protected, the WhatsApp provider can set the real group administrator as the source of manipulation even though this administrator was not active.

Since Signal's key exchange protocol provides future secrecy, we also evaluated the protocol's ability to recover into a secure group state after a member's state was compromised. The essential weakness here is that a sender only needs to know the static group ID to send a message to the group. If a group member receives a message with the correct group ID, no verification regarding the current member set takes place but the message is directly added to the group communication. Consequently it is sufficient to retrieve the group ID in order to send messages to the group. Since Signal treats content messages the same way as messages for the manipulation of the group set, an attacker who knows the group ID can add herself to the group and thereby read the subsequent group communication.

In addition to this, in all cases the delivery state of sent messages was not securely provided. Threema's group chats do not inform the sender about the delivery state while Signal and WhatsApp do not protect the delivery information on the end-to-end layer. Therefore the central provider can forge this information and drop messages without letting the communicating parties detect this.

Also the order of messages was manipulable for the providers of the applications such that the provider is able to deliver the messages in a different order than they were sent. Threema's weakness of rewinding a group state results from missing replay attack protection.

Impact of Weaknesses

Even though end-to-end encryption is implemented in all analyzed applications, the central providers can largely manipulate the communication in groups and partially also read it.
In all applications, the provider can undetectably drop and reorder messages during the delivery and thereby manipulate the view of the communication such that further attacks can be obfuscated.
The central servers of WhatsApp can be used to add arbitrary users to groups and thereby receive their communication.
To achieve the same result for Signal, it suffices to retrieve the group ID. An earlier member who left the group once still knows this ID since it is static. However, in contrast to WhatsApp, the origin of the manipulation is correctly displayed in the Signal application (which was not the fact when we started our analysis).

As a result, the end-to-end protection of WhatsApp is not sufficient to reach confidentiality in groups. For Signal no future secrecy is reached in groups and Threema was vulnerable to replay attacks which resulted in further weaknesses.

Responsible Disclosure

We disclosed our findings to the developers and received varying response. Threema updated their protocol in version 3.14 such that our attacks are not feasible anymore. Moxie Marlinspike responded that Signal is "working on an entirely new group mechanism that we should be deploying soon". WhatsApp did not hold out the prospect of fixing the described vulnerabilities (Update 01/18: According to Facebook's Security Head, the invite links make a fix more difficult [1]; we proposed a way to solve this issue [2]).

[1] https://twitter.com/alexstamos/status/951169036947107840
[2] https://web-in-security.blogspot.de/2018/01/group-instant-messaging-why-baming.htmlRelated word

Reversing C++ String And QString

After the rust string overview of its internal substructures, let's see if c++ QString storage is more light, but first we'r going to take a look to the c++ standard string object:

At first sight we can see the allocation and deallocation created by the clang++ compiler, and the DAT_00400d34 is the string.

If we use same algorithm than the rust code but in c++:

We have a different decompilation layout. Note that the Ghidra scans very fast the c++ binaries, and with rust binaries gets crazy for a while.
Locating main is also very simple in a c++ compiled binary, indeed is more low-level than rust.

The byte array is initialized with a simply move instruction:
00400c4b 48 b8 68 MOV RAX,0x6f77206f6c6c6568

And basic_string generates the string, in the case of rust this was carazy endless set of calls, detected by ghidra as a runtime, but nevertheless the basic_string is an external imported function not included on the binary.

(gdb) x/x 0x7fffffffe1d0
0x7fffffffe1d0: 0xffffe1e0 low str ptr
0x7fffffffe1d4: 0x00007fff hight str ptr
0x7fffffffe1d8: 0x0000000b sz
0x7fffffffe1dc: 0x00000000
0x7fffffffe1e0: 0x6c6c6568 "hello world"
0x7fffffffe1e4: 0x6f77206f
0x7fffffffe1e8: 0x00646c72
0x7fffffffe1ec: 0x00000000 null terminated
(gdb) x/s 0x7fffffffe1e0
0x7fffffffe1e0: "hello world"

The string is on the stack, and it's very curious to see what happens if there are two followed strings like these:

  auto s = string(cstr);
  string s2 = "test";

Clang puts toguether both stack strings:
[ptr1][sz1][string1][null][string2][null][ptr2][sz2]

C++ QString datatype

Let's see the great and featured QString object defined on qstring.cpp and qstring.h

Some QString methods use the QCharRef class whose definition is below:

class Q_EXPORT QCharRef {
    friend class QString;
    QString& s;
    uint p;

Searching for the properties on the QString class I've realized that one improvement that rust and golang does is the separation from properties and methods, so in the large QString class the methods are hidden among the hundreds of methods, but basically the storage is a QStringData *;

After removing the methods of QStringData class definition we have this:

struct Q_EXPORT QStringData : public QShared {
QChar *unicode;
char *ascii;
#ifdef Q_OS_MAC9
uint len;
#else
uint len : 30;

Wednesday, June 10, 2020

November 2019 Connector

OWASP
Connector

November 2019

Communications | Projects | Events | Community | Membership

COMMUNICATIONS

Letter from the Vice-Chairman

Dear OWASP Community,

Preparation for next year's conferences is underway. I had the pleasure of meeting people from our community at a recent ISACA Ireland event where I had an OWASP stand. I also had lots of swag to give away, loads left which I plan to share out amongst the community.

I was on a call recently with both WIA leadership and a number of individuals looking to broaden our diversity reach, forming DIA (diversity in AppSec). This was a positive call and I look forward to reviewing their proposal under the committee 2.0 operating model.

I'd like to thank our volunteers, chapter and project leaders for making OWASP what it is today. We wouldn't have a foundation without you. We always want to make things better, to this end, it would be great if you could fill out the following feedback form.

Thank you,

Owen Pendlebury, Vice-Chairman

FROM THE EXECUTIVE DIRECTOR

As we wind down 2019, we are planning lots of new opportunities to get involved with OWASP next year. The current working draft of the 2020 Operating Plan can be found on our staging site for our new website which is planned to launch next month.

Some of the highlights for 2020:

Quarterly Town Hall meetings.
Two Project Summits - the first in February 2020
Pilot single-day AppSec Days worldwide to offer local training and community.

We are also set to further increase the transparency of the daily workings of OWASP through our Staff Projects page. The pages linked there will always be a work in progress; some of which today are still only templates but still a great resource to know what's going on at OWASP.

All of this which adds to our Global and Regional Events, ongoing local chapter support, and other member activities. Our plans are ambitious and we look forward to your continued support this and every month as we look to better secure the web.

OWASP Foundation Global AppSec Event Dates for 2020

Global AppSec Dublin, June 15 - 19, 2020
(Formerly known as AppSec EU)
Sponsorship is now available
Call for Papers & Call for Training December 2019

Global AppSec San Francisco, October 19 - 23, 2020
(Formerly known as AppSec US)
CFP & CFT February 2020

** Visit our website for future announcements.**

NEW OWASP Project Summit - Winter 2020
February 2020 in Cancun, Mexico

The OWASP Foundation will host a three-day working session for FIVE selected projects in Cancun, Mexico, February 2020. Arrival day will be Wednesday the 19th and departures will be the 23rd. Projects must apply and then get selected to participate. The application process will require project meeting goals, work plans, key contributors, and expected attendance. The OWASP Foundation Officers Group will make the final selection. For more information click here.

You can also email Emily Berman Global Events Director or Harold Blankenship Director of Technology and Projects.

Announcing a New Opportunity to become part of a Global AppSec Program Team

Conference Program Teams are constituted for each Global AppSec event and consists of members of OWASP members and staff. The selection of team members is based on subject-matter expertise and a balanced representation of the OWASP community. For planning purposes, team members shall reside on the continent of the Global AppSec for which they serve. Teams are constituted no later than six months prior to the Global AppSec event.

To apply to become a member of the Conference Program Team click here.

We are so excited to announce that both the London OWASP and WIA community have been asked to speak at BlackHat Europe 2019 on Wednesday 4 December at the EXCEL London. Andra Lezza is leading the panel of women to "Share insights gained at different stages of their careers to help other women in the field." Thank you, Andra, for leading the initiative and also to Sonya Moisset, Bibi Sanjarani, Katy Anton and Lauren Chiesa for volunteering to be part of the panel. Also from the OWASP Community and a London Chapter Leader Sam Stepanyan and Paul Harragan. Sam and Pau will be presenting a more in-depth demo on the OWASP Nettacker. Good luck to all the speakers have a great conference.

I would like to encourage all of the OWASP community that will be attending BlackHat Europe to please make every effort to attend and support our fellow OWASP members Wednesday, 4 December 2019. (Click to view the schedule details.)

OWASP Members don't forget you are eligible for € 200.00 discount, email marketing@owasp.org for code to use when registering.

BlackHat Europe has extended an invitation to our London WIA community to lead a panel to "Share insights gained at different stages of their careers that could help other women in the field." Thank you to Andra Lezza for leading this initiative and Sonya Moisset, Bibi Sanjarani, Katy Anton and Lauren Chiesa for volunteering to be part of the panel and to contribute. Good luck I am sure your session will be a huge success.

BlackHat Europe 2019 London at EXCEL London
2019 December 2-5
The OWASP Booth 1015
Business Hall December 4 & 5
December 4, 10:30 AM - 7:00 PM
December 5: 10:00 AM - 4:00 PM

EVENTS

You may also be interested in one of our other affiliated events:

REGIONAL EVENTS

Event	Date	Location
German OWASP Day 2019	December 10, 2019	Karlsruhe, Germany
AppSec California 2020	January 21 - 24, 2020	Santa Monica, CA
OWASP New Zealand Day 2020	February 20 - 21, 2020	Auckland, New Zealand
OWASP Seasides	March 3 - 5, 2020	Panjim Goa, India
SnowFROC 2020	March 5, 2020	Denver, CO
AppSec Morocco & Africa 2020	June 4 - 5, 2020	Rabat, Morocco

GLOBAL PARTNERSHIP EVENTS

Event	Date	Location
BlackHat Europe 2019	December 2 - 5, 2019	London

PROJECTS

As the foundation moves toward the migration of the OWASP web presence from the old wiki site to our new Github-hosted home, some of you may still have questions regarding what to move and how to move it. Essentially, if you have a chapter page or project page and you have not migrated it to the new website, that would be first. Steps on what to do and what is needed can be found at https://www2.owasp.org/migration There are also some minor instructions on the default project or chapter page itself. And if you are wondering where that page is located, you can go to https://github.com/OWASP and type your chapter name in the repository search bar. If your project or chapter is not there, contact me. Lastly, there are a number of excellent examples already done by other leaders (also linked on the migration page).

And, as a precaution, you should click over into the 'Settings' of your repository and then click the 'Collaborators & teams' link on the left menu and check to make sure that the usernames added to Collaborators match what you expect. Having someone you do not know edit your web page without your knowledge is no longer the expected behavior.

Some resources, mostly for projects, have been uploaded to the OWASP Site Theme Repository and can be linked to via the /assets/image/common/<file> URL.

After your chapter or project page is done, there is a www-community repository which would include any files from the wiki that are not currently in a project or chapter or board/staff policy area. For instance, there are pages there for GSoC and XSS and CSRF. A list of the top pages that need to be migrated can be found attached to one of the TODO cards on our website migration Trello board which you are invited to join if you want to help migrate loose pages and/or perform some automation work.

Our current plan can be found on the Website Relaunch project page.

PROJECT ANNOUNCEMENT

As part of OWASP's participation in Google's Season of Docs, the ZAP project has had Nirojan Selvanathan (@sshniro) working on API documentation. The first iteration of the documentation is now live. It includes Java, Python, and shell
example snippets all presented in a responsive and accessible design which we will continue to build on in the future.

Big thanks to Nirojan for his efforts on this wonderful initiative!
Congratulations and thanks to Google Open Source for helping to bring the open-source and technical writer communities together!

COMMUNITY

Welcome to our New OWASP Chapters

Colombo, Sri Lanka
Des Moines, IA
Harrisburg, PA
Louisville, KY
Monterrey, Brazil
Moscow, Russia

Contributor Corporate Members

*Ads and logos are not endorsements and reflect the messages of the advertiser only. *

Join us

Donate

Our mailing address is:
OWASP Foundation
1200-C Agora Drive, #232
Bel Air, MD 21014

Unsubscribe

This email was sent to *|EMAIL|*
why did I get this? unsubscribe from this list update subscription preferences
*|LIST:ADDRESSLINE|*

Baan Implementation