GSoC2020 Ideas

OWASP Project Requests

Tips to get you started in no particular order:

List of Project Ideas

OWASP Python Honeypot

Explanation of Ideas

OWASP Honeypot is an open source software in Python language which designed for creating honeypot and honeynet in an easy and secure way! This project is compatible with Python 2.x and 3.x and tested on Windows, Mac OS X and Linux.

Expected Results
Getting Started

It’s best to start from GitHub wiki page, we are looking forward to adding more modules and optimize the core.

Students Requirements
Mentors

Zed Attack Proxy (ZAP)

Idea One: GraphQL Support

ZAP does not currently detect GraphQL weaknesses such as injection, auth problems, or information exposures.

Expected Results
Getting Started
Mentors

Idea Two: SSRF Detection/Handling

ZAP is currently able to detect vulnerabilities with limited local network callback support (such as XXE). ZAP could benefit from enhanced callback support in the form of a configurable or deployable daemon/listener to facilitate more external or public callbacks in order to improve detection of SSRF and other related vulnerabilities.

https://ssrfdetector.com/ was an online service for detecting Server Side Request Forgery (SSRF) vulnerabilities. It was developed and maintained by Jake Reynolds and is open source https://github.com/jacobreynolds/ssrfdetector It may be used for inspiration/ideas as well as other projects such as sleepy-puppy (Netflix), etc.

Expected Results
Getting Started
Mentors

Idea Three: Re-test Functionality

ZAP is currently able to detect vulnerabilities of various types, however it doesn’t have a user friendly mechanism for re-testing or re-validating identified weaknesses.

Refer to Issue 375 for further details, and to this User Group thread for discussion and staged implementation ideas.

Expected Results
Getting Started
Mentors

Idea Four: Your Idea

ZAP is a great framework for building new and innovative security testing solutions. If you have an idea that is not on this list then don’t worry, you can still submit it, we have accepted original projects in previous years and have even paid a student to work on their idea when we did not get enough GSoC slots to accept all of the projects we wanted.

Expected Results
Getting Started
Mentors

OWASP Juice Shop

OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!

To receive early feedback please:

Your idea

Brief Explanation:

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

Getting started
Expected Results:
Knowledge Prerequisites:
Mentors:

OWASP Security Knowledge Framework

Explanation of Ideas

OWASP-SKF is an open source security knowledgebase including manageble projects with checklists (ASVS / MASVS) and best practice code examples in multiple programming languages showing you how to prevent hackers gaining access and running exploits on your application. Develop your projects secure by design from the start using SKF.

In a nutshell

Expected Results
Getting Started

Have a look at our GitHub wiki page, run the SKF project and have a look at the Angular interface and the functionality. If you have questions or want to contact us please join us on Slack or Gitter: Join the chat at https://gitter.im/Security-Knowledge-Framework/Lobby Join the chat at https://owasp.slack.com/messages/C0F7L9X6V

Students Requirements
Mentors

OWASP SAMM

Explanation of Ideas

The mission of OWASP Software Assurance Maturity Model (SAMM) is to be the prime maturity model for software assurance that provides an effective and measurable way for all types of organizations to analyze and improve their software security posture. OWASP SAMM supports the complete software lifecycle, including development and acquisition, and is technology and process agnostic. It is intentionally built to be evolutive and risk-driven in nature.

More details are available on https://owaspsamm.org/

Expected Results
Getting Started

Have a look at our GitHub wiki page, and OWASP SAMM on https://owaspsamm.org/

Students Requirements
Mentors

OWASP Honeypot Project

The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. The main challenge of this project is to facilitate the deployment of a HoneyPot by embedding the generation of HoneyTokens into web applications, especially with the most used CMS (like Wordpress, Joomla and Drupal).

Expected results
Getting started
Student Requirements
Mentor

OWASP SecureTea

The OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices).

Expected results
Getting started
Student Requirements
Mentor

OWASP Risk Assessment Framework

Explanation of Ideas

The OWASP Risk Assessment Framework consist of Static application security testing and Risk Assessment tools. By using OWASP Risk Assessment Framework’s Static Appilication Security Testing tool Testers will be able to analyse and review their code quality and vulnerabilities without any additional setup. OWASP Risk Assessment Framework can be integrated in the DevSecOps toolchain to help developers to write and produce secure code.

Expected Results

1st Idea

2nd Idea

3rd Idea

submit you idea!

Students Requirements
Getting started:
Mentors:

OWASP Nettacker

Explanation of Ideas

OWASP Nettacker is an open source software in Python language which lets you automated penetration testing and automated Information Gathering. This software can be run on Windows/Linux/OSX under Python.

Getting started

Expected Results

Knowledge Prerequisites

Mentors

OWASP Intelligent Intrusion Detection System

Explanation of Ideas

OWASP IIDS is an open source software that leverages the benefits of Artificial Intelligence to detect the intrusion and alert the respective network administrator.

Getting started

Expected Results

Knowledge Prerequisites

Mentors

OWASP OWTF

Offensive Web Testing Framework (OWTF) is a project focused on penetration testing efficiency and alignment of security tests to security standards like the OWASP Testing Guide (v3 and v4), the OWASP Top 10, PTES and NIST. Most of the ideas below focus on rewrite of some major components of OWTF to make it more modular. OWTF is moving to a fresh codebase with a fully Docker testing and deployment environment.

OWASP OWTF - Passive Online scanner improvements

Brief Explanation

OWTF allows many passive tests, such as those using third party websites like Google, Bing, etc. searches, as well as handy “Search for vulnerability” search boxes (i.e. Fingerprinting plugin). This feature involves the creation of a “script” that produces an interactive OWTF report with the intention of hosting it in the github.io site. The idea here is to have a passive, JavaScript-only interactive report available on the owtf.github.io site, so that people can try OWTF “without installing anything”, simply visiting a URL.

This would be a normal OWTF interactive report where the user can:

The passive online scanner, simply makes OWTF passive testing through third party websites more accessible to anybody, however it is the user that must

  1. click the link manually +
  2. do something bad with that afterwards +
  3. doing 1 + 2 WITHOUT permission :). Therefore this passive online scanner does not do anything illegal More information about why this is not illegal here (recommended reading!)

For background on OWASP OWTF please see: OWASP OWTF

Expected results:
Knowledge Prerequisite:

A good knowledge of JavaScript and writing ES6 compliant React/TypeScript is needed. Previous exposure to security concepts and penetration testing is not required but recommended and some lack of this can be compensated with pre-GSoC involvement and will to learn.

OWASP OWTF Mentors:

OWASP OWTF - MiTM proxy interception and replay capabilities

Brief Explanation:

The OWTF man-in-the-middle proxy is written completely in Python (based on the excellent Tornado framework) and was benchmarked to be the fastest MiTM python proxy. However it lacks the useful and much need interception and replay capabilities of mitmproxy.

The current implementation of the MiTM proxy serves its purpose very well. Its fast but its not extensible. There are a number of good use cases for being extensible

Bonus:

Expected results:

Getting Started:

Knowledge Prerequisite:
OWASP OWTF Mentors:

OWASP OWTF - Web interface enhancements

Brief Explanation:

The current owtf web interface is implemented in ReactJs with Redux as the state manager. The project involves integration of Typescript in the code to ease the refactoring process. Complete implementation of the Login Page (APIs + frontend) with additional unit/functional tests will also be a deliverable for this project. Check out the current implementation of the web interface at OWTF on GitHub.

For background on OWASP OWTF please see: OWASP_OWTF

Expected results:
Getting Started:
Knowledge Prerequisite:
OWASP OWTF Mentors:

OWASP OWTF - New plugin architecture

Brief Explanation:

The current plugin system is not very useful and it is painful to browse many plugins. Most of the plugins do have much code and most of is repeated - much refactoring needed there.

This issue is documented in detail at 905.

For background on OWASP OWTF please see: OWASP_OWTF

Expected results:
Knowledge Prerequisite:
OWASP OWTF Mentors:

OWASP OWTF - General Improvements

Brief Explanation:

There are many small but important enhancements in the issue tracker which are too small to make a single project, but they can be grouped together to make a suitable GSoC project. The aim of the project is to implement some of the enhancements suggested in the issue tracker to improve user experience (adding new useful features and making the owtf tool easier to use), security and performance.

For background on OWASP OWTF please see: OWASP_OWTF

Expected results:
Knowledge Prerequisite:
OWASP OWTF Mentors:

OWASP Bug Logging Tool

Brief Explanation:

BLT lets anyone report issues they find on the internet. Found something out of place on Amazon.com ? Let them know. Companies are held accountable and shows their response time and history. Get points for reporting bugs and help keep the internet bug free.

Check OWASP WIKI PAGE https://www.owasp.org/index.php/OWASP_Bug_Logging_Tool for some reference;

Getting started
Expected Results:
Knowledge Prerequisites:
Mentors: