OWASP Site Generator Refresh

towards Application Security Tool Benchmarking Environment

by Dmitry Kozlov

Project goal

To evolve OWASP Site Generator (OSG) to become benchmarking environment for web application scanners.

This tool should generate source code of a working web application based on a number of inputs, such as the number of pages, types of pages, functions, security controls, and backend systems. The tool should allow specification of the types and number of vulnerabilities to embed in the application.

Objectives

Site Generator improvements:• Enable OSG to build working application instead of existing

dynamic stub approach. • Enable OSG to generate web application with different

backends: ASP, Java, etc. • Improve OSG GUI. • Enable generated web application to log all requests

received. • Create backend-independent library of web application

building blocks: navigation elements and vulnerabilities.

Project contribution

• New OSG v2: generates source code for application, new GUI.

• Ability to generate .Net and JSP web applications.

• Library of vulnerabilities based on NIST and old OSG, library of navigational elements.

Status and Future Steps

Alfa, problems with reviewers, unfinished.

UNFINISHED:• Testing and documenting• Design of generated sites

Future work:• Site “logic”, interconnected building blocks to perform for

example second order injections• More interesting site templates