Testing for OWASP's top 10 security issues
This recipe details the automatic testing of for well-known security issues with w3af, a penetration testing tool from the Open Web Application Security Project (OWASP). For more information, visit http://w3af.sourceforge.net. OWASP's purpose is to make application visible. The OWASP's top 10 lists of insecurities for 2010 include the following:
- A2-Cross-site Scripting (XSS): An XSS attack can when an application returns an unescaped input to a client's browser. The Jenkins administrator can do this by default through the job description.
- A6-Security Misconfiguration: A Jenkins plugin you the power to write custom authentication scripts. It is easy to get scripts wrong through misconfiguration.
- A7-Insecure Cryptographic Storage: There over 600 plugins for Jenkins, each storing its configuration in separate XML files. It is quite possible that there could be a rare mistake with the storage of passwords in plain text. You will need to double-check...
