blazingwind / owasp-asvs-4.0-testing-guide

OWASP ASVS 4.0 testing guide

Introduction

The OWASP ASVS 4.0 testing guide is an unofficial supporting document to the OWASP Application Security Verification Standard which attempts to describe each level 1 control, what are the consequences of not being compliant with it, how to test it - with known open source tools or manually - and the criteria for the control to be valid. Additionally, to several controls there have been developed scripts using bash or OWASP ZAP scripting engine to automate the check of said controls. The "ZAP-scripts" folder includes a guide on how to get started with ZAP scripts.

The aim of this project is to assist companies and organizations with getting started with using OWASP ASVS.

Find more about the project in an article on ZAProxy's website: Automate checking ASVS controls using ZAP scripts

Download

PDF version of OWASP ASVS 4.0 testing guide

Contributions

Check out CONTRIBUTING.md

owasp-asvs-4.0-testing-guide's Issues

capturing User stories, and Chef Inspec and OPA tests

Some brilliant work here.
I had made a suggestion last year on main ASVS repo (OWASP/ASVS#813) to start creating User Stories and associated validations with Chef Inspec and Open Policy Agent REGO policies (you currently have Python and ZAP scripts).
Would you consider hosting the associated User Stories as an element for each control ? I'd be happy to start submitting some PRs for that info.
I'll be doing a lot related to this in my company this year, so would expect to contributing OPA and User Stories

IMAP injection script is not valid python

Attempting to run the IMAP injection test fails due to this line, which is not valid Python.

OWASP-ASVS-4.0-testing-guide/ZAP-scripts/active/5-2-3-imap-injection.py

Line 39 in b2afde6

attack = + element