OWASP CheckList Web - owasp

In my company we use AppScan Enterprise (or Standard) for Dynamic Analysis to check the type of vulnerabilities on the websites under our observation but only that isn't enough.
Our programmers now need to use OWASP Checklist (ASVS 3.0) and fill the checklist. This process is in "alpha mode" and we are still learn about it.
What I noticed is that Mobile Checklist is really well configured with some sheets and testing procedure but the Web Checklist doesn't have that testing procedure.
We are using this guide: https://media.readthedocs.org/pdf/owasp-aasvs/latest/owasp-aasvs.pdf but we feel that's isn't enough for fill all the categories.
Can someone recommend a video with a profound explanation or some pdf's guides to complete the information we already have?
Thank you in advance.
Best Regards.

Have you seen the owasp webpage?. Perhaps this pdf could help you futher Owasp pdf and i would check here for more resources in general Owasp main page

Related

Confused between Jahia and dotcms as a java CMS

Which is better for web content management purposed only?
The website requirements include a user discussion forum and a poll survey with a good search facility and also needs a good SEO tool. The site should also load faster and should be easy to edit contents.
I can't speak to Jahia, but dotCMS can do everything you're asking for. Below are some links that should help you self evaluate dotCMS. I also would point out that dotCMS is more of a platform (makes a great user experience platform UXP) than an off-the-shelf solution and because of this your requirements might take a little work to setup and get running. With that being said, your finished product should meet your exact needs.
Site Search (uses ElasticSearch)
http://dotcms.com/docs/latest/SiteSearch
Performance Report
http://dotcms.com/aw/performance-report
I hope this helps.
Jahia should be able to handle these request. I am the opposite if Fish and have experience with jahia. Jahia does have a forum and poll component's both available as open source so you can modify the code when you require to.
What I like about jahia (among many other things) is that editing content is straight forward and very easy to for non technical persons. ofcourse it has all the permissions in place for all content so you can set it up in such a way that you don't have to be afraid that the non technical persons will mess-up a website.
Performance of Jahia, even without fancy caching proxies is very good and it can run on low resource VM's, just if you want to start small. I am using them on small Linode machines without any issues
I have not worked with Dotcms, but basic forums, polls, search, and SEO are all freely available as Jahia modules. The forums are certainly not as good as a standalone like Vanilla, but they are simple to add and administrate. Search is good and requires little configuration, and anything more than basic SEO is going to be custom work.

Which CMS is right for me? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Questions asking us to recommend or find a tool, library or favorite off-site resource are off-topic for Stack Overflow as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it.
Closed 9 years ago.
Improve this question
I am looking to help out a non-profit get a website up and running.
Only, they don't just want a website with content, they also want to maintain a database of members, and allow those members to register and pay for classes/events/seminars held by the club.
It seems to me, that if all they wanted was to post content, nearly any of the available CMS's out there would fit the bill.
But the registration portion would require some customization.
I have considered just installing a basic CMS for them, and then creating separate web application for the registration section. And this would still work...
But if I wanted to hook into the users/roles from the CMS and use them in the registration side, I think I would have to have some way of either extending the CMS or easily using it's data in the sub-application.
I have been reading about the following CMS's:
Orchard
Umbraco
C1 Composite
All of them seem to have the ability to be extended, but I'm not certain how much "work" is involved to extend each. Given that my requirements are rather simple and the fact that I don't want to spend a ton of time doing this (it is free work, after all), does anyone have a recommendation?
I'd pass on Umbraco and C1 Composite, as they generally aren't user-friendly. I think Orchard is best, as it has the best feedback of them all. Umbraco is aimed more at developers who want to tweak a lot of things.
Orchard - https://stackoverflow.com/questions/1978360/anybody-using-orchard-cms
Link - Reviews/Comparison of Open Source ASP.NET MVC CMS
Umbraco would be a very good choice because it:
is mature and has a proven track record.
is very easy to use for most use cases.
has a built-in member system which could (and should) be used for the member registration.
has a Big and friendly community always glad to help out.
has lots of plugins and extensions covering some special use cases.
If you will go outside of .NET and IIS, Joomla is another popular CMS in LAMP. This can be hosted in either Unix or Win environments. There's a large community, lots of implementations and robust API for plugins. I run it on MAMP on my Mac, and it also runs on WAMPServer, for development.
Last year I created a membership style site in Joomla using Mighty Extensions for a bed and breakfast listing service (http://uurehome.com). Mighty User and Membership was enough, this adds custom user fields and subscription plans. You do have to pay for Mighty Extensions. Payment for the B&B listings is done thru Paypal, Mighty Membership enables this.
The subscription plan feature is Mighty Membership is very good. You can have length of time, cost renewals, renewal nag messages. Could have written myself, but why at this cost :-)
Joomla can certainly handle the community side of a non-profit site, there's the usual assortment of content, discussions, news feeds and so on. It's also ok for mere mortals to administer.
Not so sure about comparing to Orchard, as I haven't kicked the tires on Orchard. I have done enterprise web CMS for a living in the past, so I am used to evaluating these sorts of products. Orchard looks similar to Joomla in how it works, based on the screenshots I see in the docs. One thing I will say with confidence is that it's easier to standup Joomla (or something LAMP/WAMP/MAMP) than on the MS Webmatrix. However, if you already have a Webmatrix provider, then it's similar. Said by someone that has done a bunch of IIS and pretty much all the web technologies going back to the beginning of time (that's 1993).
Another aspect of using Joomla for me in this project, which is for a small business, was knowing that there's a bunch of Joomla knowledgable web design shops this owner could use if I stop helping her. While I am not going to say there isn't a base of folks doing web design that are doing Orchard, my sense is that its much smaller than Joomla. This is a factor for me in helping non-profits, churches and so on, not leaving them in a place where I am the "only" person that could keep whatever it is running. Still, if there's even a couple of local web design shops that do Orchard, I'd say that's enough to feel comfortable.
We built http://aclj.org on Orchard with a custom membership implementation within to support millions of members. We do form processing through Kimbia for donations and petition signatures. We're very happy with the implementation and feel that Orchard worked out well for us as a platform. It is VERY extensible and we developed 32 custom modules in-house.
For a non profit organization it is unlikely to maintain a costly server where LAMP stack has both low cost server and some decent CMS which meets your requirements perfectly. Some of them are :
Drupal
Joomla
WordPress
Any of them are highly extensible, got a great community support , plenty of themes and modules readily available and you can get awesome things for free though there are some paid once too.
And if you want my recommendation i would go for Drupal as it provides :
Build in role management service.
Very matured and friendly community.
Great scalabilty.
Secured out of the box
And some more .......
Hope that adds a new dimension to your search :)
Best of luck
I would recommend wordpress for your requirement.
Advantages:
1. More forum support.
2. Easy to learn.
3. Very less server cost to host the site.
4. You will have N number of plugins and widgets etc...
Hope It gives some sense :)

Website development/design specification software or tool?

hello supersmart stackoverflow users!
Im wondering.. is there any software or tool (web based or otherwise) that helps and streamlines the whole technical and functional specification writing process so that we as developers/website can sit with clients, assess what they want to create/achieve and write up the spec efficiently and easily so that when its approved it can easily be passed onto the webdev people and they can create what is set out in the specification?
Thank you in advance!
Specfox is a SaaS designed just for that. You upload the screens (layouts or screen grabs), add notes and pinpoint to page elements, and generate PDFs to share with copywriters, designers and developers, or whoever you need to involve. It was the best online website specifications tool I found for a website redesign we did.
If you're still looking, take a look at Axure. It's built just for this. It's awesome

What is the "best" free CMS for my needs? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed 6 years ago.
Improve this question
I have the task to build a web-site for a smaller non-profit organization. I have a bit experience with ASP.NET but because ASP.NET hosting is rather expensive here in germany (we will also need a lot of webspace and traffic) and aslo because there are quite a hughe list of features I think I should go with a PHP/MySQL based CMS (correct me if I am wrong). The question is wich one? There are are so many free CMSs out there. If I tell you what I need, can you tell me what would be a good choice?
Here are my requirement (sorted by priority):
Ease of use (installation, configuration, maintainance) for me who builds the site but also for the members of the organisation they must be able to easily change the the content of some main pages, add supages, add a new mailinglist upload a file to the repository etc.
A membership/role management system. Based on the role of a member access to certain subpages, subforums or folders in the file management system etc. must be restricted. Only certain roles must be allowed to add new mailinglists or moderate the forum.
A mailingsystem that allows me or the members of the organistation to add new adresses, maillinglists or newsletters.
A file management system. Members should be able to upload arbitary files on the server and browse them via a web frontent. Access to folder should be restrictable based on the member rights.
A pulbic forum with private subforums.
Localization. As much as possible of the final site (if not everything) that is presented to the visitor of the site as well as to the members who maintain the site should be presented in german.
Good control over design/look and feel of the overall site. I should have good control over how I want the site to look like.
A lively community with enough momentum to find ressources and help when I am lost.
Extensibility. In case there are some smaller features missing or f the behavior of an existing feature is not quite the way I want it, it would be cool to easily add it myself.
As mentioned by others, Joomla might be a good option for you, although Wordpress may also work (and it's easier). However, I highly recommend that you check out OpenSourceCMS.com, which hosts demos for many of the free and open source CMS's, blogs, forums, shopping carts, etc. For most of them, you can try out both the admin and the frontend. Spend some time looking them over and then when you find some that you like, investigate them further by going to their websites.
Concrete5 is a new Content management system that is excellent. Easily themable, user friendly, great little dashboard for management
and it's open source
My vote would be Joomla. It has most fot he features you discussed, if not in the core as an extension, component or theme. I've set several up and rarely have to use any coding during setup, plus there's a vibrant community if you need help. It also integrates nicely with other 'best of breed' apps like BB forums, Coppermine photo gallery's and others.
Joomla! would seem to fit your needs, and I'd also suggest Kunena for the forum (which integrates with Joomla) and DOCman for the file management solution.
Well, I'd suggest Drupal for any sort of advanced web site. While Joomla! and similar systems are a bit easier to get started with, Drupal's a lot more flexible and extensible.
You want full control over theming? Or user authentication? Access control? Database queries? User picture scaling? Tagclouds?
It's there when you need it :)
I would go with Joomla too, even though I'm a ASP.NET developer.
Joomla is very flexible and customizable, so it fills all your need, because of the big community.
As a complete CMS noob, I asked myself the same question. I started with Drupal. Sure you can do lots of things with it. Very extensible and customizable.
But after implementing my first site in Drupal, I decided to create the next one in Joomla, to have a frame of comparison. Conclusion: Joomla is a looooooooooooot easier to get started and takes a lot less time to create a functioning website from scratch. Sure, for very big projects, Drupal lets you customize more, but for the type of project you suggest: I would recommend Joomla...
I found this PDF report comparing WordPress, Joomla, Drupal and Plone quite helpful when I was asking myself the same question recently. Nice comments with a focus on non-profits - find the comparison summary/recommendation on pp 13-14.
Definitely read the report because it talks about the strengths/issues of each package - given your prioritized list of features, I'd recommend Joomla. I think you can do what you want with reasonable effort and good recent modules like DocMan. WordPress is awesome for a blogging site, but lacks a number (2,3,4,9) of your requirements, and though Drupal is powerful and flexible, it definitely has a steep learning curve. Plone even more so.
Good luck!
I'd vote for DotNetNuke, it's ASP.Net but that saves you the overhead of learning a complete new environment, language and tool just to implement a 'free' CMS, realistically how much is your time worth? It meets all your criteria, and there are currently 600,000 users - which means that you can just get on with it, somewhere someone has already worked on your problems for you.
As for expensive hosting, why not host in another country, I get US$5/month for DotNetNuke in the states, and I code from Australia.
Ive had some experience with Joomla. Highly customizable, plenty of plugins and one of the liveliest communities in development. It has a great admin panel also.
Well, as told by Tom Deleu, yes, though Drupal is very capable and strong CMS but it is tough and complicated to work on. Coming to another option of CMS that is Wordpress. Though it is very easy to develop a content based websites with wordpress but with very limited scope and flexibility.
As per your requirement my vote will also go to Joomla. It is very user friendly, optimized and a CMS you can rely on. Small applications as mentioned by you like "mailing system", "File system" etc. suits joomla more than others.

Content Management system recommendations [closed]

Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 9 years ago.
Improve this question
Management is thinking of changing out Content Management Systems. What do you use/recommend?
What UCM solution is your company using?
How big is your company?
Are you happy with the implementation?
Current setup:
The company I work for uses Oracle ECM (formerly Stellent UCM).
We have somewhere over 10,000 employees across Australia, New
Zealand and Indonesia.
It works! Having worked with the system for a while now. I can see
where the initial implementation went wrong. Its 3 years later and
it is Rewrite Time! (Three year itch?)
1) CMS: Oracle's BEA Aqualogic
2) Size: 10,000+
3) Experience: As an end user with full community and content admin privileges, I find the tool to be outdated and stifling in terms of knowledge sharing and trying to get the benefits that exist in social networks. Perhaps this is due to the implementation, and not an inherent weakness in the product. Not sure of the future direction of the product either, since Oracle recently acquired it.
Our external business orientated site is running joomla which once you get passed the learning procces of how it constructs sites, is very good for a multi-user environement.
Company = 25+ people
We use Plone open source for the internal site...
We use a DotNetNuke intranet site. I think we need to upgrade or redesign cause I like Joomla much more.
1) We are moving from Microsoft Content Managemet Server 2002 to Sitecore 6.0 though we have internal PHP Wikis and Dot Net Nuke sites that have user content as well.
2) 1,000-2,000 people with about 3500 pages of Web content to migrate.
3) I'm content with it so far. There is still a lot of work to do in the migration and it will probably take a couple of years to move everything over, which includes legacy ASP and ASP.Net 1.1 and 2.0 sites that haven't been worked on in a few years as well. It would take a lot of things going easily for me to be happy with an implementation of this size.
Drupal. I've used it for small and medium sized projects.
1) We're using a CMS that was custom written in vbscript and sucks horribly. We're going to start using MODx for our external stuff, but we're not sure what's going to happen with our internal stuff.
2) A university with about 30,000 students (about 10,000 of which have ties to my department).
3) MODx looks cool, but haven't had much of a chance to use it. As stated previously, our other CMS sucks.
Tridion. And yes, there is that 3-year itch. Is Oracle on a new release or did the first implementation just look wrong now? I remember Stellent being on the development team's shortlist.
Us:
Mid-sized (small?) 700+ employee company, with over a dozen websites, but not all sites have the CMS implemented. In-house development team has worked on, and still support, a few custom solutions. Legacy code never dies. :-)
All of the CMS we researched had compelling features, but for content re-use, cross-site sharing, and programmability we found Tridion to be a good fit (compared to Ektron and RedDot). Our mandate was to stay ".NET programmers" and not have the tool take over the site.
I'm comfortable with and like with Tridion, but admire those of you who've done CMS with multiple platforms.
1) My company currently uses Word Press or no CMS at all. We are however working on a CMS that will work exactly as we want it to.
2) It's me and my friend so 2 of us
3) We're still starting up and finding clients so haven't had a chance to use it.
In my daily work, I use Tridion, and some of my colleagues use Hippo. At home I use Plone.
Institution-wide we see a variety of systems.
A few Plone sites. I'm a Plone fan.
The centre within which I work is somewhat multi-institutional (a good history of collaborative work) (one of two research centres situated within the same building) and the Plone sites that I'm setting up are fitting very nicely with diverse user/group requirements.
Companies I worked for usually developed CMS systems inhouse I've mostly worked for webshops and when cranking out websites is your core business the best way to get an edge is to be on top of this sort of thing.
So custom CMSes for:
Simplicity, just deliver what the client wants and nothing else.
Understanding it, it's developed in house so you can usually just talk to the guy who wrote it.
Profit, it's easier to ask for license fees.
We use the Alterian Content Manager application. It is very robust and suites our needs well.
20000 staff+
Very happy. Developers and business team find the application very easy to work with.