O2: 'Open Platform for automating application security knowledge and workflows'

By Michael Foord -
Dinis Cruz is a Web Application Security expert and is the chief technology evangelist for the Open Web Application Security Project (OWASP).

Dinis has been blogging about an "open source project designed to improve the productivity and capabilities of security consultants who perform application security engagements".

This project support Python on the JVM through Jython and Python on .NET through IronPython.
 In a nutshell, O2 is a bunch of (about 25) open source modules/tools that help with the multiple aspects of performing application security engagement (in most cases by extending the capabilities of a several Commercial and Open Source tools).

There is a large number of O2 modules that are designed to work specifically with the Ounce 6.x product (Ounce Labs Static Analysis engine), and several other O2 modules which are 100% independent and can be used using only freely available or Open Source tools.

One of the most powerful features of O2 is its scripting and customization capabilities. Currently O2 supports scripting in
any .Net language (with an O2 module dedicated for coding and debugging C#),
  • Java using IKVM
  • Python & Java with a via Jython and
  • Python & .NET via IronPython.
Everything in O2 is exposed via powerful object models and schemas (which are designed to make the security consultant much more productive).
The OUNCE O2 project has a page and code samples on using Python / C#.
I recieved last week a great set of OSA/O2 questions which are better answered here (see also the code samples at the end which are a good examples of the powerful O2 Finding's filtering capabilities).

...


Using the O2_Tool_Python to write a Python script:

step 1) Open the O2 'Scripts' module (from the 'Loaded O2 Module' menu)
step 2) select a *.py script from the samples on the left hand side
(optional) step 3) save it with a different name (use the properties button to open the save dialog)
step 4) enter the python script below in the source code area (you will need to fix the path to your local webgoat.ozasmt file and O2_Binaries folder)
step 5) select 'IronPython' engine
step 6) click on 'Execute on External Script Engine' (the big red exclamation mark). This will save and execute the code.

Comments

Post a Comment

Popular posts from this blog

Extending Abobe Flash Player and AIR with Python and Ruby

By Michael Foord -
An intriguing blog entry about an Adobe experimental project. It is a C/C++ cross- compiler for the flash player and AIR. This means that you can (will be able to?) cross-compile the Python / Ruby/ lots of other language runtimes and then run them in Flash. The blog entry contrasts this approach to the DLR which requires the re-implementation of dynamic languages - hence IronPython and IronRuby. The project is already beyond proof-of concept, they even have Quake III cross-compiled and running in Flash. Extending Adobe Flash Player and AIR with C/C++ Cross-Compiler Quake 3 has already been ported to managed code , but this is even more impressive. Whether the Python interpreter can be cross-compiled to run on top of another runtime (with completely different basic types), without changing the language semantics at all, has yet to be proved - but it is a very interesting project. (It also means that Python/Ruby will possibly be enabled only by additional optional downloads - but don'
Read more

Should Python Projects Support IronPython and Jython?

By Michael Foord -
The maintainers of the Spring Framework for Python ( Spring Python ) wonder how much of a priority it is to have compatibility with platforms other than CPython. In other words, should they support IronPython and Jython - and if so what should they do about their C extension dependencies? This question sparks a good discussion and is relevant to many other Python projects and applications: Need for supporting IronPython, Jython? " One of the topics on my mind recently, as we consider refactoring the core container, is how we ensure that when we introduce internal dependencies, such as possibly the Amara libraries for XML processing, what secondary constraints we might be introducing. " " For example, Amara represents a very pythonic and therefore simple to read and use approach to developing XML processing, such as our very own XML application configuration parsers. So from that perspective, things are very attractive. But then you ask the question, "can I run this
Read more

Further Adventures of the Debugger

By Michael Foord -
Harry Pierson (Microsoft IronPython PM) has been experimenting with writing an IronPython debugger ( ipydbg ) on top of the .NET MDbg APIs. When we last left him , he had implemented Just My Code (JMC) support allowing you to step into IronPython code. Since then he has made a lot of progress including a colourful REPL (interactive console) and solving some difficult problems around getting to real values behind boxed IronPython variables (needed for showing local variables). He has blogged extensively on what he has been up to (more recent posts last): Showing Source Code Colorful Console IronPython ConsoleColorMgr (the colorful console code pulled out into a separate IronPython module) A Little Hack...err...Cleanup Getting Local Variables Displaying Values Command Routing Getting Arguments REPL Console A lot of functionality is now present. In the command routing entry Harry outlines the seven commands supported by the debugger so far: Continue, Quit, Show Stack Trace, Show Locals,
Read more