Main Page

From

Welcome to OWASP O2 Platform's website. The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.

This is an independent website dedicated to the OWASP O2 Platform. The content is independently created and maintained by O2's main developer Dinis Cruz.

The OWASP O2 Platform is an OWASP project and a sister website (currently a bit out-of-data) can be found at the O2 Section of the OWASP website (note that OWASP does not endorse nor subscribe to the content presented in this http://www.o2platform.com website)

Download (TRY O2)

Download

Windows ClickOnce Installer

Requirements

Windows and .NET Framework 3.5 SP1

Source Code

The source code for the O2 Platform is availabled for download via SVN at https://code.google.com/p/o2platform/source/checkout

Mailing List

The best place to keep updated with the lastest news and developers it to subscribe to the OWASP O2 Platform Mailing list (you can read its archives here)

O2 Scripting

To see a large list of script examples, take a look at the http://o2platform.wordpress.com website

Documentation

If you are looking for info on O2 features, here are a number of links to blogs and articles that cover a wide range of O2's current scripting capabilities. If you are looking for what an presentation on O2 at an event (or OWASP Chapter) looks like, see O2 Presentation at Event

Articles in O2 Blog (more updated)

The links below go to O2's Blog which is hosted at http://o2platform.wordpress.com

• .NET
  • Selecting a TabControl page in a Thread safe way
  • Humm ... .NET Random class is not Thread Safe?
  • Injecting O2 into another .NET Process (in this case NUnit.exe)
  • Adding an O2 Menu to Notepad++ and 'listen' to menu selections
  • Creating a custom version of 'O2 Quick Development Gui' environment (stand-alone and in aspx)
  • Changing a reference/dll value of a VS CSproj file
  • Removing C# class from C# file in multiple WSDL files
  • O2 Trick to complile with explict references
  • Scripting "O2 Tool - AST Search" to find Null references (.NET Static Analysis)
  • O2 Tool - AST Search (.NET Static Analysis)
  • O2 Script: consume webservices by using the WSDL's C#
  • O2 Script: Using Reflection to Invoke Bing Search Web Service
  • O2 Script: Dynamic creation of .Net Assemblies, Types, Methods, Properties and Fields
  • Making HttpRequest QueryString and Form Editable
  • Decomposing an Lamba method used in an O2 Script
  • Custom O2 for .NET Static Analysis
  • O2 Script: Create XSD and Assembly from XML file
  • Using Reflection to (try to) set .NET default proxy settings
  • Dealing with "The server committed a protocol violation. Section=ResponseStatusLine"
• EC2
  • O2 Platform Amazon EC2 Image (AMI)
  • Using 'Amazon S3 Browser' script to upload files to Amazon S3
  • New Amazon EC2 'image filtering focused' Extension Methods
  • Script to view Amazon EC2 Images List
  • Using the O2's Amazon EC2 API
  • New Amazon EC2 .Net API
  • Solved the problem with decryping AmazonEC2 Instance's password
  • Trying to Decrypt Amazon EC2 password using BouncyCastle and it is not working
  • Amazon EC2 Browser - Timer to Stop Instances
  • O2 Tool - Amazon EC2 Browser
• Fortify
  • Fortify FVDL Files - Simple Viewer based on PropertyGrid
  • Fortify FVDL Files - Looking at the API_Fortify classes that parse the fvdl data
  • Fortify FVDL Files - First working Parser and Viewer for *.fvdl files
  • Fortify FVDL files - Creating .NET classes that map to Fvdl xml structure
  • Fortify FVDL files - Creating an API and consumining it
  • Fortify FVDL files - Simple TableList Viewer Tool
  • Fortify FVDL files - Creating and consuming the schema and CSharp file
• IE Automation
  • Login into Starbucks (via BTOpenZone) using Browser Automation (Watin)
  • Visualizing the links in JPetStore (Spring MVC)
  • Writing an O2 'IE Automation' Script for JPetStore Account Creation
  • Injecting FirebugLite and jQuery into a IE Automation page (JPetStore Example)
  • Using jQuery to consume an ASP.NET Ashx from JSON in two files
  • Creating a jQuery DataTable using serialized JSON object
  • Creating a jQuery jsTree using serialized JSON object
  • Invoking jQuery from O2
  • Trigger an Keypress event in IE
  • Script to fetch and present large number of Wordpress.com blog entries
  • O2 Script to automatically upload clipboard images to Wordpress.com
  • O2 Script: Util - Javascript Object viewer
  • IE Automation: Manipulating RadioButtons
  • Running Javascript in O2's IE Automation environment
  • O2 Script: DWR Functions Viewer and Invoker
  • O2 Util: Add sites to IE trusted zone
  • O2 Method: Adding sites to IE trusted zones
  • Using WatiN as a browser automation engine
  • O2 Script to perform a google search
  • Solving WebGoat Sql Injection lesson (3rd one)
  • O2 Script - Retrieving crossdomain.xml from Google
• Interoperability
  • Submit file to Veracode Trial: using Browser and Windows Automation (WatiN and White APIs)
  • Fortify FVDL Files - Simple Viewer based on PropertyGrid
  • Fortify FVDL Files - Looking at the API_Fortify classes that parse the fvdl data
  • Fortify FVDL Files - First working Parser and Viewer for *.fvdl files
  • Fortify FVDL files - Creating .NET classes that map to Fvdl xml structure
  • Fortify FVDL files - Creating an API and consumining it
  • Fortify FVDL files - Simple TableList Viewer Tool
  • Fortify FVDL files - Creating and consuming the schema and CSharp file
  • Using 'Amazon S3 Browser' script to upload files to Amazon S3
  • Using OpenPGP to Easily create temp PGP keys for secure file exchange
  • Injecting O2 into another .NET Process (in this case NUnit.exe)
  • Consuming Veracode Findings File(s) using O2
  • Adding an O2 Menu to Notepad++ and 'listen' to menu selections
  • Simple Windows UIAutomation example
  • O2 Script: loading data from an Xslx (OpenXml) file
  • O2 Script: Installing TortoiseSVN and ProcessExplorer
  • O2 Script: Creating a Git Clone using TortoiseGIT
  • O2 Script: adding the SSH Key to GitHub
  • O2 Script: automating PuttyGen to create Public and Private Keys
  • O2 Script: Automating TortoiseGit installation
  • O2 Util: Wordpress Editor
  • O2 Script - Creating PDFs with OWASP AppSec Brazil Certificates
  • IBM AppScan Source 7.0 Scripting: Viewing *.ozasmt file Contents
  • Accessing YouTube via its C# API
  • O2 Script: Twitter OAuth using TweetSharp
• Java
  • Finding the JSP views that are mapped to controlers in JPetStore (Spring MVC)
• JPetStore
  • Submit file to Veracode Trial: using Browser and Windows Automation (WatiN and White APIs)
  • Visualizing Spring MVC Annotations based Controls (and Autobinding PetClinic's vulnerabilities)
  • Util - Java, Jsp and Xml File Search (Example using Spring MVC JPetStore)
  • Simple Viewer to see JSP files (example using Spring MVC SPetStore)
  • Packaged Spring MVC Security Test Apps: JPetStore and PetClinc
  • Visualizing the links in JPetStore (Spring MVC)
  • Finding the JSP views that are mapped to controlers in JPetStore (Spring MVC)
  • Viewing JPetStore Hsqldb database and couple more Autobinding issues
  • Writing an O2 'IE Automation' Script for JPetStore Account Creation
  • Injecting FirebugLite and jQuery into a IE Automation page (JPetStore Example)
  • Creating an API for JPetStore Browser automation
  • O2 Script: 'Spring MVC Util - View Controllers'
  • O2 Script for "Spring MVC JPetStore - Start Servers" (start/stop apache and hsqldb)
  • O2 Script with BlackBox exploits for Spring MVC AutoBinding vulnerabilities in JPetStore
• jQuery
  • Injecting FirebugLite and jQuery into a IE Automation page (JPetStore Example)
  • Using jQuery to consume an ASP.NET Ashx from JSON in two files
  • Creating a jQuery DataTable using serialized JSON object
  • Creating a jQuery jsTree using serialized JSON object
  • Invoking jQuery from O2
  • Trigger an Keypress event in IE
• Misc Topics
  • O2Script: Not Optimized fuzz string generator
  • Source code test
• Moq
  • Unit Test for HttpModule using Moq to wrap HttpRequest
  • Mocking HttpContext HttpRequest and HttpResponse for UnitTests (using Moq)
• O2 Internals
  • O2 Script to download O2 Reference DLLs from SVN
  • O2 Trick to complile with explict references
  • Decomposing an Lamba method used in an O2 Script
  • O2 Script: Downloading File
  • Creating an API to be consumed by an O2 Script
  • Consuming extension method from external file
  • Example of Custom O2 focused on a security consultant's need
  • Creating custom O2 Versions
  • Creating a Simple Ribbon Bar
  • 7th Oct - ClickOnce Publish
  • New blog engine for O2 Development related posts
• Spring MVC
  • Visualizing Spring MVC Annotations based Controls (and Autobinding PetClinic's vulnerabilities)
  • Util - Java, Jsp and Xml File Search (Example using Spring MVC JPetStore)
  • Simple Viewer to see JSP files (example using Spring MVC SPetStore)
  • Packaged Spring MVC Security Test Apps: JPetStore and PetClinc
  • Visualizing the links in JPetStore (Spring MVC)
  • Finding the JSP views that are mapped to controlers in JPetStore (Spring MVC)
  • Viewing JPetStore Hsqldb database and couple more Autobinding issues
  • Writing an O2 'IE Automation' Script for JPetStore Account Creation
  • Injecting FirebugLite and jQuery into a IE Automation page (JPetStore Example)
  • Creating an API for JPetStore Browser automation
  • O2 Script: 'Spring MVC Util - View Controllers'
  • O2 Script for "Spring MVC JPetStore - Start Servers" (start/stop apache and hsqldb)
  • O2 Script with BlackBox exploits for Spring MVC AutoBinding vulnerabilities in JPetStore
• Veracode
  • Submit file to Veracode Trial: using Browser and Windows Automation (WatiN and White APIs)
  • Consuming Veracode Findings File(s) using O2
• videos
  • WebGoat - First Example of O2 WebGoat API
  • Writing an O2 'IE Automation' Script for JPetStore Account Creation
  • O2 Script: 'Spring MVC Util - View Controllers'
  • O2 Script for "Spring MVC JPetStore - Start Servers" (start/stop apache and hsqldb)
  • O2 Script with BlackBox exploits for Spring MVC AutoBinding vulnerabilities in JPetStore
• WatiN
  • Submit file to Veracode Trial: using Browser and Windows Automation (WatiN and White APIs)
  • Login into Starbucks (via BTOpenZone) using Browser Automation (Watin)
  • Using 'Amazon S3 Browser' script to upload files to Amazon S3
  • Visualizing the links in JPetStore (Spring MVC)
  • O2 Script to download O2 Reference DLLs from SVN
  • Writing an O2 'IE Automation' Script for JPetStore Account Creation
  • Injecting FirebugLite and jQuery into a IE Automation page (JPetStore Example)
  • Creating an API for JPetStore Browser automation
  • O2 Script for "Spring MVC JPetStore - Start Servers" (start/stop apache and hsqldb)
  • O2 Script with BlackBox exploits for Spring MVC AutoBinding vulnerabilities in JPetStore
  • Creating a jQuery DataTable using serialized JSON object
  • Creating a jQuery jsTree using serialized JSON object
  • Invoking jQuery from O2
  • Trigger an Keypress event in IE
  • O2 Script to automatically upload clipboard images to Wordpress.com
  • O2 Tool - Amazon EC2 Browser
  • IE Automation: Manipulating RadioButtons
  • O2 Script: Testing for RDP server
  • Running Javascript in O2's IE Automation environment
  • O2 Util: Wordpress Editor
  • O2 Method: Adding sites to IE trusted zones
  • Using WatiN as a browser automation engine
  • O2 Script to perform a google search
  • Solving WebGoat Sql Injection lesson (3rd one)
  • O2 Script - Retrieving crossdomain.xml from Google
  • O2 Script: Twitter OAuth using TweetSharp
• WebGoat
  • WebGoat - First Example of O2 WebGoat API
• Windows Tools
  • Using OpenPGP to Easily create temp PGP keys for secure file exchange
  • O2 Script: Quick File Viewer
  • O2 Script: Testing for RDP server
  • O2 Script Sequence: Creating a Windows Registry Viewer
  • Util - Font Viewer.h2
• WS
  • O2 Script: consume webservices by using the WSDL's C#
  • O2 Script: Using Reflection to Invoke Bing Search Web Service
  • Using a webservice to get the IP Address

Articles in this Wiki

In addition to the Wiki pages below, there are a number of Videos that show the mulitple O2 modules and scripts in action.

• Help
  • Installing O2 (using .NET ClickOnce)
  • XRules Database - Taking Screenshots
• O2 AST .NET Scanner
  • O2 .NET AST Scanner - HacmeBank - SQL Injection PoC
  • O2 .NET AST Scanner - HacmeBank Example
  • O2 Ast CodeScanner - Creating Method Streams
  • O2 .NET AST Engine/Call Graph Script Examples
• Web
  • O2 Script/API GMail.cs (with video) - Using WatiN to create a GMail account|
  • O2 Script - Quick HtmlCode Viewer
  • O2 Script - Quick HtmlCode Viewer - Version 2
  • O2 Script/View Details of current Internet Explorer instances
  • O2_Scripts/WatiN/Open_page_and_show_html_elements_in_new_window
  • Script Library/Web Examples
• APIs
  • WatiN - Web Automation API (with video)
  • O2 API/Blogger API (writing a new blog post) (with video)
  • O2 API/BT Open Zone (with video)
  • O2 API/Google Maps/Save large map as JPG (just script)
  • O2 Script/Removing Spam pages from OWASP website (28 Jun 2010)
  • O2 API/Amazon S3
• DotNet
  • Languages and Frameworks/DotNet/Convert_VBNet_Into_CSharp_and_CSharp_into_VBNet
  • ViewState Decoder ASP.NET 2.0
• Vulnerable Apps
  • WebGoat/First Example of O2 WebGoat API
• O2 misc
  • O2 Script/Ask user for security credentials (Username and Password)
  • Script Library/Wiki Examples
  • O2 Scripts - Code Samples
  • O2 Script/Running Unit Tests

• O2 development
  • O2 Script/Compiling all O2 Scripts (with results in DataGridView)
  • Requested API changes/27-May-2010
  • Requested API changes/30-May-2010
  • O2 Development/Using an O2 Script to check the O2 Scripts
  • O2 Scripting Environment/Features/File:Ref