Skip to content
This repository has been archived by the owner on Jul 4, 2024. It is now read-only.

Commit

Permalink
Updated README to remove TODO
Browse files Browse the repository at this point in the history
TODO Can be handled separately.
  • Loading branch information
dipsylala authored Nov 6, 2019
1 parent 854496d commit 9e29682
Showing 1 changed file with 0 additions and 22 deletions.
22 changes: 0 additions & 22 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,25 +58,3 @@ Install the AWS Toolkit for VS 2017 - https://aws.amazon.com/visualstudio/
## Exploitation Demos

See the `docs` folder


# TODO


## Immediate:

* Make it more easily deployable into Cloud Services (MS have lots of nice tools to help)
* Test on Greenlight.

## Ongoing:
* Add a couple of 'legacy' ASPX pages so that Greenlight can be demoed on pages (it doesn't work on CSHTML)
* DOM based XSS to demonstrate Javascript-oriented flaw remedation
* SourceClear/SCA demonstration through use of outdated/flaws 3rd party components

## Missing from here, but in Verademo
* cwe-113-http-response-splitting
* cwe-134-format-string-injection
* cwe-384-session-fixation

## Specific to .NET - possibly to implement (but bear in mind resourcing on supporting course notes)
* cwe-80 based on inadvertant exposure of public method in a controller. All controller methods are publicly accessible via get/set so look at converting to private/protected or use the [NonAction] attribute

0 comments on commit 9e29682

Please sign in to comment.