07 - References and Security Resources

This directory provides an exhaustive compilation of official security standards, RFC specifications, real-world CVE case studies, OWASP cheat sheets, and tool documentation relevant to web application security engineering.

---

1. Official Standards & Security Frameworks

• OWASP Application Security Verification Standard (ASVS v4.0.3):
  • Definitive technical requirements for designing, building, and testing secure web applications.
  • OWASP ASVS Documentation
• OWASP Web Security Testing Guide (WSTG v4.2):
  • Premier cybersecurity testing methodology for web applications and APIs.
  • OWASP WSTG Repository
• OWASP Top 10 Web Application Security Risks (2021):
  • Industry benchmark awareness document for developer security priorities.
  • OWASP Top 10 Official Portal
• NIST SP 800-53 Rev 5:
  • Security and Privacy Controls for Information Systems and Organizations.
  • NIST Computer Security Resource Center

---

2. Technical RFC Specifications & Web Standards

• RFC 6749 - The OAuth 2.0 Authorization Framework:
  • IETF RFC 6749
• RFC 7519 - JSON Web Token (JWT):
  • IETF RFC 7519
• RFC 6638 - Cookie Prefixes (__Host- and __Secure-):
  • IETF RFC 6638 Draft
• W3C Content Security Policy (CSP) Level 3:
  • W3C CSP Candidate Recommendation

---

3. Real-World CVE Vulnerability Case Studies

+--------------------------------------------------------------------------------------------------+
| CVE IDENTIFIER  | VULNERABILITY TYPE      | AFFECTED SYSTEM      | IMPACT OVERVIEW               |
+-----------------+-------------------------+----------------------+-------------------------------+
| CVE-2021-44228  | Remote Code Execution   | Apache Log4j2        | JNDI / SSRF RCE via Header    |
| CVE-2019-14287  | SSRF / IMDS Exfiltration| AWS Cloud Instances  | Capital One IAM Key Leak      |
| CVE-2022-22965  | Class Loader Binding    | Spring Framework     | DataBinder RCE (Spring4Shell) |
| CVE-2021-22205  | File Upload / ExifTool  | GitLab Enterprise    | Image Upload Polyglot RCE     |
+--------------------------------------------------------------------------------------------------+

• CVE-2021-44228 (Log4Shell):
  • Analysis of JNDI injection via unsanitized log strings triggering outbound SSRF connections.
  • NIST NVD - CVE-2021-44228
• Capital One SSRF Incident (2019):
  • Case study on WAF misconfiguration permitting SSRF calls to AWS IMDSv1 endpoints.
  • US Department of Justice Case Summary
• CVE-2022-22965 (Spring4Shell):
  • RCE in Spring Framework via HTTP request parameter binding to class loader attributes.
  • Spring Security Advisory
• CVE-2021-22205 (GitLab ExifTool RCE):
  • Unrestricted file upload flaw in ExifTool metadata parsing allowing shell code execution via DJVU image payloads.
  • GitLab Security Release Announcement

---

4. OWASP Security Cheat Sheets

• XSS Prevention Cheat Sheet:
  • OWASP XSS Guidelines
• CSRF Prevention Cheat Sheet:
  • OWASP CSRF Guidelines
• SSRF Prevention Cheat Sheet:
  • OWASP SSRF Guidelines
• File Upload Security Cheat Sheet:
  • OWASP File Upload Guidelines
• Session Management Cheat Sheet:
  • OWASP Session Guidelines

---

5. Tooling & Security Automation Resources

• OWASP ZAP (Zed Attack Proxy):
  • ZAP Official User Guide & Automation Docs
• PortSwigger Burp Suite:
  • Burp Suite Documentation & Web Security Academy
• ProjectDiscovery Nuclei:
  • Nuclei Engine & Template Reference
• Semgrep SAST Engine:
  • Semgrep Rule Docs & Registry

---

6. Interactive Practice Labs & Vulnerable Apps

• PortSwigger Web Security Academy:
  • Free, interactive labs covering modern web exploits.
  • PortSwigger Academy
• OWASP Juice Shop:
  • Modern, multi-tier vulnerable web application built on Node.js, Express, and Angular.
  • OWASP Juice Shop Portal
• OWASP WebGoat:
  • Deliberately insecure application designed to teach web application security lessons.
  • OWASP WebGoat GitHub