Wstg: 4.2 Release Notes preparation

[kingthorin]

Below is the Release Notes I've put together for 4.2. Please let me know if there's anything you disagree with or edits you'd like:

- Guide:
  - Add GraphQL API testing scenario and details (WSTG-APIT-01).
  - Add Test Objectives to all scenarios.
  - Add Testing for HTTP Method Overriding (WSTG-CONF-06).
  - Add to Review Webpage Content for Information Leakage (WSTG-INFO-05).
  - Add Testing for Session Hijacking (WSTG-SESS-09).
  - Add to Testing for Bypassing Authorization Schema (WSTG-ATHZ-02).
  - Add to Testing for Local File Inclusion (WSTG-INPV-11.1).
  - Add Appendix F: Leveraging Dev Tools.
  - Add Testing for Server-Side Request Forgery (WSTG-INPV-19).
  - Add to Testing for Weak Lock Out Mechanism (WSTG-ATHN-03).
  - Merge section Fingerprint Web Application (WSTG-INFO-09) into Fingerprint Web Application Framework (WSTG-INFO-08).
  - Merge section Testing for HTTP Verb Tampering (WSTG-INPV-03) into Test HTTP Methods (WSTG-CONF-06).
  - Merge section Testing for Stack Traces (WSTG-ERRH-02) into Testing for Improper Error Handling (WSTG-ERRH-01).
  - Update Frontispiece (Chapter 1).
  - Update Introduction (Chapter 2).
  - Update Test HTTP Strict Transport Security (WSTG-CONF-07).
  - Update Review Webserver Metafiles for Information Leakage (WSTG-INFO-03).
  - Update Penetration Testing Methodologies (Chapter 3.8).
  - Update Test HTTP Methods (WSTG-CONF-06).
  - Update Test Upload of Malicious Files (WSTG-BUSL-09).
  - Update Testing for Weak Encryption (WSTG-CRYP-04).
  - Update Testing for SSI Injection (WSTG-INPV-08).
  - Update Testing for Format String Injection (WSTG-INPV-13).
  - Update DOM-Based Cross Site Scripting to include sources, sinks, and their corresponding references (WSTG-CLNT-01).
  - Remove Testing for Buffer Overflow (WSTG-INPV-13).
  - Rewrite Fuzz Vectors (Appendix C).
  - Rewrite Testing for Weak Transport Layer Security (WSTG-CRYP-01).
  - Rewrite Role Definitions (WSTG-IDNT-01).
  - Rewrite Weak Lockout (WSTG-ATHN-03).
  - Rewrite Testing for Credentials Transported over an Encrypted Channel (WSTG-ATHN-01).
  - Rewrite Session Fixation Testing (WSTG-SESS-03).
  - Rewrite Testing for Improper Error Handling (WSTG-ERRH-01).
  - Rewrite Reporting section.
  - Update Test for Process Timing (WSTG-BUSL-04).
  - Update Contributor Guide, Style Guide, and Content Templates.
  - Standardize HTTP request/response examples.
  - Establish consistent terminology.
  - Change MiTM terminology to manipulator-in-the-middle, aligning with other industry projects such as ZAP.
  - Add reference and linking details.
  - Update references and links for tools, remove links and references for seemingly un-maintained tools.
  - Revise CIS-CAT and Wappalyzer references.
  - Add OWASP trademark registration.
- Repository housekeeping:
  - Add Codespaces support.
  - Establish GitLocalize (https://gitlocalize.com/repo/5220) as a facility through which the project will accept translations.
  - Add terminology linting.
  - Add "Sponsor" details.
  - Automate creation of JSON "checklist".
  - Add action to refresh stale issues.
  - Add README and documentation for GitHub Action workflows.
  - Add manual triggers to various workflows (such as PDF generation).
- For future use:
  - Establish a layout plan for v5.
  - Establish release plans and milestones/projects for 4.2, 4.3, and 5.0.
- Based on:
  - ~120 Pull Requests.
  - 2 Google docs for planning and data collection.
  - Innumerable Slack discussions.

• Test additions:

| Test ID | Test Name |
|---------|-----------|
| WSTG-SESS-09 | Testing for Session Hijacking |
| WSTG-INPV-19 | Testing for Server-Side Request Forgery |
| WSTG-APIT-01 | Testing GraphQL |

• Test scenarios which were re-written:

| Test ID | v4.1 Test Name | New Test Name |
|---------|----------------|---------------|
| WSTG-INPV-13 | Testing for Buffer Overflow | Testing for Format String Injection |
| WSTG-ERRH-01 | Analysis of Error Codes | Testing for Improper Error Handling |
| WSTG-CRYP-01 | Testing for Weak SSL TLS Ciphers Insufficient Transport Layer Protection | Testing for Weak Transport Layer Security |

• Test name modifications:

| Test ID | v4.1 Test Name | New Test Name |
|---------|----------------|---------------|
| WSTG-INFO-05 | Review Webpage Comments and Metadata for Information Leakage | Review Webpage Content for Information Leakage |
| WSTG-CONF-04 | Backup and Unreferenced Files for Sensitive Information | Review Old Backup and Unreferenced Files for Sensitive Information |
| WSTG-ATHZ-01 | Testing Directory Traversal - File Include | Testing Directory Traversal File Include |
| WSTG-SESS-01 | Testing for Bypassing Session Management Schema | Testing for Session Management Schema |
| WSTG-SESS-07 | Test Session Timeout | Testing Session Timeout |
| WSTG-INPV-10 | IMAP/SMTP Injection | Testing for IMAP SMTP Injection |
| WSTG-INPV-15 | Testing for HTTP Splitting/Smuggling | Testing for HTTP Splitting Smuggling |
| WSTG-ERRH-02 | Analysis of Stack Traces | Testing for Stack Traces |
| WSTG-CLNT-12 | Test Local Storage | Test Browser Storage |

[ThunderSon]

I made some small magic on what Rick provided. You can review both versions by checking the edited content.

[victoriadrake]

Ditto!

[kingthorin]

• [x] Add something about adopting GitLocalize. ~Should this go in the "Guide" or "Repo" section? (I'm thinking in "Guide" after all the leading 'Add' notes.~ @ThunderSon ✔️
  > Establish GitLocalize (https://gitlocalize.com/repo/5220) as a facility through which the project will accept translations.
• [x] Add translation info to our contribution guide. (Done in https://github.com/OWASP/wstg/pull/627)

[ThunderSon]

Since this didn't touch the guide yet, these are Repo matters.

[ThunderSon]

@victoriadrake about your changes, the buffer overflow sections were removed, and not just Update the format strings section.
Another point on error handling, where ERRH-02 was removed as well and merged into 01, so the whole ERRH section was updated, not just ERRH-01

[victoriadrake]

@ThunderSon My approach was just to list: <keyword> <section title> <code>. wherever possible, which makes the notes easier to read if you're trying to spot where something has changed. Feel free to tweak if there's something that seems misrepresented.

[ThunderSon]

What would you recommend to better describe the misrepresented points and to follow with your approach?

[victoriadrake]

Made updates above!

[ThunderSon]

In addition to the release notes above, there is a need to update the text in the frontispiece for the version 4.2

What do you think that we create a table or a list to showcase what changed for the IDs from 4.1 to 4.2 as well?

[kingthorin]

Sure go for it.

[ThunderSon]

I updated the notes to include the new additions and updates.

For the ID updates I created 3 sections with tables, let me know what you think about them:

Summary Tables _{(Click the triangle/control to expand)}

• Test Additions:

| Test ID | Test Name |
|---------|-----------|
| WSTG-SESS-09 | Testing for Session Hijacking |
| WSTG-INPV-19 | Testing for Server-Side Request Forgery |
| WSTG-APIT-01 | Testing GraphQL |

• Test ID modifications:

| Test ID | v4.1 Test Name | New Test Name |
|---------|----------------|---------------|
| WSTG-INPV-13 | Testing for Buffer Overflow | Testing for Format String Injection |
| WSTG-ERRH-01 | Analysis of Error Codes | Testing for Improper Error Handling |
| WSTG-CRYP-01 | Testing for Weak SSL TLS Ciphers Insufficient Transport Layer Protection | Testing for Weak Transport Layer Security |

• Test Name modifications:

| Test ID | v4.1 Test Name | New Test Name |
|---------|----------------|---------------|
| WSTG-INFO-05 | Review Webpage Comments and Metadata for Information Leakage | Review Webpage Content for Information Leakage |
| WSTG-CONF-04 | Backup and Unreferenced Files for Sensitive Information | Review Old Backup and Unreferenced Files for Sensitive Information |
| WSTG-ATHZ-01 | Testing Directory Traversal - File Include | Testing Directory Traversal File Include |
| WSTG-SESS-01 | Testing for Bypassing Session Management Schema | Testing for Session Management Schema |
| WSTG-SESS-07 | Test Session Timeout | Testing Session Timeout |
| WSTG-INPV-10 | IMAP/SMTP Injection | Testing for IMAP SMTP Injection |
| WSTG-INPV-15 | Testing for HTTP Splitting/Smuggling | Testing for HTTP Splitting Smuggling |
| WSTG-ERRH-02 | Analysis of Stack Traces | Testing for Stack Traces |
| WSTG-CLNT-12 | Test Local Storage | Test Browser Storage |

[kingthorin]

Im not quite clear on table two. The bullet/heading suggests an ID change but then discusses a title change like table 3.

Shouldn't table two cover the 3 merged sections? (And the existing table 2 content be moved into table 3)

[ThunderSon]

So table two is tests that are no longer the "same", as in the content changed. It's no longer BO, it's format strings. No longer error codes, error handling, etc. Not just the test name.

Feel free to edit as you see fit. About the merged sections, they still appear on the IDs, so they didn't "actually" change?

[kingthorin]

Okay now I see what you’re going for. I’ll just tweak the bullet.

[kingthorin]

This is now complete.