Updating to reflect contribution to OWASP CBAS

Author: martingalloar

ChangeLog.md

@@ -4,8 +4,9 @@ Changelog
 v0.1.20 - 2022-XX-XX
 --------------------
 
-- `pysap/SAPCredv2.py`: Added subject fields instead of commonName for LPS-enabled credentials ([\#35](https://github.com/SecureAuthCorp/pysap/issues/35)). Thanks [@rstenet](https://github.com/rstenet)!
-- `pysap/SAPCredv2.py`: Add support for cipher format version 1 with 3DES ([\#35](https://github.com/SecureAuthCorp/pysap/issues/35) and [\#37](https://github.com/SecureAuthCorp/pysap/pull/37)). Thanks [@rstenet](https://github.com/rstenet)!
+- Project was contributed by SecureAuth to the OWASP CBAS Project in October 2022.
+- `pysap/SAPCredv2.py`: Added subject fields instead of commonName for LPS-enabled credentials ([\#35](https://github.com/OWASP/pysap/issues/35)). Thanks [@rstenet](https://github.com/rstenet)!
+- `pysap/SAPCredv2.py`: Add support for cipher format version 1 with 3DES ([\#35](https://github.com/OWASP/pysap/issues/35) and [\#37](https://github.com/OWASP/pysap/pull/37)). Thanks [@rstenet](https://github.com/rstenet)!
 - `pysap/SAPHDB.py`: Added missing `StatementContextOption` values (see [\#22](https://github.com/SecureAuthCorp/SAP-Dissection-plug-in-for-Wireshark/issues/22)).
 
 
@@ -18,9 +19,9 @@ v0.1.19 - 2021-04-29
 - `requirements-examples.txt`: Renamed to match `setup.py`'s extra. 
 - `pysap/SAPHDB.py`: Implementation of GSS-based auth method with Kerberos 5.
 - `pysap/SAPHDB.py`: Handling of Session Cookie values when found in the `CONNECT` response.
-- `pysap/SAPRouter.py`: Add support to route string in `SAPRouterNativeProxy` ([\#33](https://github.com/SecureAuthCorp/pysap/pull/33)). Thanks [@gloomicious](https://github.com/gloomicious)!
+- `pysap/SAPRouter.py`: Add support to route string in `SAPRouterNativeProxy` ([\#33](https://github.com/OWASP/pysap/pull/33)). Thanks [@gloomicious](https://github.com/gloomicious)!
 - `examples/router_fingerprints.json`: New fingerprints for SAP Router version 7450.34.25.5091. Thanks [@jvis](https://twitter.com/jvis)!
-- `examples/router_portfw.py`: Add support to route string. ([\#33](https://github.com/SecureAuthCorp/pysap/pull/33)) Thanks [@gloomicious](https://github.com/gloomicious)!
+- `examples/router_portfw.py`: Add support to route string. ([\#33](https://github.com/OWASP/pysap/pull/33)) Thanks [@gloomicious](https://github.com/gloomicious)!
 - `tests/sapssfs_test.py`: Basic unit tests for the SSFS file format.
 
 
@@ -51,11 +52,11 @@ v0.1.17 - 2019-11-05
 - Using Scapy version 2.4.3.
 - Added documentation of projects using `pysap`.
 - Added documentation of all example scripts.
-- `bin/pysapcar`: Add cli option to determine output directory when extracting archives with pysapcar ([\#24](https://github.com/SecureAuthCorp/pysap/pull/24)) Thanks [@okuuva](https://github.com/okuuva)!
+- `bin/pysapcar`: Add cli option to determine output directory when extracting archives with pysapcar ([\#24](https://github.com/OWASP/pysap/pull/24)) Thanks [@okuuva](https://github.com/okuuva)!
 - `pysap/SAPDiag.py`: Added support bits for SAP GUI 7.50 and SAP NW 7.52 SP01.
-- `pysap/SAPCAR.py`: Fixed crafting of archive files by defaulting length fields to zero ([\#22](https://github.com/SecureAuthCorp/pysap/issues/22)) Thanks [@okuuva](https://github.com/okuuva)!
-- `pysap/SAPMS.py`: Added the `DPInfo[1-3]` packets for handling specific Message Server `ADM` packets relaying Dispatcher/WP info: `[1-3]` because of tight SAP kernel version dependency. ([\#31](https://github.com/SecureAuthCorp/pysap/pull/31)) Thanks Mathieu ([@gelim](https://github.com/gelim)) and Dmitry ([@_chipik](https://twitter.com/_chipik))!
-- `pysap/SAPRFC.py`: Enhanced with mainly `SAPCPIC*` and `SAPRFXPG*` new packets. ([\#31](https://github.com/SecureAuthCorp/pysap/pull/31)) Thanks Mathieu ([@gelim](https://github.com/gelim)) and Dmitry ([@_chipik](https://twitter.com/_chipik))!
+- `pysap/SAPCAR.py`: Fixed crafting of archive files by defaulting length fields to zero ([\#22](https://github.com/OWASP/pysap/issues/22)) Thanks [@okuuva](https://github.com/okuuva)!
+- `pysap/SAPMS.py`: Added the `DPInfo[1-3]` packets for handling specific Message Server `ADM` packets relaying Dispatcher/WP info: `[1-3]` because of tight SAP kernel version dependency. ([\#31](https://github.com/OWASP/pysap/pull/31)) Thanks Mathieu ([@gelim](https://github.com/gelim)) and Dmitry ([@_chipik](https://twitter.com/_chipik))!
+- `pysap/SAPRFC.py`: Enhanced with mainly `SAPCPIC*` and `SAPRFXPG*` new packets. ([\#31](https://github.com/OWASP/pysap/pull/31)) Thanks Mathieu ([@gelim](https://github.com/gelim)) and Dmitry ([@_chipik](https://twitter.com/_chipik))!
 - `pysap/SAPRouter.py`: Fixed padding on SAPRouter client info packets.
 - `examples/rfc_monitor.py`: Renamed the script to `gw_monitor.py`.
 - `examples/router_scanner.py`: Add capability to provide a comma separated list of targets/ports to scan.
@@ -70,28 +71,28 @@ v0.1.16 - 2018-06-19
 - Using Scapy version 2.4.0.
 - Using Sphinx 1.7.4 for documentation.
 - Added missing `pysap.utils` package in source/binary packages.
-- Use flake8 to find syntax errors and undefined names in Travis ([\#20](https://github.com/SecureAuthCorp/pysap/pull/20)) Thanks [@cclauss](https://github.com/cclauss)!
+- Use flake8 to find syntax errors and undefined names in Travis ([\#20](https://github.com/OWASP/pysap/pull/20)) Thanks [@cclauss](https://github.com/cclauss)!
 - `pysap/SAPCAR.py`: Improved SAPCAR files parsing, adding proper structure names based on VSI documentation.
 
 
 v0.1.15 - 2018-03-27
 --------------------
 
 - Version released at Troopers'18
-- Added initial support for handling IGS (Internet Graphic Server) packets along with example scripts to play with them ([\#19](https://github.com/SecureAuthCorp/pysap/pull/19)) Thanks [@iggy38](https://github.com/iggy38)!
+- Added initial support for handling IGS (Internet Graphic Server) packets along with example scripts to play with them ([\#19](https://github.com/OWASP/pysap/pull/19)) Thanks [@iggy38](https://github.com/iggy38)!
 - Added initial support for handling PSE and SSO Credential format files.
 - `bin/pysapgenpse`: New binary tool for working with PSE and SSO credential files.
 - `bin/pysapcar`: Added options for creating a new archive and appending files to an existing one.
 - `pysap/SAPCredv2.py`: New module for SSO Credential files definitions and decryption logic.
-- `pysap/SAPDiagItems.py`, `extra/parsesupportbits.py`: Corrected order of support data bit fields ([\#18](https://github.com/SecureAuthCorp/pysap/pull/18)). Thanks [@hnzlmnn](https://github.com/hnzlmnn)!
-- `pysap/SAPIGS.py`: New module for IGS packets layer ([\#19](https://github.com/SecureAuthCorp/pysap/pull/19)).
+- `pysap/SAPDiagItems.py`, `extra/parsesupportbits.py`: Corrected order of support data bit fields ([\#18](https://github.com/OWASP/pysap/pull/18)). Thanks [@hnzlmnn](https://github.com/hnzlmnn)!
+- `pysap/SAPIGS.py`: New module for IGS packets layer ([\#19](https://github.com/OWASP/pysap/pull/19)).
 - `pysap/SAPLPS.py`: New module for LPS definitions and INT/DP API decryption logic.
 - `pysap/SAPMS.py`: Added Message Server Domain field, MS J2EE Cluster/Header/Service packets. Thanks Albert Zedlitz!
 - `pysap/SAPPSE.py`: New module for PSE files definitions and decryption logic.
 - `pysap/utils.py`: Moved utils classes into a package.
-- `examples/diag_login_brute_force.py`: Detect invalid clients while logins ([\#17](https://github.com/SecureAuthCorp/pysap/pull/17)). Thanks [@hnzlmnn](https://github.com/hnzlmnn)!
+- `examples/diag_login_brute_force.py`: Detect invalid clients while logins ([\#17](https://github.com/OWASP/pysap/pull/17)). Thanks [@hnzlmnn](https://github.com/hnzlmnn)!
 - `examples/dlmanager_decrypt.py`: Replaced use of PyCrypto with Cryptography library.
-- `examples/igs_*.py`: New example scripts to interact with IGS services ([\#19](https://github.com/SecureAuthCorp/pysap/pull/19)).
+- `examples/igs_*.py`: New example scripts to interact with IGS services ([\#19](https://github.com/OWASP/pysap/pull/19)).
 - `examples/rfc_monitor.py`: Added `noop` command in the monitor and version command line option.
 - `examples/ms_*.py`: Added command line option to specify Message Server Domain.
 - `extra/pse2john.py`: New extra script to extract crypto material in John the Ripper format.
@@ -105,23 +106,23 @@ v0.1.14 - 2017-10-04
 - `pysap/SAPRouter.py`: Fixed route request for more than one SAP Router when using the native proxy.
 - `pysap/SAPRouter.py`: Allow route strings to use lowercase separator chars (e.g. "/h/host/s/port").
 - `pysap/SAPRouter.py`: Allow a `SAPRoutedStreamSocket` to bypass the NI layer if no route was specified but talk mode
-  was set to raw ([\#10](https://github.com/SecureAuthCorp/pysap/pull/10)).
+  was set to raw ([\#10](https://github.com/OWASP/pysap/pull/10)).
 - `pysap/SAPRouter.py`: Enhanced the version retrieve routine by not failing when an error is returned by the server
-  ([\#11](https://github.com/SecureAuthCorp/pysap/issues/11)). Thanks [@gelim](https://github.com/gelim)!
-- `pysap/SAPRouter.py`: Fixed missing eyecatcher in control messages ([\#10](https://github.com/SecureAuthCorp/pysap/pull/10)).
+  ([\#11](https://github.com/OWASP/pysap/issues/11)). Thanks [@gelim](https://github.com/gelim)!
+- `pysap/SAPRouter.py`: Fixed missing eyecatcher in control messages ([\#10](https://github.com/OWASP/pysap/pull/10)).
   Thanks [@gelim](https://github.com/gelim)!.
 - `examples/diag_login_screen_info.py`: Script was improved by better printing technical information and
-  outputting login screen text items (language, input fields, login text) ([\#14](https://github.com/SecureAuthCorp/pysap/pull/14)).
+  outputting login screen text items (language, input fields, login text) ([\#14](https://github.com/OWASP/pysap/pull/14)).
   Thanks [@gelim](https://github.com/gelim)!.
 - `examples/diag_login_brute_force.py`: Script was improved to handle currently logged in users
-  ([\#16](https://github.com/SecureAuthCorp/pysap/pull/16)). Thanks [@hnzlmnn](https://github.com/hnzlmnn)!
-- `example/router/admin.py`: Improved client list table display and fixed timestamps ([\#12](https://github.com/SecureAuthCorp/pysap/issues/12)).
+  ([\#16](https://github.com/OWASP/pysap/pull/16)). Thanks [@hnzlmnn](https://github.com/hnzlmnn)!
+- `example/router/admin.py`: Improved client list table display and fixed timestamps ([\#12](https://github.com/OWASP/pysap/issues/12)).
   Thanks [@gelim](https://github.com/gelim)!.
 - `examples/ms_dump_param.py`: New example script to list Message Server parameters and check them against a list of
-  expected values ([\#15](https://github.com/SecureAuthCorp/pysap/pull/15)). Thanks [@iggy38](https://github.com/iggy38)!
+  expected values ([\#15](https://github.com/OWASP/pysap/pull/15)). Thanks [@iggy38](https://github.com/iggy38)!
 - `examples/ms_dos_exploit.py`: New example script to check for [CVE-2017-5997](https://erpscan.com/advisories/erpscan-16-038-sap-message-server-http-remote-dos/)
   DoS vulnerability on Message Server and fixed at [SAP Note 2358972](https://launchpad.support.sap.com/#/notes/2358972)
-  ([\#10](https://github.com/SecureAuthCorp/pysap/pull/10)). Thanks [@vah13](https://github.com/vah13) and [@gelim](https://github.com/gelim)!
+  ([\#10](https://github.com/OWASP/pysap/pull/10)). Thanks [@vah13](https://github.com/vah13) and [@gelim](https://github.com/gelim)!
 
 
 v0.1.13 - 2017-02-16
@@ -153,7 +154,7 @@ v0.1.12 - 2016-12-16
 - `examples/diag_capturer.py`: Added option to display available capture interfaces.
 - `examples/enqueue_dos_exploit.py`: New example script to check for [CVE-2016-4015](https://erpscan.com/advisories/erpscan-16-019-sap-netweaver-enqueue-server-dos-vulnerability/)
   DoS vulnerability on Standalone Enqueue Server and fixed at [SAP Note 2258784](https://launchpad.support.sap.com/#/notes/0002258784)
-  ([\#6](https://github.com/SecureAuthCorp/pysap/pull/6)). Thanks [@vah13](https://github.com/vah13)!
+  ([\#6](https://github.com/OWASP/pysap/pull/6)). Thanks [@vah13](https://github.com/vah13)!
 - `examples/router_fingerprints.json`: Added fingerprints from SAP Router releases 745.
 
 
@@ -200,8 +201,8 @@ v0.1.8 - 2015-10-29
 
 - Enabled travis containers for more quick builds.
 - Minor documentation and README improvements.
-- `pysap/SAPRouter.py`: Documented some version numbers from old releases ([\#3](https://github.com/SecureAuthCorp/pysap/pull/3)). Thanks [invisiblethreat](https://github.com/invisiblethreat)!
-- `pysapcompress/vpa108csulzh.cpp`: Improved the fix for CVE-2015-2278 by properly initializing arrays ([\#4](https://github.com/SecureAuthCorp/pysap/pull/4)). Thanks [ret5ret](https://github.com/ret5ret)!
+- `pysap/SAPRouter.py`: Documented some version numbers from old releases ([\#3](https://github.com/OWASP/pysap/pull/3)). Thanks [invisiblethreat](https://github.com/invisiblethreat)!
+- `pysapcompress/vpa108csulzh.cpp`: Improved the fix for CVE-2015-2278 by properly initializing arrays ([\#4](https://github.com/OWASP/pysap/pull/4)). Thanks [ret5ret](https://github.com/ret5ret)!
 - `examples/diag_render_login_screen.py`: Fail gracefully if `wx` is not found.
 - `examples/router_password_check.py`: Updating the `fau_timer` library in use and failing gracefully if it's not found.
 - `examples/router_fingerprint.py`: New example script for performing fingerprint over SAP Router versions.

README.md

@@ -1,12 +1,10 @@
 pysap - Python library for crafting SAP's network protocols packets
 ===================================================================
 
-[![Build and test pysap](https://github.com/SecureAuthCorp/pysap/workflows/Build%20and%20test%20pysap/badge.svg)](https://github.com/SecureAuthCorp/pysap/actions?query=workflow%3A%22Build+and+test+pysap%22)
+[![Build and test pysap](https://github.com/OWASP/pysap/workflows/Build%20and%20test%20pysap/badge.svg)](https://github.com/OWASP/pysap/actions?query=workflow%3A%22Build+and+test+pysap%22)
 [![Latest Version](https://img.shields.io/pypi/v/pysap.svg)](https://pypi.python.org/pypi/pysap/)
 [![Documentation Status](http://readthedocs.org/projects/pysap/badge/?version=latest)](http://pysap.readthedocs.io/en/latest/?badge=latest)
 
-SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. All rights reserved.
-
 Version 0.1.20.dev0 (XXX 2022)
 
 
@@ -68,8 +66,8 @@ To install pysap simply run:
     $ python -m pip install pysap
 
 pysap is compatible and tested with Python 2.7. A Python 2/3 compatible version
-is [in the workings](https://github.com/SecureAuthCorp/pysap/tree/python2-3) but
-it's [not finalized yet](https://github.com/SecureAuthCorp/pysap/projects/1).
+is [in the workings](https://github.com/OWASP/pysap/tree/python2-3) but
+it's [not finalized yet](https://github.com/OWASP/pysap/projects/1).
 
 Documentation
 -------------
@@ -87,9 +85,10 @@ file for more details.
 Authors
 -------
 
-The library was designed and developed by Martin Gallo from [SecureAuth's Innovation
-Labs](https://www.secureauth.com/labs/) team, with the help of a large number of
-contributors.
+he tool was initially designed and developed by Martin Gallo wile working at
+[SecureAuth's Innovation Labs](https://www.secureauth.com/labs/) team, with the
+help of many contributors. The code was then contributed by SecureAuth to the
+OWASP CBAS Project in October 2022.
 
 ### Contributors ###
 
@@ -134,7 +133,7 @@ Contact Us
 ----------
 
 Whether you want to report a bug, send a patch, or give some suggestions
-on this package, drop us a few lines at oss@secureauth.com.
+on this package, drop a few lines to
+[OWASP CBAS' project leaders](https://owasp.org/www-project-core-business-application-security/#leaders).
 
 For security-related questions check our [security policy](SECURITY.md).
-

SECURITY.md

@@ -4,4 +4,4 @@ Security Policy
 Although this initiative is not meant to be used in productive environments,
 if you consider that you have identified an issue that might affect the
 security of its users, or you understand that the tool is being abused,
-you can contact us at oss-security@secureauth.com.
+you can contact [OWASP CBAS' project leaders](https://owasp.org/www-project-core-business-application-security/#leaders).

bin/pysapcar

@@ -1,8 +1,7 @@
 #!/usr/bin/env python2
+# encoding: utf-8
 # pysap - Python library for crafting SAP's network protocols packets
 #
-# SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. All rights reserved.
-#
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; either version 2
@@ -14,7 +13,8 @@
 # GNU General Public License for more details.
 #
 # Author:
-#   Martin Gallo (@martingalloar) from SecureAuth's Innovation Labs team.
+#   Martin Gallo (@martingalloar)
+#   Code contributed by SecureAuth to the OWASP CBAS project
 #
 
 # Standard imports

bin/pysapgenpse

@@ -1,8 +1,7 @@
 #!/usr/bin/env python2
+# encoding: utf-8
 # pysap - Python library for crafting SAP's network protocols packets
 #
-# SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. All rights reserved.
-#
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; either version 2
@@ -14,7 +13,8 @@
 # GNU General Public License for more details.
 #
 # Author:
-#   Martin Gallo (@martingalloar) from SecureAuth's Innovation Labs team.
+#   Martin Gallo (@martingalloar)
+#   Code contributed by SecureAuth to the OWASP CBAS project
 #
 
 # Standard imports

bin/pysaphdbuserstore

@@ -1,8 +1,7 @@
 #!/usr/bin/env python2
+# encoding: utf-8
 # pysap - Python library for crafting SAP's network protocols packets
 #
-# SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. All rights reserved.
-#
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; either version 2
@@ -14,7 +13,8 @@
 # GNU General Public License for more details.
 #
 # Author:
-#   Martin Gallo (@martingalloar) from SecureAuth's Innovation Labs team.
+#   Martin Gallo (@martingalloar)
+#   Code contributed by SecureAuth to the OWASP CBAS project
 #
 
 # Standard imports

docs/conf.py

@@ -23,8 +23,7 @@
 
 
 project = u'pysap'
-copyright = u'SECUREAUTH LABS. Copyright (C) 2021 SecureAuth Corporation. All rights reserved.'
-author = u'Martin Gallo, SecureAuth Corporation'
+author = u'Martin Gallo, OWASP CBAS Project'
 
 # The short X.Y version
 version = pysap.__version__

docs/dev/index.rst

@@ -54,7 +54,7 @@ Code contributions
 
 When contributing code, follow this checklists:
 
-1. Fork the repository on `GitHub <https://github.com/SecureAuthCorp/pysap/>`_.
+1. Fork the repository on `GitHub <https://github.com/OWASP/pysap/>`_.
 2. Run the tests to check that all current tests pass on the system. If they don't,
    some investigation might be required to determine why they fail. Note that current
    tests are limited and only covers some of the protocols and client interfaces.
@@ -76,7 +76,7 @@ library's core components and example scripts.
 
 When submitting bugs, follow this checklist:
 
-1. Check current `GitHub issues <https://github.com/SecureAuthCorp/pysap/issues>`_ for
+1. Check current `GitHub issues <https://github.com/OWASP/pysap/issues>`_ for
    potential duplicates.
 2. Create a new issue detailing as much information as possible. Packet captures are
    always helpful when dealing with specific packets missing or client interface errors.

docs/examples/router.rst

@@ -120,7 +120,7 @@ not found in the database:
     [-] Request: Empty route null offset
     [-] Request: No route invalid length
 
-    [-] Some error values where not found in the fingerprint database. If you want to contribute submit a issue to https://github.com/SecureAuthCorp/pysap or write an email to mgallo@secureauth.com with the following information along with the SAP Router file information and how it was configured.
+    [-] Some error values where not found in the fingerprint database. If you want to contribute submit a issue to https://github.com/OWASP/pysap or write an email to mgallo@secureauth.com with the following information along with the SAP Router file information and how it was configured.
 
 
     New fingerprint saved to: saprouter_new_fingerprints.json