Merge REST Assessment CS into WSTG

[ThunderSon]

What would you like added?
Following the issue from the CheatSheets project, Issue 367 discusses the move of Rest Assessment CS to WSTG

What do you think? If yes, this can modified to fit with the REST testing scenario

[Hsiang-Chih]

@kingthorin
I can help, but I am thinking where/which section we may add the information? Any advices?

Reference
REST_Security_Cheat_Sheet

REST_Assessment cs

[ThunderSon]

@Hsiang-Chih This will be part of #492
Let's discuss this there and see how things can be structured.
We can create a section for API testing that will contain them, we'll have to review the identifiers and how this can be smooth in terms of usage.
If you're willing to lead on the REST effort, I don't mind having it in parallel.

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[za]

Merged REST cheatsheet into WSTG @ThunderSon @kingthorin in PR #800 Now we may start discussing how we gonna structure testing REST application section.

[ThunderSon]

@za apologies for not interacting on this ticket yet.
Thanks for bringing in the content from the CSS project. Can you tell me what your idea would look like for the testing section for REST APIs?
We usually discuss things in issues as we move it into a PR.

[za]

@ThunderSon I thought CSS was Cascading Style Sheet 😅 I've no significant idea at the moment to improve of what's already written here in CSS https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/REST_Assessment_Cheat_Sheet.md

Before we proceed, I'd like to know what's the difference between OWASP WSTG vs CSS? Are the audience expecting to be more hands on (step-by-step approach) on WSTG?

[ThunderSon]

Hey @za , the difference between the two projects is the following:

• OWASP CSS is focused on delivering content to builders in "cheat" manner, because as we all know, security sometimes can be daunting and overwhelming.
• OWASP WSTG focuses on providing the reader with knowledge similar to a book, scenario by scenario, and where possible linked together (it's a book after all). This is for attackers, and not builders. Builders can definitely use it to test and make sure things are well protected (that makes them attackers too at that bit).

Back when the REST CS (cheat sheet) was written, there was no clear focus on who's consuming it. By now, it's old, so definitely requires an update. The methodology is still similar, no debating that.

What should be done is the transformation of the look of that CS into how our template guide is shaped like (@kingthorin shared it on the PR, and it's in our root directory).
Our template depicts an attacker's flow, and should help guide you on what we're expecting.

Let me know how I can help further :)

[kingthorin]

https://github.com/OWASP/wstg/blob/master/REST_CS_Migrate.md