Next week I will be talking about some of the ideas behind Groundspeed in the OWASP NY/NJ chapter meeting. The meeting will be on Tuesday, Nov 2 at the KPMG offices (345 Park Ave) from 6pm to 9pm and the agenda includes some very interesting presentations:

• Much Ado about Randomness, Aleksandr Yampolskiy
• Escaping the Sandbox, Stephen Ridley
• Memory Corruption, Exploitation, and You, Dino Dai Zovi

There will be free beer and food and there are over 200 people already registered to attend! This is supposed to be largest OWASP chapter meeting ever held! If you are in the NY/NJ area you should consider coming! For more information and a link to register check the OWASP NY/NJ chapter website.

On April 19 (1pm EDT / 18h00 GMT) I will be talking about some of the ideas behind Groundspeed on a SANS webcast titled “Manipulating Web Application Interfaces“.

For a long time we have used the same approach to perform input validation on web applications. We have seen some nice improvements at the client side proxy level (remember the old Achilles proxy? Now think about Burp), but the overall idea remained the same: place a client proxy between the browser and the web server, generate requests, intercept them and modify the HTTP parameters.

Why was manipulating the HTTP request such a successful idea that today we still assume it’s the natural way to test input validation? Has the context that forced that solution changed? Or in other words, are we still subject to the same limitations we were then? Those are some of the questions I want to discuss.

You can find more information including a link to register for it here.

I am currently working on an update for Groundspeed that should be released soon. This upcoming version will fix some bugs and add support to locales. It will support Spanish, French and Portuguese locales, so if you would prefer to use Groundspeed in one of these languages check the site next week!

Also, if you want to help translate Groundspeed into your language contact me by email!