A Complete OWASP Checklist

As I wandered throughout the Internet looking for why NETCAT was not working on my laptop, I ran into a spreadsheet that potentially can help me in the future. This checklist has three worksheets.
The first worksheet serves as checklist of all the tests one must do to make sure a website is secure. The checklist is extremely interactive and can help me keep track of everything. The second worksheet summarizes all the categories of testing, the names of each test per category, a description of each test, and lastly the tools used for testing. Finally, the third worksheet provides a list and description of various testing tools.

The spreadsheet was last updated in October of 2011 and can freely be downloaded from its Google Code Site.

CMT - Testing for HTTP Methods and XST

The HTTP protocol has a bunch of methods used for interacting with the web server. Most people only know of the POST (parameters values are hidden in the HTTP request) and GET (parameter values can be seen in the URL) methods. However, there are  6 more methods in existence.  These include  HEAD, PUT, DELETE, TRACE, OPTIONS,  & CONNECT.

The PUT (allows clients to upload files), DELETE (allows client to delete files) , CONNCT (allows clients to use the web server as a proxy server to connect to other servers)  and TRACE methods should be disabled by all web servers unless it is specially needed.

For a hacker to take advantage of this, he or she must first know which methods the server supports. OWASP Testing guide states that this can be done through a program called NETCAT . Once this program is downloaded and installed, one simply has to run the following command: nc -v www.domain.com 80.  Unfourenelty, this method did not work for me and I kept running into the following error.

DNS fwd/rev mismatch: www.domain.com  hostname.domain.com
www.domain.com [xxx.xxx.xxx.xx] xx (http) open.

The next couple of days, one of my goals will be to try to get this this working since it seems like a valuable tool.  Lastly, the guide provides more information on cross site scripting using the TRACE method, but due to the NETCAT not cooperating with my computer,  trying this out will have to wait a few days.