Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to carry out similar assignments.

So far I have come across the O2 Platform but the documentation is all over the place. Microsoft's FxCop is another tool I found but their reports are horrible and I'd like something that would give me a report which I could use to further carry out a manual inspection without having to pull out my hair trying to read output.

What recommendations do you have for carrying out a code review in terms of a quality scan, free / relatively low pricing for an independent contractor and good reporting?

share|improve this question
1  
This question might end up as a 'list', which tends not to do well on IS.SE. I will point you to en.wikipedia.org/wiki/… –  schroeder Dec 10 '12 at 16:57
    
The challenge is finding a SAST tool. In terms of general code review, I saw the Wikipedia list. One article I found was at: securityninja.co.uk/application-security/… but haven't found anything similar for C#. If there's a comparison between different SAST tools in terms of costs and quality especially for a small business or independent consultant, that would be great. –  Epoch Win Dec 10 '12 at 19:12
add comment

2 Answers

SAST tools in general tend to be pretty expensive for on-site hosted solutions and for c# I'm not aware of many good free tools

One option you could look at is the on-demand style scanning that several of the tool vendors do, which is likely to be cheaper if you're doing a smaller number of scans and also is something you might be able to factor into the cost of your assessments.

Some options

share|improve this answer
add comment

Take a look at CAT.NET from Microsoft.

http://www.microsoft.com/en-us/download/details.aspx?id=19968

Its a snapin for visual studio that does static analysis on a number of different languages.

share|improve this answer
1  
CAT.NET is interesting, but unfortunately it's not (AFAIK) maintained and there haven't been any updates in the last couple of years. –  Rоry McCune Apr 19 '13 at 15:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.