Tagged Questions
0
votes
1answer
85 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
4
votes
3answers
275 views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
6
votes
1answer
242 views
How many iterations of fuzzing is enough?
Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code.
My question: How much fuzzing is enough? Are there are any standards or best ...
5
votes
6answers
733 views
Fortify360 - Sinks & Sources - Vulnerability count
In an application security environment, I use Fortify Software's Fortify360 on a daily basis.
One of my biggest hurdles is explaining the numbers (sources vs sinks)
Fortify flags each location in ...
5
votes
4answers
533 views
Benefits of secure code review in-IDE vs. fatapp vs. webapp
For those of you who have worked with commercial secure code review tools such as:
Klocwork
Coverity
Armorize
Fortify
Checkmarx
Appscan Source Edition (formerly
Ounce)
Or perhaps a free or ...
7
votes
5answers
835 views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
6
votes
4answers
149 views
Is external vuln scanning sufficient?
Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it?
From the original Area51 proposal.
11
votes
9answers
1k views
What are some good website security scanning solutions?
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
