Tagged Questions

5
votes
2answers
122 views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
8
votes
4answers
402 views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
1
vote
2answers
402 views

Are there any free static analysis tools for C# / .NET code

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
4
votes
6answers
376 views

Could a computer program be used to automate testing for trapdoors?

Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
1
vote
2answers
183 views

Is the following code vulnerable? [closed]

Is following code vulnerable? If yes, how it can be exploited? <% Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite"); String someSiteUrl = ...
0
votes
1answer
102 views

Which software scans software for potential vulnerabilities?

Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
3
votes
3answers
254 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: ...
6
votes
1answer
488 views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
10
votes
5answers
697 views

Code Analysis: Binary vs Source

While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
7
votes
5answers
587 views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...