Questions tagged [code-review]
Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.
9
questions with no upvoted or accepted answers
1
vote
0
answers
125
views
What are some effective strategies to pentest a native code library?
The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" ...
1
vote
0
answers
159
views
What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?
What type of vulnerabilities would be found additional in a source code review vs a pentest?
If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
1
vote
0
answers
104
views
What is the iOS securecoding feature, and what risks does it mitigate?
iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized
Can anyone explain what this would actually protect to the ...
0
votes
0
answers
50
views
How to calculate CVSS score of a finding detected in the source code?
While I was doing source code review of API handlers for REST APIs, I found a security issue.
This issue is that some methods have the annotation @PreAuthorize("permitAll()").
If I want to ...
0
votes
0
answers
67
views
Trying to ret2text on 64bit program issues, can't jump to shell
Here is the elf summary of the program:
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
This is the ...
0
votes
0
answers
106
views
Use of JWT Token in open source project
I'm currently performing a code audit for an application that a company will release to the public as open-source in the next few days.
In this application, they use a JWT token for authentication and ...
0
votes
0
answers
173
views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
0
votes
0
answers
118
views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
-1
votes
1
answer
601
views
What is the difference between "secure code review" and "secure static code analysis"?
What are the subtle differences in both - as one could say that both are almost the same...
Static Code Analysis (also known as Source Code Analysis) is usually
performed as part of a Code ...