Questions tagged [code-review]

Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.

9 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1 vote
0 answers
125 views

What are some effective strategies to pentest a native code library?

The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" ...
the_endian's user avatar
  • 1,169
1 vote
0 answers
159 views

What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?

What type of vulnerabilities would be found additional in a source code review vs a pentest? If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
Pentester's user avatar
1 vote
0 answers
104 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
makerofthings7's user avatar
0 votes
0 answers
50 views

How to calculate CVSS score of a finding detected in the source code?

While I was doing source code review of API handlers for REST APIs, I found a security issue. This issue is that some methods have the annotation @PreAuthorize("permitAll()"). If I want to ...
anonymous's user avatar
0 votes
0 answers
67 views

Trying to ret2text on 64bit program issues, can't jump to shell

Here is the elf summary of the program: Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) This is the ...
Nsion's user avatar
  • 1
0 votes
0 answers
106 views

Use of JWT Token in open source project

I'm currently performing a code audit for an application that a company will release to the public as open-source in the next few days. In this application, they use a JWT token for authentication and ...
NeCro's user avatar
  • 25
0 votes
0 answers
173 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
Bob's user avatar
  • 1
0 votes
0 answers
118 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
user2023370's user avatar
-1 votes
1 answer
601 views

What is the difference between "secure code review" and "secure static code analysis"?

What are the subtle differences in both - as one could say that both are almost the same... Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code ...
Andrei Clear's user avatar