3

I'm looking for an answer specific to Windows/Linux standalone applications, for instance Dropbox has Windows Application written purely (I think so) in python, What steps should I follow? What are the various threats I should consider?

I am very interested in penetration testing standalone applications, I have good enough experience with Web Application Security Testing and I do Python programming a lot.

Any good reads, links and write up are welcome.

3

This is a two-part answer:

  1. You must overcome any obfuscation or get to some sort of decompiled state. See this question on StackExchangeRE for more details on Python obfuscation.
  2. Once you have the code (or if you have the source in the first place), you will want to utilize a mixture of secure code review, runtime analysis, and security-focused static analysis to uncover potential findings for triage.

If you are looking for security-focused static analysis tools, sadly many of the commercial ones are just not there yet for the Python language. Pylint and Flake8 also are primarily style or correctness checkers with zero security checks. My top recommendation for Python SAST is the Bandit project from the OpenStack Security team. There are only a few basic checks but you can add more. Bandit is only a slight (but important) improvement over older tools' techniques, such as seen in graudit and RATS.

If you are interested in runtime analysis, most security testers leverage Burp Suite Professional for HTTP/TLS traffic and Canape as a pluggable, local-logging proxy for other protocols. In order to understand file handlers or network protocols that utilize encryption or compression routines during runtime analysis, many security testers turn to software tracing (because it's faster than debugging) or hooking techniques, such as found in the Frida framework. A popular set of flaws targeting serialization (pickling in Python) are becoming more widely known, so it may be worth checking out the OWASP Python Security Project page or list for more information.

For a more-detailed look at Dropbox specifically, see this other answer over at StackExchangeRE, in addition to this Security Analysis of Dropbox code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.