auditing source code for security aspects
1
vote
1answer
70 views
Is my AES/CTR/RIPEMD encryption correctly implemented?
Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking.
For brevity, I've inlined the functions for ...
1
vote
3answers
132 views
What is the security flaw in the following code?
I am reading OWASP Testing Guide v3. The following passage:
Example 1: Magic Parameters
Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
0
votes
0answers
12 views
Fixing Memory Safety Error for Fread [duplicate]
Can someone pls explain how I can fix the following valgrind error on fread? I tried doing if (fread(valueCon, 1, intCount, f) == intCount){ then execute}; but that does not seem to change anything. ...
3
votes
4answers
116 views
Risk management with software code analysis
I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation.
I have been thinking lately that a lot of PCI-DSS ...
0
votes
1answer
44 views
what freeware tool for java source code review? [closed]
I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
-1
votes
2answers
70 views
How to properly select a code audit company? [closed]
How should I go about selecting a code auditing company?
3
votes
1answer
906 views
Hiding backdoors in Open Source code in other languages than C and C++?
I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
9
votes
1answer
247 views
Do the Windows shared source files compile into the same binaries as the retail version?
Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative
Is this a ...
6
votes
1answer
127 views
How to encourage responsible disclosure (and react appropriately otherwise)
As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
5
votes
2answers
477 views
What are good free opensource tools for helping in manual source code reviews? [closed]
I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
6
votes
2answers
333 views
SELinux and text relocations exploitability
I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm.
As per my deparment defined requirements, this solution should support SELinux ...
3
votes
2answers
109 views
How to assess severity/impact of vulnerability
In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
7
votes
4answers
1k views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
8
votes
2answers
403 views
How dangerous is it to use third-party security audit tools?
This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE).
Besides a dated (and patched) vulnerability in LSAT ...
30
votes
6answers
2k views
Teaching a loved one about secure coding practices
This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
2
votes
2answers
3k views
Are there any free static analysis tools for C# / .NET code
A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
3
votes
1answer
291 views
Base64 encode diffences in BCrypt implemenations
I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt.
What is the effect, if any, of ...
4
votes
6answers
611 views
Could a computer program be used to automate testing for trapdoors?
Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
1
vote
2answers
270 views
Is the following code vulnerable? [closed]
Is following code vulnerable? If yes, how it can be exploited?
<%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = ...
5
votes
3answers
726 views
Secure source code review tool for jQuery
Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
33
votes
3answers
2k views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
5
votes
3answers
175 views
How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio.
You can see the video at Real-time ...
0
votes
1answer
188 views
Which software scans software for potential vulnerabilities?
Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
2
votes
1answer
430 views
Intepreting PE (Portable Executable) headers of suspicious malware files
I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.
Using PEview I am examining the .text, .rdata and .data headers.
I know that if there is a big ...
5
votes
2answers
191 views
Recommendations for documenting security code review
How should I document the results of a security code review?
Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
0
votes
3answers
413 views
Code auditing and/or fuzzing - Books and resources
I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
5
votes
3answers
343 views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
3
votes
1answer
92 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
5
votes
2answers
970 views
HTML 5 Security Code Scanner
Are there code scanners in the market that scan HTML 5 code?
Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
5
votes
3answers
332 views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: ...
5
votes
1answer
811 views
Code Review on a Header Injection In Java : any help?
I'm auditing a piece of Java code that might be vulnerable to header injection :
String headerValue =request.getParameter("headerVal");
//escaping CRLF
headerValue = headerValue.replace("\n", "");
...
2
votes
2answers
106 views
Debug mode for an application but removed in production
A application use the debug as boolean to prefill login, password for authentication.
The code is something like that :
if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final
{
//disable access control ...
7
votes
1answer
808 views
Is Request.getHeader(“host”) vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
3
votes
2answers
370 views
Secure Software Development
I'm researching models on building security into the SDLC and so far have come across:
BSIMM
Microsoft SDL
Open SAMM
Are there any other documents and resources to look into? Specific tools that ...
4
votes
1answer
2k views
Penetration Testing Silverlight Applications
What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file ...
5
votes
2answers
384 views
How do you organize a code review / static analysis report?
Recently I get involved in a security code review.
I found many format string, buffer overflow and dangerous libc function call.
Right now I need to write down a report with all the stuff founded ...
10
votes
4answers
546 views
Criteria for Evaluating Static Analysis Tools
As with any tools purchase part of the outcome is in how good the evaluation criteria are, so I'd be interested to hear any criteria people might use when assessing Security static analysis tools.
...
5
votes
3answers
648 views
Open source web application penetration testing community
I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
6
votes
2answers
424 views
Outsourcing security evaluation
Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? ...
8
votes
4answers
4k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
8
votes
5answers
1k views
How to review code for backdoors?
I have a codebase that needs a code review to evaluate it for backdoors.
The code is far too big to review it all, how would you recommend approaching the problem.
It is a java web application with ...
7
votes
5answers
662 views
Code Review Strategies
As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
7
votes
4answers
1k views
Is there a real risk of exploitation in java code where a null pointer is dereferenced
I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool.
I know a null pointer dereference can crash a program, but assuming ...
13
votes
5answers
960 views
Code Analysis: Binary vs Source
While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
10
votes
3answers
2k views
Can anyone suggest good open source tools for scanning source code for vulnerabilities?
I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
6
votes
8answers
640 views
What is the vulnerability in my PHP code?
A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam.
I've taken ...
6
votes
2answers
609 views
GET with additional parameters leads to “code injection” in html displayed
We got a security review done of our PHP code and the security company sent this in their report:
Request
GET ...
7
votes
6answers
1k views
Fortify360 - Sinks & Sources - Vulnerability count
In an application security environment, I use Fortify Software's Fortify360 on a daily basis.
One of my biggest hurdles is explaining the numbers (sources vs sinks)
Fortify flags each location in ...
8
votes
5answers
775 views
Scripting a search through php files for dangerous calls for manual review
I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.
Does anyone have any recommendations for ...
7
votes
3answers
459 views
Finding security consultant for doing in-depth code review?
We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
