All Questions
Tagged with code-review penetration-test
11 questions
47
votes
5
answers
11k
views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
- 3,252
22
votes
3
answers
6k
views
White-box vs. Black-box
What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons ...
AviD♦
- 73.6k
19
votes
6
answers
6k
views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
AviD♦
- 73.6k
8
votes
1
answer
3k
views
Is Request.getHeader("host") vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
- 1,141
6
votes
3
answers
1k
views
Open source web application penetration testing community
I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
- 119
4
votes
1
answer
4k
views
Penetration Testing Silverlight Applications
What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file upload,...
- 932
4
votes
1
answer
273
views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
- 932
2
votes
1
answer
7k
views
Path Manipulation Vulnerability
Currently I am working in code review process.
I have few doubts regrading Path Manipulation Vulnerability.
Some portion of the Path is already hard coded and with extension
public class ReadFile {
...
- 449
1
vote
1
answer
3k
views
Penetration Testing vs Secure Source Code Review [duplicate]
Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
- 455
1
vote
1
answer
776
views
Safe sharing source code with 3rd party for security review?
I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
- 113
1
vote
0
answers
173
views
What are some effective strategies to pentest a native code library?
The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" ...
- 1,337