Questions tagged [code-review]
Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.
120 questions
0
votes
2
answers
148
views
Does splitting RNG into "private" and "public" entropy sources reduce risks of compromise?
I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that:
https://github.com/awslabs/s2n#compartmentalized-random-number-generation
The security of TLS and its associated ...
- 5,367
4
votes
2
answers
4k
views
Will the following PHP code result in source code info leak/disclosure?
I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php.
So I went ahead to guard ...
- 45
0
votes
3
answers
1k
views
Exploiting a desktop application
I'm studying application security and now I have a question which I couldn't find a good answer.
Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
- 366
23
votes
3
answers
3k
views
What ways are there to verify a self-written protocol?
Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter.
I needed to secure ...
- 433
3
votes
5
answers
627
views
Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]
It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
- 71
4
votes
2
answers
2k
views
Security review: is this PHP mcrypt wrapper class safe?
> **Update (6 February 2015):**
> It seems like the class in question has actually updated as a response to the answers here (through an issue, now closed, raised on github).
I was looking for an ...
- 1,092
9
votes
2
answers
2k
views
security reviews of third party code
I am not familiar with all the steps involved in a full-fledged
information security review of an in-house developed application,
so I am wondering whether or not the following scenario is ...
- 193
-1
votes
2
answers
2k
views
Why do static code analyzers cite CWE rather than CVE in their findings?
I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
- 331
1
vote
0
answers
623
views
What tools on unix can scan sql dumps for malware? [closed]
I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this?
...
- 267
1
vote
1
answer
152
views
Resources for reviewing multi-tiered webabbs in Spring, Hibernate or JAX-WS
I need some pointers to any resources (videos from any conferences or general videos, pdf, anything) for secure source code reviewing of multi-tiered web-apps in JAX-WS, Spring or Hibernate. I am ...
- 507
8
votes
4
answers
4k
views
Static code review approach
My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan.
Veracode – Finds security flaws in application binaries and bytecode without requiring source
Fortify/...
3
votes
2
answers
719
views
Box web application security review - legality? [closed]
is it legal to do a security review/pentest of a web application that we bought and operate on our servers? Meaning, the whole infrastructure is ours + we bought a licence for the software. Can we do ...
- 49
1
vote
2
answers
1k
views
Static code analysis strategies [closed]
Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case?
For example: We know ...
- 147
3
votes
1
answer
728
views
OpenSSL Code Review
Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
- 207
4
votes
1
answer
1k
views
VB.NET stored procedure implementation?
While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet
Result = DBInstance.ExecuteDataSet(Name, paramArrayList....
- 7,497
3
votes
1
answer
866
views
Is my AES/CTR/RIPEMD encryption correctly implemented?
Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking.
For brevity, I've inlined the functions for ...
- 2,600
3
votes
5
answers
1k
views
What is the security flaw in this example of "magic parameters"?
I am reading OWASP Testing Guide v3:
Example 1: Magic Parameters
Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For simplicity, the GET request may be: ...
- 457
3
votes
4
answers
695
views
Risk management with software code analysis
I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation.
I have been thinking lately that a lot of PCI-DSS ...
- 435
0
votes
1
answer
1k
views
what freeware tool for java source code review? [closed]
I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
- 155
1
vote
2
answers
718
views
How to properly select a code audit company? [closed]
How should I go about selecting a code auditing company?
- 31
6
votes
1
answer
4k
views
Hiding backdoors in Open Source code in other languages than C and C++?
I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
- 61
9
votes
1
answer
559
views
Do the Windows shared source files compile into the same binaries as the retail version?
Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative
Is this a ...
- 445
10
votes
1
answer
587
views
How to encourage responsible disclosure (and react appropriately otherwise)
As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
- 233
5
votes
2
answers
2k
views
What are good free opensource tools for helping in manual source code reviews? [closed]
I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
- 2,789
7
votes
2
answers
1k
views
SELinux and text relocations exploitability
I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm.
As per my deparment defined requirements, this solution should support SELinux ...
- 448
3
votes
2
answers
317
views
How to assess severity/impact of vulnerability
In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
- 283
9
votes
4
answers
5k
views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
- 863
8
votes
2
answers
840
views
How dangerous is it to use third-party security audit tools?
This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE).
Besides a dated (and patched) vulnerability in LSAT (CVE-2007-...
- 5,367
37
votes
6
answers
4k
views
Teaching a loved one about secure coding practices
This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
- 132k
8
votes
3
answers
27k
views
Are there any free static analysis tools for C# / .NET code [closed]
A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
- 932
4
votes
2
answers
4k
views
Base64 encode differences in BCrypt implemenations
I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of the salt.
What is the effect, if any, of the ...
- 7,752
5
votes
6
answers
2k
views
Could a computer program be used to automate testing for trapdoors?
Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
- 101
1
vote
2
answers
4k
views
Tampering req.getParameter() Vs req.getAttribute() [closed]
Is following code vulnerable? If yes, how it can be exploited?
<%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = (String)request....
- 1,141
5
votes
3
answers
2k
views
Secure source code review tool for jQuery
Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
- 2,334
51
votes
3
answers
6k
views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
- 1,426
5
votes
4
answers
402
views
How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio.
You can see the video at Real-time ...
- 629
2
votes
2
answers
504
views
Which software scans software for potential vulnerabilities?
Is there any kind of parser software analysis tool that will analyze C code and outputs possible vulnerabilities like buffer overflows?
- 224
3
votes
1
answer
2k
views
Intepreting PE (Portable Executable) headers of suspicious malware files
I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.
Using PEview I am examining the .text, .rdata and .data headers.
I know that if there is a big ...
- 1,560
5
votes
2
answers
388
views
Recommendations for documenting security code review
How should I document the results of a security code review?
Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
- 100k
-1
votes
3
answers
1k
views
Code auditing and/or fuzzing - Books and resources
I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
- 2,758
6
votes
3
answers
1k
views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
- 2,783
4
votes
1
answer
273
views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
- 932
6
votes
2
answers
2k
views
HTML 5 Security Code Scanner
Are there code scanners in the market that scan HTML 5 code?
Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
- 1,204
5
votes
3
answers
695
views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?...
- 932
6
votes
1
answer
8k
views
Code Review on a Header Injection In Java : any help?
I'm auditing a piece of Java code that might be vulnerable to header injection :
String headerValue =request.getParameter("headerVal");
//escaping CRLF
headerValue = headerValue.replace("\n", "");
...
- 249
2
votes
2
answers
328
views
Debug mode for an application but removed in production
A application use the debug as boolean to prefill login, password for authentication.
The code is something like that :
if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final
{
//disable access control =...
- 249
8
votes
1
answer
3k
views
Is Request.getHeader("host") vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
- 1,141
6
votes
2
answers
964
views
Secure Software Development
I'm researching models on building security into the SDLC and so far have come across:
BSIMM
Microsoft SDL
Open SAMM
Are there any other documents and resources to look into? Specific tools that ...
- 932
4
votes
1
answer
4k
views
Penetration Testing Silverlight Applications
What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file upload,...
- 932
6
votes
2
answers
738
views
How do you organize a code review / static analysis report?
Recently I get involved in a security code review.
I found many format string, buffer overflow and dangerous libc function call.
Right now I need to write down a report with all the stuff founded ...
- 1,086