Questions tagged [dynamic-analysis]
The dynamic-analysis tag has no usage guidance.
13
questions
2
votes
3
answers
249
views
How do you test security tools
I am planning to purchase a security tool like fortify, or sonarqube or snyk.
How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks?
Any good ...
- 121
2
votes
2
answers
630
views
VeraCode static code scan reports "Improper Neutralization of CRLF Sequences in HTTP Headers" for frontend code
I have the following code in my frontend javascript which basically reads the csrf cookie value and sets that in the ajax calls done via jquery.
var csrftoken = self.getCookie('csrftoken');
...
- 131
1
vote
1
answer
244
views
VeraCode static code scan of django view reports "External control of Filename or Path" on render method
Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is:
return render(request, 'core/create-...
- 131
0
votes
2
answers
827
views
Dynamic Application Security Testing (DAST) Scanner for Post Authentication [closed]
I am wondering if anyone know's of a DAST Scanner than can either take in an authenticated request from somewhere like burp, OR some DAST software that takes username and password and then run DAST ...
- 121
0
votes
1
answer
273
views
Adding Floating point operations to fuzzing?
During analysing a software testing paper I read
We plan to add floating-point operations in order to extend fuzz testing capability.
What kind of benefits I can expect from adding floating point ...
- 31
1
vote
1
answer
149
views
Is it correct to say that AVs use the same signature-based detection methods in emulation as they do on static binaries?
Many malwares can be packed or encrypted and AVs will emulate their execution to allow them to unpack or decrypt themselves. Once they do, are AVs simply using the same hashing or pattern-matching ...
- 355
5
votes
2
answers
4k
views
Fuzzing versus Symbolic Execution -- what's the difference?
Fuzzing, per a current Wikipedia definition is defined the following way:
Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random ...
- 265
1
vote
1
answer
2k
views
Malware Execution Delay
I am new to malware analysis and am currently using Cuckoo to understand some of the basics.
I am trying to figure the time that the malware delays its initial executions. I found a functional call ...
- 61
4
votes
2
answers
614
views
Can results from DAST (Dynamic Application Security Testing) tools be false positive?
I know results from Static Application Security Testing (SAST) can be false positives or real and it is up to the security analyst and developer to decide which vulnerability is real based on the ...
- 79
3
votes
1
answer
1k
views
What is the relationship between HTTP response codes and successful execution of XSS attacks?
What is the relationship between HTTP response codes and successful execution of XSS attacks? For e.g I am using a commercial vulnerability scanner that reports XSS vulnerability found in a certain ...
- 79
1
vote
1
answer
726
views
Extract urls from obfuscated android malware
Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
- 123
3
votes
1
answer
886
views
Is it possible to make my host completely safe from the virtual machine (where I will do malware analysis)?
I am using Windows 10 Home edition (Fall creators update), 750 GB HDD. I use Oracle VirtualBox, and I have two virtual machines there: Windows 7 (32 bit) and Ubuntu 14.04.5. I will do malware-analysis ...
- 31
2
votes
0
answers
313
views
Creating a dynamic malware analysis environment [duplicate]
I have analysed a shortcut virus statically and its impact on USB drives and wrote a code to repair its damage.
My static analysis of this malware on USB drives:
It creates shortcuts for all folders ...
