Questions tagged [static-analysis]
Static analysis is the examination of computer source code without executing it. Most commonly static analysis is used to find bugs or ensure conformance to coding guidelines. The classic example is a compiler which finds lexical, syntactic and even some semantic mistakes. A source code security analyzer examines source code to detect and report weaknesses that can lead to security vulnerabilities.
61
questions
0
votes
1
answer
66
views
Is there evidence that using SAST / SCA brings positive ROI to software companies?
Using SAST / SCA tools within the delivery pipelines is quite common these days; however, in the software my teams are building, the SAST tools that we're using are very rarely finding even relatively ...
0
votes
2
answers
118
views
Is there a machine-readable way to document dangerous sinks in libraries?
One of the key questions when investigating the security of software and libraries is what are the dangerous sinks? What functions are potentially dangerous, if called with untrusted data?
It would be ...
- 34.6k
0
votes
0
answers
68
views
Veracode SSRF Flag for http.NewRequestWithContext: Mitigating Risk in My Go Application
I'm working on a Go application where I'm using http.NewRequestWithContext to make outgoing requests. During a recent Veracode scan, I received an SSRF (Server-Side Request Forgery) flag for the ...
1
vote
1
answer
124
views
Static malware analysis using machine learning
As you know, using machine learning we can detect malware.
We can use dynamic analysis based on WinAPI function calls and their arguments.
But what about static analysis using machine learning? In ...
- 13
1
vote
0
answers
77
views
Required features for taint-based vulnerability tools? [closed]
What tools are necessary for static-analysis taint-based vulnerability detection? For example, being able to find/search source-sink paths through a tainted variable, flexibility to choose flow ...
- 11
1
vote
0
answers
145
views
MobSF Android Activity APK Pentest
it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it:
Under HARDCODED_SECRETS in MobSF, ...
- 11
2
votes
1
answer
215
views
How to perform security analysis of jwt authentication libraries
I am working on security analysis of jwt python libraries. I want to analyze how the libraries work and how they were used in development. Not the source code. Also I have to check the jwt libraries ...
- 73
2
votes
3
answers
341
views
How do you test security tools
I am planning to purchase a security tool like fortify, or sonarqube or snyk.
How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks?
Any good ...
- 121
1
vote
2
answers
226
views
How is "Smart Contract" security different?
I am learning smart contract programming on Ethereum (using Solidity) and realizing that security is highly important here. Why? Because of 2 reasons: they deal with high-stake financial transactions, ...
- 221
1
vote
0
answers
114
views
Pixel File Size in STAMINA [closed]
Last year Intel released a white paper on a joint research effort with Microsoft concerning the possibility to perform malware analysis by converting a file to an image and then applying a deep neural ...
- 413
0
votes
0
answers
205
views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
- 1
-1
votes
1
answer
647
views
What is the difference between "secure code review" and "secure static code analysis"?
What are the subtle differences in both - as one could say that both are almost the same...
Static Code Analysis (also known as Source Code Analysis) is usually
performed as part of a Code ...
- 11
4
votes
1
answer
404
views
Making SQL/HTML Injection attacks programmatically impossible
Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why?
Can't static code analysis tools ensure that all user supplied input vectors (including user ...
- 797
3
votes
2
answers
732
views
VeraCode static code scan reports "Improper Neutralization of CRLF Sequences in HTTP Headers" for frontend code
I have the following code in my frontend javascript which basically reads the csrf cookie value and sets that in the ajax calls done via jquery.
var csrftoken = self.getCookie('csrftoken');
...
- 141
1
vote
1
answer
281
views
VeraCode static code scan of django view reports "External control of Filename or Path" on render method
Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is:
return render(request, 'core/create-...
- 141
6
votes
3
answers
11k
views
Best Practice for Suppressing Fortify SCA Findings
I have been searching for an answer as to how you should treat false positives in Fortify scans.
For a long time, if something was determined to be a false positive, I would document the reasoning ...
- 171
1
vote
1
answer
962
views
Perform static analysis over executable Jar
Can you perform static analysis over executable Jar files ?
What I did so far is decompile (JD GUI) the jar to get source code excerpts. Is there a better way to do this ?
3
votes
0
answers
199
views
Identifying kernel pointer infoleaks via static analysis
Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
- 67.1k
2
votes
1
answer
1k
views
Scanning a binary against YARA rules dictionary
I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
- 1,142
1
vote
2
answers
399
views
Security code review recommendations [closed]
I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
- 135
0
votes
1
answer
357
views
CWE-234 - Snprintf Missing Parameter issues
We are scanning a third party library using a well know static analysis tool here.
We keep getting:
"Failure to Handle Missing Parameter CWE ID 234"
I'm not a C developer but I can't see what is ...
- 3
2
votes
0
answers
121
views
PHP static code analysis tool that follows includes (framework compatible)
I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis.
For example:
include "asdf.php"
//this is a function defined in asdf.php
echo test($...
3
votes
1
answer
236
views
What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?
I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
- 301
1
vote
1
answer
804
views
Extract urls from obfuscated android malware
Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
- 123
12
votes
3
answers
15k
views
Safely load a pickle file?
In our Python app, we are using pickle.load to load a file named perceptron.pkl. A HP Fortify static scan raises a high vulnerability, "Dynamic Code Evaluation - Unsafe Pickle Deserialization", at the ...
- 261
3
votes
2
answers
8k
views
Common JavaScript Vulnerabilities
Can someone recommend a secure coding guideline for JavaScript?
Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
- 59
4
votes
3
answers
589
views
Web Application Firewall using web app source code analysis
I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks.
We know each web application has a number of input ...
- 67
1
vote
0
answers
221
views
Is there any tool for static analysis of Windows Workflow Foundation XAML files? [closed]
The title says it all.
First, is there any dedicated tool that is capable of analysis of Workflow Foundation files?
If not, is there a process that can analyse them, eg. compile the WF into IL, then ...
- 121
3
votes
1
answer
166
views
How to handle 3rd party vulnerable code?
We have recently done a static analysis of our application/s, and there are few critical findings for a 3rd party code i.e. jquery and swagger UI.
What are security best practices in this case to ...
- 103
1
vote
1
answer
305
views
How practical are proof-carrying codes to guarantee security of a program?
Going through the list of SIGOPS Hall-of-Famers, I came across this paper about proof-carrying codes. However, I don't see these techniques used in practice, and they seem unusable when building at ...
- 3,996
3
votes
0
answers
230
views
Taint analysis in a functional language
I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
- 131
1
vote
2
answers
2k
views
Security code review Apple Swift - tools and documentation
I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
- 11
-1
votes
1
answer
242
views
Decompiling folders inside a jar file [closed]
I am in possession of a jar file that I have reason to believe has a RAT inside. I downloaded it inside of a virtual machine with jad installed and began to attempt to look at the source. I found that ...
- 344
69
votes
7
answers
10k
views
Does one need to be a good programmer to perform secure source code analysis?
A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
- 1,507
2
votes
2
answers
2k
views
Way to find security bugs in Scala source code open-source way?
I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
- 1,507
1
vote
0
answers
705
views
Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?
I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
- 1,507
0
votes
1
answer
948
views
Having trouble with FindBugs exclude filter
I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
- 1,507
2
votes
0
answers
2k
views
Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]
I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
- 1,507
0
votes
2
answers
3k
views
Analyze Windows executable
How can I see which files, ports, URLs, etc that are used by a suspicious Windows executable.
- 113
2
votes
0
answers
159
views
Can static analysis of JavaScript be done?
Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
4
votes
2
answers
1k
views
Security Bugs in Scala Code
I'm currently reading "Software Security: Build Security In" by Gary McGraw, and he makes the distinction between security bugs and security flaws. Security bugs being implementation errors in code, ...
- 249
3
votes
1
answer
180
views
Sensitive information rendered into inline static javascript object vulnerability if user saves HTML page
I am using a javascript rendering template engine with node.js. I am rendering sensitive user information into a static javascript object which is then served to the client. However I realized if the ...
- 96
3
votes
5
answers
627
views
Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]
It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
- 71
0
votes
1
answer
742
views
Sandbox environment for "php malware" analysis [closed]
I would like to know how can I analyse an obfuscated malware php code ?
I heard about cuckoo sandbox, but it seems too overwhelming for this particular task.
So I decided to run a Vagrant box, install ...
- 229
1
vote
3
answers
5k
views
What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?
Do these 2 terminologies refer to the same thing?
https://www.owasp.org/index.php/Source_Code_Analysis_Tools
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET
Some of the ...
- 329
-1
votes
2
answers
2k
views
Why do static code analyzers cite CWE rather than CVE in their findings?
I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
- 321
8
votes
4
answers
4k
views
Static code review approach
My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan.
Veracode – Finds security flaws in application binaries and bytecode without requiring source
Fortify/...
1
vote
2
answers
1k
views
Static code analysis strategies [closed]
Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case?
For example: We know ...
- 147
2
votes
3
answers
3k
views
What are the pros and cons of using live CDs vs VMs for malware analysis?
I'm planning on doing some malware research for a research project, and I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only ...
- 173
5
votes
0
answers
6k
views
AngularJS Static Analysis Tools [closed]
I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities.
Many ...
- 371