Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [static-analysis]

Static analysis is the examination of computer source code without executing it. Most commonly static analysis is used to find bugs or ensure conformance to coding guidelines. The classic example is a compiler which finds lexical, syntactic and even some semantic mistakes. A source code security analyzer examines source code to detect and report weaknesses that can lead to security vulnerabilities.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

How to Scan Firebase Database?

I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL. Obviously, the URL is not accessible. I am new to ...
user avatar
0 votes
0 answers
32 views

How do you connect a piece of code in a repo to an actual user-input point in an app?

This is conceptual I know so let me know if there's a better place to ask this. I'm wondering how people can view a piece of code in a repo they aren't familiar with, or simply didn't write, and ...
user avatar
  • 123
2 votes
1 answer
143 views

How to perform security analysis of jwt authentication libraries

I am working on security analysis of jwt python libraries. I want to analyze how the libraries work and how they were used in development. Not the source code. Also I have to check the jwt libraries ...
user avatar
  • 73
2 votes
3 answers
153 views

How do you test security tools

I am planning to purchase a security tool like fortify, or sonarqube or snyk. How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks? Any good ...
user avatar
1 vote
2 answers
153 views

How is "Smart Contract" security different?

I am learning smart contract programming on Ethereum (using Solidity) and realizing that security is highly important here. Why? Because of 2 reasons: they deal with high-stake financial transactions, ...
user avatar
  • 221
1 vote
0 answers
74 views

Pixel File Size in STAMINA [closed]

Last year Intel released a white paper on a joint research effort with Microsoft concerning the possibility to perform malware analysis by converting a file to an image and then applying a deep neural ...
user avatar
  • 413
0 votes
0 answers
115 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
user avatar
  • 1
-1 votes
1 answer
342 views

What is the difference between "secure code review" and "secure static code analysis"?

What are the subtle differences in both - as one could say that both are almost the same... Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code ...
user avatar
4 votes
1 answer
170 views

Making SQL/HTML Injection attacks programmatically impossible

Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why? Can't static code analysis tools ensure that all user supplied input vectors (including user ...
user avatar
  • 777
1 vote
2 answers
411 views

VeraCode static code scan reports "Improper Neutralization of CRLF Sequences in HTTP Headers" for frontend code

I have the following code in my frontend javascript which basically reads the csrf cookie value and sets that in the ajax calls done via jquery. var csrftoken = self.getCookie('csrftoken'); ...
user avatar
  • 121
1 vote
1 answer
203 views

VeraCode static code scan of django view reports "External control of Filename or Path" on render method

Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is: return render(request, 'core/create-...
user avatar
  • 121
3 votes
3 answers
5k views

Best Practice for Suppressing Fortify SCA Findings

I have been searching for an answer as to how you should treat false positives in Fortify scans. For a long time, if something was determined to be a false positive, I would document the reasoning ...
user avatar
1 vote
1 answer
531 views

Perform static analysis over executable Jar

Can you perform static analysis over executable Jar files ? What I did so far is decompile (JD GUI) the jar to get source code excerpts. Is there a better way to do this ?
user avatar
3 votes
0 answers
153 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
user avatar
  • 64k
2 votes
1 answer
797 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
user avatar
  • 1,132
1 vote
2 answers
358 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
user avatar
  • 135
0 votes
1 answer
263 views

CWE-234 - Snprintf Missing Parameter issues

We are scanning a third party library using a well know static analysis tool here. We keep getting: "Failure to Handle Missing Parameter CWE ID 234" I'm not a C developer but I can't see what is ...
user avatar
  • 3
2 votes
0 answers
82 views

PHP static code analysis tool that follows includes (framework compatible)

I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis. For example: include "asdf.php" //this is a function defined in asdf.php echo test($...
user avatar
3 votes
1 answer
178 views

What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
user avatar
1 vote
1 answer
617 views

Extract urls from obfuscated android malware

Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
user avatar
9 votes
3 answers
8k views

Safely load a pickle file?

In our Python app, we are using pickle.load to load a file named perceptron.pkl. A HP Fortify static scan raises a high vulnerability, "Dynamic Code Evaluation - Unsafe Pickle Deserialization", at the ...
user avatar
  • 231
3 votes
2 answers
7k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
user avatar
4 votes
3 answers
464 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
user avatar
  • 67
1 vote
0 answers
192 views

Is there any tool for static analysis of Windows Workflow Foundation XAML files? [closed]

The title says it all. First, is there any dedicated tool that is capable of analysis of Workflow Foundation files? If not, is there a process that can analyse them, eg. compile the WF into IL, then ...
user avatar
3 votes
1 answer
126 views

How to handle 3rd party vulnerable code?

We have recently done a static analysis of our application/s, and there are few critical findings for a 3rd party code i.e. jquery and swagger UI. What are security best practices in this case to ...
user avatar
  • 103
1 vote
1 answer
246 views

How practical are proof-carrying codes to guarantee security of a program?

Going through the list of SIGOPS Hall-of-Famers, I came across this paper about proof-carrying codes. However, I don't see these techniques used in practice, and they seem unusable when building at ...
user avatar
  • 3,876
3 votes
0 answers
163 views

Taint analysis in a functional language

I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
user avatar
  • 131
1 vote
2 answers
1k views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
user avatar
  • 11
-1 votes
1 answer
213 views

Decompiling folders inside a jar file [closed]

I am in possession of a jar file that I have reason to believe has a RAT inside. I downloaded it inside of a virtual machine with jad installed and began to attempt to look at the source. I found that ...
user avatar
  • 344
69 votes
7 answers
10k views

Does one need to be a good programmer to perform secure source code analysis?

A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
user avatar
2 votes
2 answers
2k views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
user avatar
1 vote
0 answers
647 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
user avatar
0 votes
1 answer
842 views

Having trouble with FindBugs exclude filter

I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
user avatar
2 votes
0 answers
2k views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
user avatar
0 votes
2 answers
2k views

Analyze Windows executable

How can I see which files, ports, URLs, etc that are used by a suspicious Windows executable.
user avatar
2 votes
0 answers
132 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
user avatar
4 votes
2 answers
1k views

Security Bugs in Scala Code

I'm currently reading "Software Security: Build Security In" by Gary McGraw, and he makes the distinction between security bugs and security flaws. Security bugs being implementation errors in code, ...
user avatar
  • 249
3 votes
1 answer
139 views

Sensitive information rendered into inline static javascript object vulnerability if user saves HTML page

I am using a javascript rendering template engine with node.js. I am rendering sensitive user information into a static javascript object which is then served to the client. However I realized if the ...
user avatar
  • 96
3 votes
5 answers
598 views

Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]

It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
user avatar
  • 71
0 votes
1 answer
656 views

Sandbox environment for "php malware" analysis [closed]

I would like to know how can I analyse an obfuscated malware php code ? I heard about cuckoo sandbox, but it seems too overwhelming for this particular task. So I decided to run a Vagrant box, install ...
user avatar
  • 229
1 vote
3 answers
4k views

What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?

Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET Some of the ...
user avatar
-1 votes
2 answers
2k views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
user avatar
8 votes
4 answers
4k views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source Fortify/...
user avatar
1 vote
2 answers
1k views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
user avatar
  • 147
1 vote
3 answers
3k views

What are the pros and cons of using live CDs vs VMs for malware analysis?

I'm planning on doing some malware research for a research project, and I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only ...
user avatar
5 votes
0 answers
6k views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
user avatar
  • 361
5 votes
1 answer
500 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
user avatar
  • 6,797
0 votes
1 answer
2k views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
user avatar
1 vote
0 answers
189 views

DLL preloading attack - are IAT libraries affected too?

I'm about to distribute a dll library (there's also a linux version) to my users but I'm afraid of dll preloading attacks (i.e. someone substituting its malicious dll to get called by mine and gain ...
user avatar
  • 169
2 votes
1 answer
208 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
user avatar
  • 32.6k