Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [static-analysis]

Static analysis is the examination of computer source code without executing it. Most commonly static analysis is used to find bugs or ensure conformance to coding guidelines. The classic example is a compiler which finds lexical, syntactic and even some semantic mistakes. A source code security analyzer examines source code to detect and report weaknesses that can lead to security vulnerabilities.

0
votes
0answers
21 views

Treating undefined values as tainted (Clang Static Analyzer)

I'm not sure whether it fits in here as it's quite technical, but I leave this question here anyway as it's at least related to security. While testing some of the benchmarks on Clang Static Analyzer ...
2
votes
0answers
54 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
2
votes
1answer
151 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
1
vote
2answers
164 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
0
votes
1answer
109 views

CWE-234 - Snprintf Missing Parameter issues

We are scanning a third party library using a well know static analysis tool here. We keep getting: "Failure to Handle Missing Parameter CWE ID 234" I'm not a C developer but I can't see what is ...
2
votes
0answers
33 views

PHP static code analysis tool that follows includes (framework compatible)

I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis. For example: include "asdf.php" //this is a function defined in asdf.php echo test($...
3
votes
1answer
76 views

What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
1
vote
1answer
262 views

Extract urls from obfuscated android malware

Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
5
votes
3answers
1k views

Safely load a pickle file?

In our Python app, we are using pickle.load to load a file named perceptron.pkl. A HP Fortify static scan raises a high vulnerability, "Dynamic Code Evaluation - Unsafe Pickle Deserialization", at the ...
2
votes
1answer
2k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
3
votes
3answers
256 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
1
vote
0answers
99 views

Is there any tool for static analysis of Windows Workflow Foundation XAML files? [closed]

The title says it all. First, is there any dedicated tool that is capable of analysis of Workflow Foundation files? If not, is there a process that can analyse them, eg. compile the WF into IL, then ...
4
votes
1answer
73 views

How to handle 3rd party vulnerable code?

We have recently done a static analysis of our application/s, and there are few critical findings for a 3rd party code i.e. jquery and swagger UI. What are security best practices in this case to ...
1
vote
1answer
166 views

How practical are proof-carrying codes to guarantee security of a program?

Going through the list of SIGOPS Hall-of-Famers, I came across this paper about proof-carrying codes. However, I don't see these techniques used in practice, and they seem unusable when building at ...
4
votes
0answers
109 views

Taint analysis in a functional language

I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
1
vote
2answers
922 views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
-1
votes
1answer
147 views

Decompiling folders inside a jar file [closed]

I am in possession of a jar file that I have reason to believe has a RAT inside. I downloaded it inside of a virtual machine with jad installed and began to attempt to look at the source. I found that ...
68
votes
7answers
9k views

Does one need to be a good programmer to perform secure source code analysis?

A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
2
votes
2answers
1k views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
1
vote
0answers
484 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
0
votes
1answer
655 views

Having trouble with FindBugs exclude filter

I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
2
votes
0answers
2k views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
0
votes
2answers
1k views

Analyze Windows executable

How can I see which files, ports, URLs, etc that are used by a suspicious Windows executable.
2
votes
0answers
91 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
4
votes
2answers
1k views

Security Bugs in Scala Code

I'm currently reading "Software Security: Build Security In" by Gary McGraw, and he makes the distinction between security bugs and security flaws. Security bugs being implementation errors in code, ...
3
votes
1answer
89 views

Sensitive information rendered into inline static javascript object vulnerability if user saves HTML page

I am using a javascript rendering template engine with node.js. I am rendering sensitive user information into a static javascript object which is then served to the client. However I realized if the ...
3
votes
5answers
518 views

Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]

It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
0
votes
1answer
536 views

Sandbox environment for “php malware” analysis [closed]

I would like to know how can I analyse an obfuscated malware php code ? I heard about cuckoo sandbox, but it seems too overwhelming for this particular task. So I decided to run a Vagrant box, install ...
1
vote
2answers
2k views

What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?

Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET Some of the ...
-1
votes
2answers
1k views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
8
votes
4answers
3k views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source Fortify/...
1
vote
2answers
860 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
0
votes
3answers
2k views

What are the pros and cons of using live CDs vs VMs for malware analysis?

I'm planning on doing some malware research for a research project, and I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only ...
5
votes
0answers
6k views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
5
votes
1answer
428 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
0
votes
1answer
2k views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
1
vote
0answers
116 views

DLL preloading attack - are IAT libraries affected too?

I'm about to distribute a dll library (there's also a linux version) to my users but I'm afraid of dll preloading attacks (i.e. someone substituting its malicious dll to get called by mine and gain ...
2
votes
1answer
143 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
1
vote
1answer
252 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
1
vote
1answer
2k views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
8
votes
1answer
8k views

How do I know if a font is malicious?

There are cases of fonts being used for exploiting vulnerabilities {for ex: ThreatPost, SecureList and F-Secure}. My question is if you ever get hands on such a font, how do you know that it is ...
10
votes
1answer
1k views

List of methods in iOS that have been deprecated for security reasons?

Is anybody on the nets keeping track of iOS methods that have been deprecated by Apple for security reasons? I have searched around but with no luck. Going through all the deprecated methods and ...
9
votes
2answers
882 views

What applicability does the Halting Problem have to infosec?

I was reading an infosec blog recently, and I was caught off guard by the following statement: Sure you can run up to date software and firewalls and that network appliance in your data center that ...
30
votes
9answers
7k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always written a short PDF quickly explaining what I encountered ...
17
votes
4answers
2k views

Criteria for Evaluating Static Analysis Tools

As with any tools purchase part of the outcome is in how good the evaluation criteria are, so it is important to understand the criteria people might use when assessing Security static analysis tools. ...