116
votes
Accepted
Does one need to be a good programmer to perform secure source code analysis?
It depends on what is meant by "secure source code analysis." One can do anything one pleases. The issue, I presume, is when someone else has asked for something called "secure source code analysis,"...
- 9,226
26
votes
Does one need to be a good programmer to perform secure source code analysis?
I think you need to be a good programmer to be successful, so I'd recommend becoming one. There may be lots of things that your toolkit / scanner misses. I honestly don't recommend relying completely ...
- 22.6k
16
votes
Safely load a pickle file?
The Python manual comes with a warning about the pickle module:
Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an ...
- 65.2k
13
votes
Does one need to be a good programmer to perform secure source code analysis?
It's doubtful that a security expert would be effective at performing source code analysis without also being a skilled programmer. Many vulnerabilities are the result of technical or syntactical ...
- 34.1k
12
votes
Does one need to be a good programmer to perform secure source code analysis?
It depends on your expectations. Security vulnerabilities caused by design problems (i.e. missing CSRF protection, only rudimentary implementation of a protocol etc) can probably be found if the ...
- 196k
6
votes
Making SQL/HTML Injection attacks programmatically impossible
Nothing is ever impossible.
But SQL injection vulnerabilities have gone down with ORMs and query builders which prevent the most common mistakes. In my experience, applications which use a secure(...
- 29.4k
4
votes
Accepted
Extract urls from obfuscated android malware
I am afraid there are more ways to obfuscate an URL than one can count. It's very easy to come with another method when your last one got flagged, so static analysis is not recommended.
If possible, ...
- 52.8k
3
votes
Safely load a pickle file?
Is there any way we can safely load a pickle?
You've asked for any way, but it partly depends not only on the way, but on the pickle in question and on what you mean by "safely."
Unless you mean ...
- 421
3
votes
Does one need to be a good programmer to perform secure source code analysis?
Does one need to be a good programmer to perform secure source code analysis?
No.
Will he be able to perform secure code review without knowledge of multiple programming languages and mastery over ...
- 279
3
votes
Does one need to be a good programmer to perform secure source code analysis?
Not only does secure code review require knowledge of the high level language, but also of the compiler options and HOW THE CODE ACTUALLY WILL WORK ON THE CPU! High level languages are efficient to ...
- 2,042
3
votes
Accepted
How to perform security analysis of jwt authentication libraries
Here is my proposal for your analysis that in general, is valid for other python projects. In general, you need to perform a static analysis and a dynamic analysis of the code. You can google and find ...
- 2,247
2
votes
Accepted
Way to find security bugs in Scala source code open-source way?
Codacy (an automated code review platform) has been deploying Scala security patterns.
There's a blog post with the first 9 patterns and if you head to the patterns list in the documentation you can ...
- 136
2
votes
Common JavaScript Vulnerabilities
Full disclosure: the following guide was written by the research team of Checkmarx, creator of CxSAST (static code analysis tool), where I am employed.
Here is a JavaScript Secure Coding Practices ...
- 250
2
votes
How to handle 3rd party vulnerable code?
You can use subresource integrity. This prevents an attacker from altering scripts. It adds a hash to the script tag, and if that hash does not match with the script it does not get executed.
- 29.1k
2
votes
Accepted
How practical are proof-carrying codes to guarantee security of a program?
Ok, so trust is relocated from the component to the proof checker. On what basis can the proof checker's certificate process be trusted?
The proof checker's certification process can be trusted ...
- 503
2
votes
Accepted
Decompiling folders inside a jar file
JAD has been unmaintained for a while now. For decompiling a jar, I typically use JD-GUI, just as your linked question proposes.
2
votes
How do you test security tools
The type of security tool you're testing will dictate what type of testing container you'll need. If you're testing malware detection, grab a container that contains the EICAR malware test file. If ...
- 619
2
votes
How is "Smart Contract" security different?
Ethereum-style smart contracts are entirely public and immutable, whereas classic web APIs can have private data, private logic, and can be updated at any time by the server operator. Thus, we have ...
- 1,306
2
votes
Security code review recommendations
I wouldn't worry about being an imposter. You have the development background to be able to relate to developers and they will probably be psyched to have someone from security who understands appsec ...
- 6,864
2
votes
Security code review recommendations
You could take OWASP ASVS as a baseline. It provides quite comprehensive coverage of software checks broken down into next categories:
Architecture
Authentication
Session Management
Access Control
...
- 692
2
votes
What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?
Don't download it on a regular machine, as various services may try to access it for indexing or for previewing, which can be exploitable. But regardless, how advanced do you expect the malicious PDF ...
- 66.3k
1
vote
VeraCode static code scan of django view reports "External control of Filename or Path" on render method
I don't see anything wrong with this implementation.
It is also completely according to documentation:
https://docs.djangoproject.com/en/3.0/topics/http/shortcuts/
It seems like this Veracode result ...
- 250
1
vote
Best Practice for Suppressing Fortify SCA Findings
The best practice when "triaging/auditing" findings is to tag them. One of the default tags is "not an issue".
- 11
1
vote
Perform static analysis over executable Jar
Can you perform static analysis over executable Jar files?
Yes. Static analysis just means that you are not actually executing the software during your analysis.
What I did so far is decompile (JD ...
- 4,981
1
vote
Scanning a binary against YARA rules dictionary
YARA allows you to specify multiple rules files to be used (as the latest version).
yara64.exe path/rule/file1 path/rule/file2 path/rule/file3 malwareFile
I don't know what the limit to the number ...
- 5,100
1
vote
Safely load a pickle file?
Only the default unpickler is unsafe. You can write a modified unpickler that's safe, or use one that someone else already wrote, such as picklemagic: https://github.com/CensoredUsername/picklemagic
- 19
1
vote
Common JavaScript Vulnerabilities
I wrote an article about JavaScript vulnerabilities, so I believe I can help here:
Most security vulnerabilities in javascript come as a result of end-user interaction.
Malicious users can input ...
1
vote
Does one need to be a good programmer to perform secure source code analysis?
In order to properly figure out the danger of side-channel attacks, you need to know hardware. There are really ugly side-channel attacks, like running a non-privileged process on a multi-CPU setup ...
- 27
1
vote
Security code review Apple Swift - tools and documentation
I encourage you try out https://www.kiuwan.com
It has out of the box custom rules for Swift, it allows for custom rule creation and has scored the highest benchmark on Owasp for SAST vendors.
...
1
vote
Having trouble with FindBugs exclude filter
The problem I found out was with the filename of xml file provided as filter. After changing the name of filter from "filter-ECB.xml" to "filterECB.xml", the scan completed without any error from ...
- 1,507
Only top scored, non community-wiki answers of a minimum length are eligible