Crawling Code - Revision history

Tony Hsu HsiangChih: /* Crypto */

2017-08-25T02:24:16Z

‎Crypto

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T15:32:25Z

Added navigation to facilitate sequential reading online

KirstenS: /* Searching for Code in .NET */

2009-05-05T11:36:50Z

‎Searching for Code in .NET

KirstenS: /* Storage */

2009-01-25T17:34:36Z

‎Storage

KirstenS: /* Crypto */

2009-01-25T17:34:16Z

‎Crypto

KirstenS: /* Reflection, Serialization */

2009-01-25T17:33:25Z

‎Reflection, Serialization

KirstenS at 17:29, 25 January 2009

2009-01-25T17:29:03Z

KirstenS: /* SQL & Database */

2009-01-16T13:48:31Z

‎SQL & Database

KirstenS: /* Crypto */

2009-01-11T12:40:52Z

‎Crypto

KirstenS: /* Exceptioins & Errors */

2009-01-11T12:38:51Z

‎Exceptioins & Errors

@@ Line 245: / Line 245: @@
 System.Random <br>
 Random <br>
-System.Security.Cryptography <br>
+System.Security.Cryptography
 ==Storage==

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 Crawling code is the practice of scanning a code base of the review target in question. It is, in effect, looking for key pointers wherein a possible security vulnerability might reside. Certain APIs are related to interfacing to the external world or file IO or user management, which are key areas for an attacker to focus on. In crawling code we look for APIs relating to these areas. We also need to look for business logic areas which may cause security issues, but generally these are bespoke methods which have bespoke names and can not be detected directly, even though we may touch on certain methods due to their relationship with a certain key API.
@@ Line 270: / Line 275: @@
 strcpy <br>
 [[Category:OWASP Code Review Project]]

@@ Line 15: / Line 15: @@
 ==Searching for Code in .NET==
-Firstly one needs to be familiar with the tools one can use in order to perform text searching, following this one neesd to know what to look for.
+Firstly one needs to be familiar with the tools one can use in order to perform text searching, following this one needs to know what to look for.
 In this section we will assume you have a copy of Visual Studio (VS) .NET at hand. VS has two types of search "Find in Files" and a cmd line tool called Findstr.

@@ Line 243: / Line 243: @@
 ==Storage==
-If storing sensitive data in memory recommend one uses the following.
+If storing sensitive data in memory, I recommend one uses the following.
 SecureString <br>

@@ Line 229: / Line 229: @@
 ==Crypto==
-If cryptography is used then is a strong enough cipher used i.e. AES or 3DES. What size key is used, the larger the better. Where is hashing performed? Are passwords that are being persisted hashed? They should be. How are random numbers generated? Is the PRNG "random enough"?
+If cryptography is used then is a strong enough cipher used, i.e. AES or 3DES? What size key is used? The larger the better. Where is hashing performed? Are passwords that are being persisted hashed? They should be. How are random numbers generated? Is the PRNG "random enough"?
 RNGCryptoServiceProvider <br>

@@ Line 211: / Line 211: @@
 ==Reflection, Serialization==
-Code may be generated dynamically at runtime. Code that is generated dynamically as a function of external input may give rise to issues. If your code contains sensitive data does it need to be serialized.
+Code may be generated dynamically at runtime. Code that is generated dynamically as a function of external input may give rise to issues. If your code contains sensitive data, does it need to be serialized?
 Serializable <br>

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
-Crawling code is the practice of scanning a code base of the review target in question. It is, in effect, looking for key pointers wherein a possible security vulnerability might reside. Certain APIs are related to interfacing to the external world or file IO or user management which are key areas for an attacker to focus on. In crawling code we look for API relating to these areas. We also need to look for business logic areas which may cause security issues, but generally these are bespoke methods which have bespoke names and can not be detected directly, even though we may touch on certain methods due to their relationship with a certain key API.
+Crawling code is the practice of scanning a code base of the review target in question. It is, in effect, looking for key pointers wherein a possible security vulnerability might reside. Certain APIs are related to interfacing to the external world or file IO or user management, which are key areas for an attacker to focus on. In crawling code we look for APIs relating to these areas. We also need to look for business logic areas which may cause security issues, but generally these are bespoke methods which have bespoke names and can not be detected directly, even though we may touch on certain methods due to their relationship with a certain key API.
-Also we need to look for common issues relating to a specific language; issues that may not be *security* related but which may affect the stability/availability of the application in the case of extraordinary circumstances. Other issues when performing a code review are areas such a simple copyright notice in order to protect one’s intellectual property.
+We also need to look for common issues relating to a specific language; issues that may not be *security* related but which may affect the stability/availability of the application in the case of extraordinary circumstances. Other issues when performing a code review are areas such a simple copyright notice in order to protect one’s intellectual property.
 Crawling code can be done manually or in an automated fashion using automated tools. Tools as simple as grep or wingrep can be used. Other tools are available which would search for key words relating to a specific programming language.

@@ Line 68: / Line 68: @@
 select from <br>
 Insert <br>
 update <br>
@@ Line 87: / Line 86: @@
 sqloledb <br>
 sql server <br>
 driver <br>

← Older revision		Revision as of 12:40, 11 January 2009
Line 244:		Line 244:
	System.Security.Cryptography <br>		System.Security.Cryptography <br>

		+	==Storage==
		+	If storing sensitive data in memory recommend one uses the following.
		+
		+	SecureString <br>
		+	ProtectedMemory <br>
		+
		+	==Authorization, Assert & Revert==
		+	Bypassing the code access security permission? Not a good idea. Also below is a list of potentially dangerous permissions such as calling unmanaged code, outside the CLR.
		+
		+	.RequestMinimum <br>
		+	.RequestOptional <br>
		+	Assert <br>
		+	Debug.Assert <br>
		+	CodeAccessPermission <br>
		+	ReflectionPermission.MemberAccess <br>
		+	SecurityPermission.ControlAppDomain <br>
		+	SecurityPermission.UnmanagedCode <br>
		+	SecurityPermission.SkipVerification <br>
		+	SecurityPermission.ControlEvidence <br>
		+	SecurityPermission.SerializationFormatter <br>
		+	SecurityPermission.ControlPrincipal <br>
		+	SecurityPermission.ControlDomainPolicy <br>
		+	SecurityPermission.ControlPolicy <br>
		+
		+	==Legacy Methods==
		+	printf <br>
		+	strcpy <br>


	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]

@@ Line 222: / Line 222: @@
 System.Reflection <br>
-==Exceptioins & Errors==
+==Exceptions & Errors==
 Ensure that the catch blocks do not leak information to the user in the case of an exception. Ensure when dealing with resources that the finally block is used. Having trace enabled is not great from an information leakage perspective. Ensure customised errors are properly implemented.
@@ Line 230: / Line 230: @@
 customErrors mode <br>
 [[Category:OWASP Code Review Project]]