Udostępnij za pośrednictwem

Code Inspection - First Look For What To Look For

  • Artykuł

Reposted from Security Code Inspection - First Look For What To Look For for further reuse on this blog.

I found it extremely productive to first look for strings in the code. But what strings to look for? And how to look for the strings? Looking into the source files?

My good friend FindStr is of great help here:

So first let's find what to look for:

Ildasm.exe secureapp.dll /text | findstr ldstr

This is what I've got using it:

Wouldn't it trigger you think of authorization data doing roundtrip thus vulnerable to tampering and elevation of privileges?

Wouldn't it trigger you think there is some custom authentication mechanism that potentially could be vulnerable thus enabling identity spoofing?

 

Wouldn't it trigger you think.....

 

So once you have these strings you use same FindStr to find actual files to inspect:

findstr /S /M /I /d:c:\projects\yourweb "StringOfInterestGoesHere" *.cs

Cheers

Comments

  • Anonymous
    March 26, 2007
    In my previous post, Code Inspection - First Look For What To Look For , I've described how to look for
  • Anonymous
    March 31, 2007
    Here are couple of techniques I used for searching hints of SQL Injections in .Net apps. The basic approach
  • Anonymous
    April 18, 2007
    Imagine if security was cool like Silverlight .... But security is not that cool, so the biggest challenge
  • Anonymous
    July 06, 2007
    Are you using Typed DataSet as DTO (data transfer object) ? Are you building distributed systems where
  • Anonymous
    December 01, 2007
    DIR /S /B /A:-D I use simple DIR command to generate file lists. It serves me in many scenarios. For
  • Anonymous
    January 24, 2008
    How to streamline the process of capturing security flaws during security code review? How to save time
  • Anonymous
    March 17, 2008
    Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It
  • Anonymous
    July 24, 2008
    "The hardest thing of all is to find a black cat in a dark room, especially if there is no cat."