Re: Vuln Scanner for Web App Source Code

[Greg Rubin <grrubin () gmail com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I think that work by hand is valuable, but there is also room for 
automated scanning (depending on your language).  If you want to work 
from code-analysis, then you are looking for something called "Static 
Analysis".  One company that does it is FortifySoftware, but I'm sure 
that there are others.

Automated scanning is especially good for enforcing some best practices 
and preventing injection attacks (XSS, SQL, LDAP, etc.) but it will 
always take work to get right.

Hope that helps.

Greg

cnanne () gmail com wrote:
| This might be a bit of a dumb question, but does anyone know of a good 
Vulnerability Scanner for finding faults in the actual Source Code of 
the Web App? Or can this task can only be done by hand?
|
|
| Any feedback on this is highly appreciative
|
|
|
| cheers,
|
|
| PhoenixRbrth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIMQnC5KDU23nQpRcRAsvGAJ91J0cCTty572Q3ULsCE2wTMOfIswCfegwK
is4fO4n8+yavwD2Rf54YQW4=
=AYV+
-----END PGP SIGNATURE-----