Difficult to present Findings with Disconnected Data-Flows  Any time I've found myself faced with a real-world, web application, scanning and presenting the AppScan Source Edition Findings, I always arrive at the point at which I have Triaged, Analyzed, Filtered and otherwise massaged the raw results into the 'data-flow pieces', which in totality represent the true vulnerabilities that I've found.  The most difficult part of this exercise is then to construct [for the results consumer] a realistic picture of what an actual round trip of... [More]

Tags:  fortify struts findings_viewer o2platform sp1r0 frameworks java static_analysis ounce appscan fuzzing findings jn14net github appscan_for_analysis checkmarx spring fxcop o2 mvc development kernel results appscan_source fluentsharp

** Re-posting this entry from the Message Board **   IBM Security Systems Has All The Artillery To Dominate the Security Battlefield It just needs to be deployed properly.. → Some factors that may explain the current state of the application security maturity [extremely low]: Development organizations continue to lack the necessary security training and processes to translate 'security requirements' into a secure design with appropriate unit tests. The intense pace development of new technologies and migration of... [More]

Tags:  static_analysis development findings_viewer security_appliance fuzzing appscan_source applicance fxcop ounce correlation github appscan_for_analysis java sp1r0 o2 veracode fortify appscan_appliance o2platform checkmarx fluentsharp

  In his recent post on obtaining the various installation packages for a complete installation of the AppScan product suite: AppScan Eval Downloads and What is What   Dinis makes a good point about the confusion that one can encounter when moving from earlier versions (pre-8.5) of AppScan Source and AppScan Enterprise to 8.6.x and does a pretty solid job of explaining the line in a bit more detail. To help out with his one point of confusion, regarding the Dynamic Analysis module, I gave him a bit of an insider explanation, which may be useful... [More]

Tags:  appscan_for_analysis findings_viewer ounce appscan appscan_appliance struts spring o2 results findings static_analysis wafl dynamic_analysis sp1r0 frameworks correlation appscan_correlation appscan_source mvc installation downloads

The AppScan Appliance – Proof Of Concept Architecture and Application Security Process Following some great feedback I received on my previous post regarding the concept of an AppScan Security Appliance, How The Mainframe Can Transform Application Security , I want to further define a potential high level architecture along with a set of processes for integration into the application development life cycle.  The goal here is to start down the path towards a Proof Of Concept including a prototype in order to demonstrate what I believe will... [More]

Tags:  mvc static_analysis appscan_appliance struts spring url_mapping ounce dynamic_analysis appscan_source results correlation wafl frameworks appscan_for_analysis appscan findings appscan_correlation sp1r0 findings_viewer o2

Here is a pretty funny and / or really serious (depending on your frame of reference) utility that exploits a low level SMTP vulnerability by design.  In effect, this allows one to send an email FROM ANY ADRESS, as long as the domain doesn't actually exist. That may sound like a tough restriction but I can testify that anything from a realistic sounding new division name, theoretically something like myboss@security.us.ibm.com , has a very high potential of being opened.   Link to the Utility in a Standalone Executable (with a cool... [More]

Tags:  wafl callbacks injection application_injection frameworks appscan_for_analysis appscan_appliance ounce web_application_framework... o2 sp1r0 static_analysis results findings hijacking appscan appscan_source findings_viewer