RE: Source code review/scanner

In general, I think RELYING totally on an automated tool isn't good security practice. You need that human element to put things together. Obviously, tools are great for the time-intensive laborious stuff but I personally think that some level of manual review is also needed.

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of xelerated
Sent: Tuesday, August 21, 2007 9:10 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Source code review/scanner

All,
Im looking for something for another dept. to help them review both
source code and web app code created by our developers. The main types
being VB and ASP.

Standard manual testing will still take place, but id like to get
something to check the obvious things before it goes into testing.
Can anyone recommend some tools for both aspects?
Due to separation of duties neither I or the others in network
security nor the developers
will be doing the source code testing. So im trying to find something
that works for those
with less than optimal security or coding knowledge.

Thanks for your input

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.

Relevant Pages

  • Source code review/scanner
    ... source code and web app code created by our developers. ... with less than optimal security or coding knowledge. ...
    (Pen-Test)
  • Re: What so special about PostgreSQL and other RDBMS?
    ... Unsubstantiated bunk, if you have the source code, it is not magic to ... my comments where ment *FOR DEVELOPERS* that is those who ... Oracle suits your needs and you think it's worth the money, use it, ... your database server, then write some additional functions as wrappers ...
    (comp.lang.php)
  • Re: What so special about PostgreSQL and other RDBMS?
    ... >> I'm dependent on the author's licence regardless of which database I use. ... > Unsubstantiated bunk, if you have the source code, it is not magic to ... > the original developers, regardless of your right to the source code, ... > Oracle suits your needs and you think it's worth the money, use it, ...
    (comp.lang.php)
  • UCanCode Releases Upgraded Visio 2007- Like Flow/Diagramming Source Code Kit!
    ... Source Code)! ... E-XD++ Enterprise Edition V11.0 offers software developers several key ... New style of port editing feature is added, with this feature, you ... Full feature evaluation kit is ready, the evaluation kit gives you the ...
    (microsoft.public.dotnet.languages.vc)
  • E-XD++ MFC Library Enterprise Edition V11.0 is released (100% MFC/C++ Source Code)!
    ... E-XD++ Enterprise Edition V11.0 offers software developers several key ... New style of port editing feature is added, with this feature, you ... Full feature evaluation kit is ready, the evaluation kit gives you the ... All source code is supplied and is 100% MFC ...
    (comp.software.shareware.announce)