Skip to content

Static Application Security Testing (SAST)

Are automated tools for code analysis.

links

Semgrep : is a fast, static analysis tool powered by an open-source engine for finding bugs, detecting vulnerabilities, and enforcing code standards.

E.g Psalm 

#psalm.xml
<?xml version="1.0"?>
<psalm
    errorLevel="3"
    resolveFromConfigFile="true"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="https://getpsalm.org/schema/config"
    xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
    findUnusedBaselineEntry="true"
>
    <projectFiles>
        <directory name="html/" />
        <ignoreFiles>
            <directory name="vendor" />
        </ignoreFiles>
    </projectFiles>
</psalm>

#executing
./vendor/bin/psalm --no-cache

# it will pinpoint possible security issues
./vendor/bin/psalm --no-cache --taint-analysis

Dynamic Application Security Testing (DAST)

%%{init: {"flowchart": {"nodeSpacing": 60, "rankSpacing": 80, "padding": 18}, "themeVariables": {"fontSize": "24px"}}}%%
flowchart TB
    subgraph DEV["🖥️ Dev"]
        direction LR
        P1["01 · Plan"] --> P2["02 · Code"] --> P3["03 · Build"] --> P4["04 · Test"]
    end
    subgraph OPS["☁️ Ops"]
        direction LR
        P5["05 · Release"] --> P6["06 · Deploy"] --> P7["07 · Operate"] --> P8["08 · Monitor"]
    end
    P4 --> P5
    P4 -.-> DAST["🔎 DAST"]
    P8 -->|feedback loop| P1

It is common to use automated DAST during the test phases

Is the process of testing a running instance of a web application for weaknesses and vulnerabilities. It focuses on a black-box testing approach where vulnerabilities are found just like a regular attacker would find them.

There are two ways in which DAST can be performed:

  • Manual DAST: Manually perform tests against an application to check for vulnerabilities.
  • Automatic DAST: An automated tool will scan the web application for vulnerabilities.

A DAST tool will perform at least the two following tasks against the target website:

  • Spidering/Crawling: The tool will navigate through the web app, trying to map the application and identify a list of pages and parameters that can be attacked.
  • Vulnerability Scanning: The tool will try to launch attack payloads against the identified pages and parameters. The user can typically customise the type of attacks to include only the ones relevant to the target application.

links:

  • ZAP: A free and open-source web application security scanner. It is a powerful tool that penetration testers and security professionals can use to test the security of web applications.