Source code analysis

It's common to place external libraries and dependencies lower on the priority list than application source files. With this in mind, there are many high-priority items to consider when performing manual source code analysis. This high-level list is presented in no particular order:

• After checking unauthenticated areas, focus on areas of the application that are likely to receive less attention (i.e. authenticated portions of the application).

• Investigate how sanitization of the user input is performed. Is it done using a trusted, open-source library, or is a custom solution in place?

• If the application uses a database, how are queries constructed? Does the application parameterize input or simply sanitize it?

• Inspect the logic for account creation or password reset/recovery routines. Can the functionality be subverted?

• Does the application interact with its operating system? If so, can we modify commands or inject new ones?

• Are there programming language-specific vulnerabilities?

Debugging

Let's try debugging a simple Java application using Visual Studio Code. We will need to install two plugins: the RedHat Language Support for Java and the Microsoft Debugger for Java.

DebuggerTest.java

import java.util.Random;
import java.util.Scanner;

public class DebuggerTest {

  private static Random random = new Random();
  public static void main(String[] args){
    int num = generateRandomNumber();
        Scanner scanner = new Scanner(System.in);
        System.out.println("Guess a number between 1 and 100.");
        try{
      int answer = scanner.nextInt();
      scanner.close();
      System.out.println("Your guess was: " + answer);
      if(answer == num) {
        System.out.println("You are correct!");
      } else {
        System.out.println("Incorrect. The answer was " + num);
      }
    } catch(Exception e) {
      System.out.println("That's not a number.");
    } finally {
      scanner.close();
    }
    System.exit(0);
  }

  public static int generateRandomNumber() {
    return random.nextInt(100)+1;
  }
}

Remote debugging