Skip to content

static-code-analysis.md

Latest commit

 

History

History
23 lines (21 loc) · 1.28 KB

static-code-analysis.md

File metadata and controls

23 lines (21 loc) · 1.28 KB

What is Static Code Analysis?

Static code analysis identifies security vulnerabilities efficiently in source code, byte code or binaries. In addition to security vulnerability the available toolset has expanded the scope to testing code repetitions, code quality etc.

What are some of the examples of static code analysis?

  • Unbound Buffer Errors, e.g., buffer overflow
  • Script Injections: XSS, CSRF (cross-site) etc.
  • Command injections: SQL, LDAP etc.

What are some of the tools available for Static Code Analysis?

  • Fortify, PVS Studio, Raxis, ...

What is Dynamic Code Analysis?

While static code analysis is executed on the source base, Dynamic code analysis is the method of debugging by examining an application during or after a program is run.

What aew some of the examples of Dynamic Code Analysis?

  • Undocumented Open port scanning
  • API vulnerability : Authentication, Authorization, API bounds check

What are some of the Dynamic Code Analysis tools?

  • Nessus, Qualis, nmap, ...

What are some vulnerability those are exploited most?

There are many authorative sources they have document top vulnerabilities. Here are some of the sources.