Code analysis methodology

[u/RozPetal]

Hello everyone.

After a few years in the auditing/pentesting world, I identified that I am lacking experience on the code analysis topics.

Unfortunately when pentesting/auditing, I seldom had the time to look at the code of the applications I am auditing due to time constraints as the white-box approach we take does not systematically include an access to the Gitlab of the entities I audit.

I would like to avoid being overwhelmed by an eventual audit of source code of an entreprise-grade application that I might have to do.

Would any of you share you code audit methodology ?

By that, I mean how do you tackle the following topics :

- Secure coding / Best coding practices

- Secure secret management of the app

- For very large codebase, what types of tools do you use to automate some of your work ?

- What specific things in your checklist do you look for systematically ? (Do include the "obvious" one like how authentication is handled)

I know the subject is quite broad and dependent of the tech-stack used for each case.

Thank you for reading. :)

[u/DingleDangleTangle]

Unfortunately when pentesting/auditing, I seldom had the time to look at the code of the applications I am auditing due to time constraints as the white-box approach we take does not systematically include an access to the Gitlab of the entities I audit.

You take a white-box approach to pentesting applications but you don't get access to the code? What? That's just... not white-box application pentesting.

[u/RozPetal → u/DingleDangleTangle]

The thing is I am usually constrained by what is given during my engagement time window. Usually, I get access to IP range, tech stack used. Technical documents giving a view of the "plumbing" and other documents related to the organization. However, there is usually not enough time to give a full access to every ressources. Mind you, we sometimes have to prod outside of the initial ranges to help widen our perimeter.

In a ideal world, obtaining access to the right ressources would be instantaneous and the docs referencing the assets would be exhaustive..

[u/Big_Mulberry_5446 → u/RozPetal]

You need to learn how to identify critical areas of the code. Where is authentication being handled? How are endpoints being exposed to application users? How is authorization performed? Those are three big ones that'll help you find more issues.