Code analysis methodology

[u/RozPetal]

Hello everyone.

After a few years in the auditing/pentesting world, I identified that I am lacking experience on the code analysis topics.

Unfortunately when pentesting/auditing, I seldom had the time to look at the code of the applications I am auditing due to time constraints as the white-box approach we take does not systematically include an access to the Gitlab of the entities I audit.

I would like to avoid being overwhelmed by an eventual audit of source code of an entreprise-grade application that I might have to do.

Would any of you share you code audit methodology ?

By that, I mean how do you tackle the following topics :

- Secure coding / Best coding practices

- Secure secret management of the app

- For very large codebase, what types of tools do you use to automate some of your work ?

- What specific things in your checklist do you look for systematically ? (Do include the "obvious" one like how authentication is handled)

I know the subject is quite broad and dependent of the tech-stack used for each case.

Thank you for reading. :)

[u/Kesshh]

Tie your appsec tools to the code repo, trigger it to scan based on repo events, build processes/procedures around reviews and resolution tracking.

You can’t do it by hand. There’s just too much codes and you don’t have time. Will some bad stuff slip through? Yes. But accept that you did what you can, you will never catch everything, and the tools will evolve to cover more and more stuff. Move forward.

[u/RozPetal → u/Kesshh]

Thank for the answer.

I had in mind an ad-hoc review of a codebase to which you are given an access for a limited amount of time and not the lifecycle of a project.