BSidesLondon 20th April 2011 - David Rook (@securityninja) ----------------------- This demonstration filled talk will start by discussing the problems with the security code review approaches most people follow and the reasons why I created Agnitio. This will include a look at existing manual and automated static analysis procedures and tools. The talk will move onto exploring the Principles of Secure Development and how the principles have been mapped to over 60 different checklist items in Agnitio. ---- for more about David go to http://www.securityninja.co.uk/ ---- for more about Agnito go to http://sourceforge.net/projects/agnitiotool/

1. David Rook Agnitio It’s static analysis, but not as we know it SecurityBSides, London

23. Cross Site Scripting Injection Flaws Security Misconfiguration Information Leakage Race Condition Broken Authentication Session Management Cross Site Request Forgery Buffer Copy without Checking Size on Input Insecure Direct Object Reference Failure to Restrict URL Access Insecure Cryptographic Storage SQL Injection Content Spoofing Insufficient Authorisation Insufficient Authentication Abuse of Functionality Predictable Resource Location Unrestricted Upload of File with Dangerous Type Failure to Preserve SQL Query Structure Failure to Preserve Web Page Structure Failure to Preserve OS Command Structure URL Redirection to Untrusted Site Insufficient Transport Layer Protection Improper Limitation of a Pathname to a Restricted Directory Improper Control of Filename for Include/Require Statement in PHP Program Incorrect Permission Assignment for Critical Resource Download of Code Without Integrity Check Information Exposure Through an Error Message Reliance on Untrusted Inputs in a Security Decision Use of Hard-coded Credentials Buffer Access with Incorrect Length Value Improper Check for Unusual or Exceptional Conditions Use of a Broken or Risky Cryptographic Algorithm Missing Encryption of Sensitive Data Missing Authentication for Critical Function Integer Overflow or Wraparound Improper Validation of Array Index Incorrect Calculation of Buffer Size Unvalidated Redirects and Forwards Allocation of Resource Without Limits or Throttling Improper Access Control The principles of secure development

27. Cross Site Scripting Injection Flaws Security Misconfiguration Information Leakage Race Condition Broken Authentication Session Management Cross Site Request Forgery Buffer Copy without Checking Size on Input Insecure Direct Object Reference Failure to Restrict URL Access Insecure Cryptographic Storage SQL Injection Content Spoofing Insufficient Authorisation Insufficient Authentication Abuse of Functionality Predictable Resource Location Unrestricted Upload of File with Dangerous Type Failure to Preserve SQL Query Structure Failure to Preserve Web Page Structure Failure to Preserve OS Command Structure URL Redirection to Untrusted Site Insufficient Transport Layer Protection Improper Limitation of a Pathname to a Restricted Directory Improper Control of Filename for Include/Require Statement in PHP Program Incorrect Permission Assignment for Critical Resource Download of Code Without Integrity Check Information Exposure Through an Error Message Reliance on Untrusted Inputs in a Security Decision Use of Hard-coded Credentials Buffer Access with Incorrect Length Value Improper Check for Unusual or Exceptional Conditions Use of a Broken or Risky Cryptographic Algorithm Missing Encryption of Sensitive Data Missing Authentication for Critical Function Integer Overflow or Wraparound Improper Validation of Array Index Incorrect Calculation of Buffer Size Unvalidated Redirects and Forwards Allocation of Resource Without Limits or Throttling Improper Access Control The principles of secure development Input Validation Output Validation Error Handling Authentication Authorisation Session Management Secure Communications Secure Storage Secure Resource Access Auditing and Logging

38. Why did I develop Agnitio?

41. Agnitio v2.0

42. My “shoot for the moon” vision for Agnitio “ we pretty much need a Burp Pro equivalent for Static Analysis – awesome, powerful in the right hands, and completely affordable!” http://www.securityninja.co.uk/application-security/can-you-implement-static-analysis-without-breaking-the-bank/comment-page-1#comment-9777

44. www.securityninja.co.uk @securityninja QUESTIONS? /realexninja /securityninja /realexninja