Design issues may arise from session management flaws in web applications, allowing an attacker to hijack a user's session or identity.
Development issues may arise from input data processing flaws in web applications, enabling code execution at the database or server operating system levels.
Code Audit by ITrust
Through its code audit, ITrust analyzes how the application was designed and how the code was developed. The primary method is manual code review. By tracking data flows throughout the program, processing functions are analyzed to evaluate their adequacy regarding the trust level of the input and output data handled.
Open-source static code analysis tools may be used to identify common errors such as buffer overflows, format string flaws, "time of check/time of use" vulnerabilities, and more. In all cases, manual analysis is essential to eliminate false positives.
To ensure the most comprehensive coverage across various vulnerability types, ITrust relies on several reference frameworks, with the two primary ones being:
- Secure Programming for Linux and Unix HOWTO: Creating Secure Software
- OWASP Top Ten Project
Whenever feasible, the severity of the vulnerability is assessed, ranging from "non-exploitable" to "full server takeover" or "theft of confidential information".
Contact us
An initial consultation with our team will allow us to fully understand your requirements and provide you with a tailored quote.