Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP Code Analysis with LAPSE+ Bruno Motta Rego June 2011

OWASP 2 Agenda  Introduction  Goals  Hands On  Case  Challenges

OWASP 3 Introduction  LAPSE+ is a eclipse plugin to static analysis of code for detecting vulnerabilities of untrusted data injection in Java EE Applications.  LAPSE+ is inspired by existing lightweight security auditing tools such as FlawFinder.  Developed by Group of Stanford University.  GPL Software.

OWASP 4 Goals  Introduction Lapse+  Practical Understanding  Challenges

OWASP 5 Hands On

OWASP 6 LAPSE+ Vulnerabilities Detected  URL Tampering  Cookie Poisoning  Parameter Tampering  Header Manipulation  Cross-site Scripting (XSS)  HTTP Response Splitting  Injections (SQL, Command, XPath, XML, LDAP)  Path Traversal

OWASP 7 LAPSE+ Installation  Eclipse Helios   LAPSE plugin for Eclipse Helios. 

OWASP 8 LAPSE+ Configuration  Drag and Drop  Copy LAPSE+ to plugins folder of our Eclipse Helios  LapsePlus_2.8.1.jar LapsePlus_2.8.1.jar  Open Eclipse  Go to Window / Show View / Lapse+  Vulnerability Source  Vulnerability Sink  Provenance Tracker

OWASP 9 LAPSE+ Demo response.setContentType("text/html"); PrintWriter out = response.getWriter(); for(String parametro : request.getParameterMap().keySet()) { out.println(parametro + ": " + request.getParameter(parametro)); }

OWASP 10 LAPSE+ Steps  Vulnerability Source  Points of code that can be source of an attack.  Vulnerability Sink  Points of code that can be target of data injection.  Provenance Tracker  Performing the backward propagation through the different assignations.

OWASP 11 LAPSE+ Challenges  Requirements  Eclipse Helios  Java 1.6 or higher  Support  High Level Management  Software developers have been proponents of using  LAPSE+ Project

OWASP 12 Case

OWASP 13 Case

OWASP 14 Software Security Challenges Total Cost of Development

OWASP 15 Software Security Challenges  Coding  Reports claims that static analysis can remove upwards of 91% of errors within source code.  Implementation  Bugs found during this phase can be 5 to 10 times cheaper to repair than if left for the testing.  Others  The software developers have long been proponents of using static-analysis tools for critical applications.

OWASP 16 Questions and Answers

OWASP 17