1. Static Analysis for Dynamic Assessments Greg Patton | September 2014

2. Agenda Introduction Background & observations Static analysis for dynamic assessments – RIPSA tool Takeaways

3. Introduction Greg Patton Mobile Delivery Manager, HP Fortify on Demand Work on Fortify on Demand team Web & mobile dynamic application testing Attended first OWASP meeting on June 5, 2007 (Houston, TX) hacker@hp.com

4. BACKGROUND & OBSERVATIONS

5. Great divides Security vs. Usability Builders vs. Breakers Dynamic vs. Static

6. Common dynamic challenges Lack of complete security assessments – Few conduct static and dynamic assessments in concert

7. Common dynamic challenges Lack of complete security assessments – Few conduct static and dynamic assessments in concert Client-side false negatives – Dynamic tools and tests miss stuff

8. Common dynamic challenges Lack of complete security assessments – Few conduct static and dynamic assessments in concert Client-side false negatives – Dynamic tools and tests miss stuff “No source code available” – Dynamic testers rarely receive source code

9. A possible solution Use static tools during dynamic assessments Deeper analysis of JavaScript, HTML, XML, and other client-side files

10. STATIC ANALYSIS FOR DYNAMIC ASSESSMENTS

11. RIPSA Accepts XML from Burp – Target Site Map – Proxy History Parses and saves responses as individual files on tester’s machine Output files can be scanned with static tools and manually audited

12. Save Burp responses as XML

13. RIPSA

14. Evaluate XML Save files locally

15. Statically analyze local files

16. DEMO: RIPSA RESPONSE INTERPRETATION AND PREPARATION FOR STATIC ANALYSIS

17. #Winning Reduces potential false negatives by increasing breadth of dynamic web assessments Utilizes information from Burp Suite that dynamic testers already collect Pairs part of a static assessment with a full dynamic web assessment

18. #Winning Static tools – Fortify SCA, FxCop, JSHint, etc. JavaScript analysis – DOM based XSS Silverlight analysis Gather and group files –.dll files for disassembly –.pdf files for strings analysis

19. TAKEAWAYS

20. Takeaways Embrace static Use static tools and techniques to dig deeper into client-side & DOM results – Use automated static tools – Disassemble and decompile Java, Silverlight, Flash, etc.

21. Takeaways Embrace static Use static information to assist with content discovery. – Map application – Identify files and targets

22. Call to the community ZAP extensions – Save responses as local files? – Static scanning signatures? Other ideas?

23. Special thanks Special thanks to Sam Denard David Nester

24. Reach out hacker@hp.com