Help needed #itsec
I have to do a source code analysis for my bachelor thesis but I'm a total noob. Are there any good tools out there to help me compensate my lacking skills?
Thank you!
I have to do a source code analysis for my bachelor thesis but I'm a total noob. Are there any good tools out there to help me compensate my lacking skills?
Thank you!
Comments
bei den Audits die ich begleitet habe wurde zumeist AppSweep und Agnito verwendet
https://github.com/project-chip/connectedhomeip
Here's a list of a few C++ static analyzers.
https://gist.github.com/akirill0v/4d7ac89196a06922f9119fe201f69087#cc
Most of them don't look for security vulns, but things like memory leaks, undefined behaviour etc. based on which you do manual analysis
But again, those are only indicators for vulnerabilities, not vulnerabilities themselves.
https://www.nist.gov/itl/ssd/software-quality-group/source-code-security-analyzers
That said, they'll spit out so many false positives, that they are usually almost useless.
Sadly, there's no way around manual analysis.
A tool that can spit out good results is simply not possible for general purpose programming languages. halting problem be damned :)