Secure Source Code Analysis Using Hybrid Approach

---

Instructors:

Ranjith Menon, Manoj Kumar

---

Secure code audit is a highly effective process of identifying vulnerabilities in software. This process requires a more in-depth analysis of an application in order to find the security flaws. We will help you to understand the different techniques to do source code analysis. In this training you will learn how to do source code analysis on different web, mobile applications. This training will be hands on how to do secure code analysis & review, so you need to bring your own laptop to perform different types of attacks on applications provided by us.

Course Content (TOC):

---

Day 1: Dynamic Analysis

• Module 1: Introduction to Secure Source Code Practices (SSCP)
• Module 2: Application security basics (Dynamic analysis)
• Module 3: Introduction to proxy tools
• Module 4: Hands on vulnerable web applications

Day 2: Source Code Analysis – Hybrid Approach

• Module 1: Different ways of doing code analysis
• Module 2: Parameter manipulation attack and Defenses
• Module 3: SQL- Injection
• Module 4: Cross Site Scripting (XSS)
• Module 5: Cryptography
• Module 6: Cross Site Request Forgery (CSRF)
• Module 7: Security Misconfiiguration

Day 3: Source Code Analysis – Hybrid ApproachH

• Module 1: Broken Authentication and Session Management
• Module 2: Error Handling and Logging
• Module 3: Code quality
• Module 4: XML external Entity (XXE) Attack
• Module 5: Deserializing Objects
• Module 6: Android mobile app source code analysis

Day 4: CTF Challenges

• Module 1: CTF challenge on vulnerable source code application for attendees

---

Pre-Requisite

• Laptop/Desktop with Google Chrome installed
• RDP client installed

---

Who Should Attend

• Those having basic development background.
• Those who want to build secure applications.
• Those who want to perform a secure source code review based on hybrid approach
• Those who want to learn various secure code audit methodologies and approaches.

---

What to expect

• Exposure to different tools used for dynamic and static analysis
• Demo application to perform dynamic and static analysis
• Hands on CTF challenges

---

What not to expect

• Any professional tools

Related Courses