4 ms·

I guess people would pay for a service that could identify 90% of all security issues with an online service by going through source code and available routes.

• gtani 13y ago
  I've seen quite a few things that are germane, google "static analysis for security",pentesting etc http://pentestlab.wordpress.com/2012/11/27/automated-source-code-review/ http://pentestlab.wordpress.com/2012/11/27/automated-source-... https://www.owasp.org/index.php/Static_Code_Analysis https://www.owasp.org/index.php/Static_Code_Analysis http://code.google.com/p/yara-project/ http://code.google.com/p/yara-project/ http://ulsrl.org/ http://ulsrl.org/ http://www.lightbluetouchpaper.org/ http://www.lightbluetouchpaper.org/ (the 3rd post (these aren't the services, these are what you shd read to decide if some service's operatives are appropriately expensive, and up on current research
• _pius 13y ago
  https://www.tinfoilsecurity.com/ https://www.tinfoilsecurity.com/
  • dsl 13y ago
    Tinfoil scans remotely for known vulnerabilities (i.e. WordPress version X has exploit Y). What you really want is source code analysis. WhitehatSec.com and Veracode.com are the two huge players in this space.
• kcen 13y ago
  For the Rails folks out there, I have had pretty good luck with Brakeman Scanner in the past. http://brakemanscanner.org/ http://brakemanscanner.org/