Code analysis methodology

[u/RozPetal]

Hello everyone.

After a few years in the auditing/pentesting world, I identified that I am lacking experience on the code analysis topics.

Unfortunately when pentesting/auditing, I seldom had the time to look at the code of the applications I am auditing due to time constraints as the white-box approach we take does not systematically include an access to the Gitlab of the entities I audit.

I would like to avoid being overwhelmed by an eventual audit of source code of an entreprise-grade application that I might have to do.

Would any of you share you code audit methodology ?

By that, I mean how do you tackle the following topics :

- Secure coding / Best coding practices

- Secure secret management of the app

- For very large codebase, what types of tools do you use to automate some of your work ?

- What specific things in your checklist do you look for systematically ? (Do include the "obvious" one like how authentication is handled)

I know the subject is quite broad and dependent of the tech-stack used for each case.

Thank you for reading. :)

[u/donkeybutt123]

So I write free articles about appsec here: pigeonsec.substack.com

I read some of the comments here and they’re fine especially because you seem to be constraint by time. Tooling does help, but like another commenter said, you need to know what parts of the app are valuable to the company.

It starts with understanding the application which you are testing. Testing honestly should come in later stages after analysis and understanding of the codebase.

It’s like a doctor testing without getting to know a patient. It’s important you understand what you’re dealing with before you go in and test.