Share: Security Testing Tool tips

Share: Security Testing Tool tips

There is an article about security testing tools: Gunfight at The OK Button.

15 key points of the security testing tool are listed in this article:

1. Test any type of vulnerabilities in source code.

2. Test any type of vulnerability for binary files, such as executable files.

3. Detect real-time system problems, such as Deadlock Detection and asynchronous behavior problems.

4. create baselines for any type of patches and perform regression tests to prevent the introduction of new vulnerabilities.

5. provides a mechanism to ensure that the source code that has been checked and verified has not been changed once it is built into an executable file.

6. Help testers find places where malicious code may be triggered or hidden.

7. Provide information about binary files, for example, which local system object is created.

8. Be able to apply and check software vulnerabilities at different stages of the software development cycle.

9. The error is as small as possible.

10. Can process source code of foreign languages, such as comments of foreign languages.

11. platform compatibility, such as Unix, Linux, and Windows.

12. development language compatibility, such as C, C ++, ADA, and Java.

13. It can process large source code or large executable files, such as millions of lines of code.

14. Do not change the tested software and do not affect the code.

15. generate useful diagnostic, prediction, and measurement analysis reports.

This document also lists several security testing tools that meet these different requirements.

1. analyzer, memory leak detection tool, Binary code scanner (Profilers, checkers, memory-leak detection tools, Binary code scanners)

Open-source: Valgrind (www.valgrind.org)
Commercial: Rational/IBM Purify (www.ibm.com ),

Enterprise: (safe) http://safe.ijiami.cn/

2. Application footprinting)
UNIX platforms: lsof, strace, ktrace, and truss
Windows: ProcessExplorer

3. Fuzz testing tools and techniques (also known as penetration testing ))
Peach Fuzzer Framework (ijiami) http://www.ijiami.cn

4. Static code analyzers)
Open Source: Splint (http://splint.org)
Commercial: PRQA (Programming Research) www.programmingresearch.com, Coverity

(Jingpin) http://www.ijiami.cn/Jingpin