Detect source code exposed to hackers’ attack and bring more complete security in the early stage of application development life cycle.
Our SAST technology enables you to conduct both your source codes vulnerability and quality inspection at once. It means that you can conveniently check your application’s security defects and quality including potential errors and performance issues in a single environment.
A critical aspect of the computer security problem is a software or application problem. It is common sense that developers make software defects with security holes — including bugs such as buffer overflows and design flaws such as inconsistent error handling. Malicious intruders can hack into systems by exploiting those software defects. Internet-enabled software applications present the most common security risk encountered today, with software’s ever-expanding complexity and extensibility.
Apona’s SAST tool can be used to assist with automated code inspection. It compares favorably to manual reviews, but they can be done faster and more efficiently. The tool also encapsulates deep knowledge of underlying rules and semantics required to perform this type of analysis such that it does not require the human code reviewer to have the same level of expertise as an expert human auditor.
Its aim is automatically detecting and locating defects in source code. Those defects can be broadly divided into two categories; security vulnerability and quality. The vulnerability is a weakness which allows an attacker to attack a system, decreasing system’s security assurance. The defects associated with software quality may vary ranging from potential errors and bad performance factors to non-compliance with development standards.
Buffer Overflows: Buffer overflows can be triggered by inputs that are designed to execute code, or alter the way the program operates. This may result in erratic program behavior, including memory access errors, incorrect results, a crash, or a breach of system security. They are thus the basis of many software vulnerabilities and can be maliciously exploited.
Command Injection: The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application. In situation like this, the application, which executes unwanted system commands, is like a pseudo system shell, and the attacker may use it as any authorized system user.
Cross-Site Scripting (XSS): XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. An attacker can use XSS to send a malicious script to an unsuspecting user.
SQL Injection: One of the major hacking methods is the SQL injection attack. Such attacks exploit security vulnerabilities and insert malicious code (in this case script tags) into the database running a site.
Common security defects detected
Inspect your source code’s quality and vulnerability
