{"id":93051,"date":"2020-09-02T13:42:49","date_gmt":"2020-09-02T11:42:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode"},"modified":"2020-09-02T13:42:49","modified_gmt":"2020-09-02T11:42:49","slug":"kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","title":{"rendered":"Kuidas kasutada lihtsat t\u00f6\u00f6riista haavatavuste otsimiseks programmikoodis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Graudit toetab mitmeid programmeerimiskeeli ja v\u00f5imaldab integreerida koodibaasi turvatestimise otse arendusprotsessi.<\/p>\n

\"Kuidas
\nAllikas: Unsplash<\/a><\/noindex> (Markus Spiske)<\/p>\n

Testimine on tarkvaraarenduse eluts\u00fckli oluline osa. On olemas palju erinevaid testimisviise, iga\u00fchel on oma eesm\u00e4rk. T\u00e4na tahan r\u00e4\u00e4kida koodis turvaprobleemide leidmisest.<\/p>\n

On ilmne, et t\u00e4nap\u00e4eva tarkvaraarenduse tingimustes on oluline tagada protsesside turvalisus. Mingil ajal ilmus isegi spetsiaalne m\u00f5isted DevSecOps. Selle terminiga m\u00f5istetakse rida protseduure, mis on suunatud rakenduse haavatavuste kindlakstegemisele ja k\u00f5rvaldamisele. On olemas spetsialiseeritud avatud l\u00e4htekoodiga lahendused haavatavuste kontrollimiseks vastavalt standarditele OWASP<\/a><\/noindex>, mis kirjeldavad erinevaid t\u00fc\u00fcpe ja k\u00e4itumist haavatavusi l\u00e4htekoodis.
\n<\/a><\/noindex><\/p>\n

On erinevaid l\u00e4henemisviise turvaprobleemide lahendamiseks, n\u00e4iteks rakenduste staatiline turvatestimine (SAST), d\u00fcnaamiline turvatestimine (DAST), interaktiivne rakenduste turvatestimine (IAST), tarkvara koostisosade anal\u00fc\u00fcs (Software Composition Analysis) jne.<\/p>\n

Staatiline rakenduste turvatestimine avastab vigu juba kirjutatud koodis. See l\u00e4henemine ei n\u00f5ua rakenduse k\u00e4ivitamist, seet\u00f5ttu nimetatakse seda staatiliseks anal\u00fc\u00fcsiks.<\/p>\n

Ma peatun koodi staatilisel anal\u00fc\u00fcsil ja kasutan lihtsat avatud l\u00e4htekoodiga t\u00f6\u00f6riista, et demonstreerida k\u00f5ike praktikas.<\/p>\n

Miks ma valisin avatud l\u00e4htekoodiga t\u00f6\u00f6riista koodi staatiliseks turvaanal\u00fc\u00fcsiks<\/h2>\n

\nSellel on mitmeid p\u00f5hjuseid: esiteks, see on tasuta, kuna kasutate t\u00f6\u00f6riista, mille on v\u00e4lja t\u00f6\u00f6tanud sarnaste huvidega kogukond, kes soovib aidata teisi arendajaid. Kui teil on v\u00e4ike meeskond v\u00f5i idufirma, on teil suurep\u00e4rane v\u00f5imalus s\u00e4\u00e4sta, kasutades avatud l\u00e4htekoodiga tarkvara oma koodibaasi turvalisuse kontrollimiseks. Teiseks, see vabastab teid vajadusest palgata eraldi DevSecOps meeskond, mis veelgi v\u00e4hendab teie kulusid.<\/p>\n

Headless open source t\u00f6\u00f6riistad arvestavad alati suurenenud paindlikkuse n\u00f5udmistega. Seet\u00f5ttu saab neid kasutada praktiliselt igas keskkonnas, katab lai valik \u00fclesandeid. Arendajatele on palju lihtsam neid t\u00f6\u00f6riistu siduda s\u00fcsteemiga, mida nad on juba oma projektide kallal t\u00f6\u00f6tades ehitanud.<\/p>\n

Aga v\u00f5ivad tekkida olukorrad, kus vajate funktsiooni, mida teie valitud t\u00f6\u00f6riist ei paku. Sellisel juhul on teil v\u00f5imalus selle koodi forkitada ja arendada selle alusel oma t\u00f6\u00f6riist, millel on vajalikud funktsionaalsused.<\/p>\n

Kuna avatud l\u00e4htekoodiga tarkvara arendusele avaldab enamasti tugevat m\u00f5ju kogukond, v\u00f5etakse muudatuste tegemise otsus piisavalt kiiresti ja asjakohaselt: avatud l\u00e4htekoodiga projekti arendajad tuginevad kasutajate tagasisidele ja ettepanekutele, nende s\u00f5numitele leitud vigade ja teiste probleemide kohta.<\/p>\n

Graudit'i kasutamine koodi turvaanal\u00fc\u00fcsiks<\/h2>\n

\nKoodi staatiliseks anal\u00fc\u00fcsiks saab kasutada erinevaid avatud l\u00e4htekoodiga t\u00f6\u00f6riistu, universaalset t\u00f6\u00f6riista k\u00f5igi programmeerimiskeelte jaoks ei eksisteeri. M\u00f5ned arendajad j\u00e4rgivad OWASP-i soovitusi ja p\u00fc\u00fcavad katta nii palju keeli kui v\u00f5imalik.<\/p>\n

Siin kasutame Graudit<\/a><\/noindex>, lihtsat k\u00e4surea utiliiti, mis v\u00f5imaldab meil leida haavatavusi meie koodibaasis. See toetab erinevaid keeli, kuid siiski on nende hulk piiratud. Graudit on v\u00e4lja t\u00f6\u00f6tatud grep'i teenusutiliidi p\u00f5hjal, mis toodi kunagi v\u00e4lja GNU litsentsi all.<\/p>\n

On olemas sarnased t\u00f6\u00f6riistad staatiliseks koodi anal\u00fc\u00fcsiks \u2014 Rough Auditing Tool for Security (RATS), Securitycompass Web Application Analysis Tool (SWAAT), flawfinder ja nii edasi. Kuid Graudit on v\u00e4ga paindlik ja omab minimaalset tehnilist n\u00f5udlust. Siiski v\u00f5ivad tekkida \u00fclesanded, mida Graudit lahendada ei suuda. Siis v\u00f5ite otsida teisi variante siit selles nimekirjas<\/a><\/noindex>.<\/p>\n

Me saame integreerida selle t\u00f6\u00f6riista konkreetse projekti, muuta selle valitud kasutajale kergesti k\u00e4ttesaadavaks v\u00f5i kasutada seda samaaegselt k\u00f5igis meie projektides. See on veel \u00fcks Graudit'i paindlikkuse n\u00e4ide. Nii et k\u00f5igepealt kloonime repositooriumi:<\/p>\n

$ git clone https:\/\/github.com\/wireghoul\/graudit<\/code><\/pre>\n
\nN\u00fc\u00fcd loome Graudit jaoks s\u00fcmboolse lingi, et seda k\u00e4surea formaadis kasutada.<\/p>\n
$ cd ~\/bin && mkdir graudit\n$ ln --symbolic ~\/graudit\/graudit ~\/bin\/graudit<\/code><\/pre>\n
\nLisame aliase .bashrc faili (v\u00f5i m\u00f5nda teise konfiguratsioonifaili, mida kasutate):<\/p>\n
#------ .bashrc ------\nalias graudit="~\/bin\/graudit"<\/code><\/pre>\n
\nLaadime s\u00fcsteemi uuesti:<\/p>\n
$ source ~\/.bashrc # V\u00d5I\n$ exec $SHELL\n<\/code><\/pre>\n
\nKontrollime, kas installatsioon \u00f5nnestus:<\/p>\n
$ graudit -h<\/code><\/pre>\n
Kui n\u00e4ete midagi sarnast, siis k\u00f5ik on h\u00e4sti.<\/p>\n
\"Kuidas
\n
\nMa hakkan testima \u00fcht minu olemasolevat projekti. Enne t\u00f6\u00f6riista k\u00e4ivitamist tuleb sellele edastada andmebaas, mis vastab selle programmeerimiskeelele, milles minu projekt on kirjutatud. Andmebaasid asuvad kaustas ~\/gradit\/signatures:<\/p>\n
$ graudit -d ~\/gradit\/signatures\/js.db<\/code><\/pre>\n
\nSeega testisin kahte js-faili oma projektist ja Graudit n\u00e4itas konsoolis teavet minu koodi haavatavuste kohta:<\/p>\n
\"Kuidas
\n
\n\"Kuidas
\n
\nSaate proovida oma projekte selliselt testida. Erinevat t\u00fc\u00fcpi programmeerimiskeelte andmebaaside nimekirja leiate siin<\/a><\/noindex>.<\/p>\n
Grauditi plussid ja miinused<\/h2>\n
\nGraudit toetab mitmeid programmeerimiskeeli. Seet\u00f5ttu sobib see laiale kasutajaskonnale. See suudab v\u00e4\u00e4rika konkurentsiga toime tulla mis tahes tasuta v\u00f5i tasuliste analoogidega. On v\u00e4ga oluline, et projekti parendused j\u00e4tkuvad ja kogukond aitab mitte ainult arendajaid, vaid ka teisi kasutajaid, kes p\u00fc\u00fcavad t\u00f6\u00f6riista m\u00f5ista.<\/p>\n
See on mugav t\u00f6\u00f6riist, kuid praegu ei suuda see alati t\u00e4pselt n\u00e4idata, milles probleem seisneb, mis on seotud kahtlase koodiosas. Arendajad j\u00e4tkavad Grauditi t\u00e4iustamist. <\/p>\n
Kuid igal juhul on kasulik p\u00f6\u00f6rata t\u00e4helepanu potentsiaalsetele turvaprobleemidele koodis, kasutades sarnaseid t\u00f6\u00f6riistu.<\/p>\n
Algus\u2026<\/h2>\n
\nSelles artiklis k\u00e4sitlesin vaid \u00fchte paljusid viise haavatavuste otsimiseks \u2014 rakenduste staatilist turvatestimist. Koodi staatiline anal\u00fc\u00fcs on lihtne teostada, kuid see on vaid algus. Et rohkem teada saada oma koodibaasi turvalisusest, tuleb integreerida tarkvaraarenduse eluts\u00fcklisse teisi testimisviise.<\/p>\n
<\/p>\n
Reklaami \u00f5igustes<\/h4>\n
\nUsaldusv\u00e4\u00e4rne VPS<\/a><\/noindex> ja \u00f5ige hinnaplaani valik aitab v\u00e4ltida h\u00e4irivaid probleeme arendamisel \u2014 k\u00f5ik t\u00f6\u00f6tab sujuvalt ja v\u00e4ga k\u00f5rge uptime\u2019iga!<\/p>\n
\"Kuidas<\/a><\/noindex>
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
Graudit \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438. \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: Unsplash (Markus Spiske) \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u2014 \u0432\u0430\u0436\u043d\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0432\u0438\u0434\u043e\u0432 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u0430\u0436\u0434\u044b\u0439 \u0438\u0437 \u043d\u0438\u0445 \u0440\u0435\u0448\u0430\u0435\u0442 \u0441\u0432\u043e\u044e \u0437\u0430\u0434\u0430\u0447\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u0438\u0441\u043a\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0434\u0435. \u041e\u0447\u0435\u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-93051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas kasutada lihtsat t\u00f6\u00f6riista haavatavuste leidmiseks tarkvarakoodis | ProHoster","description":"Graudit toetab mitmeid programmeerimiskeeli ja v\u00f5imaldab integreerida koodibaasi turvatestimise otse arendusprotsessi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043a\u043e\u0434\u0435 | ProHoster","og:description":"Graudit \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-02T11:42:49+00:00","article:modified_time":"2020-09-02T11:42:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93051","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:56:23","updated":"2022-10-03 07:52:13","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/93051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=93051"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/93051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/93052"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=93051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=93051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=93051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}