{"id":93051,"date":"2020-09-02T13:42:49","date_gmt":"2020-09-02T11:42:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode"},"modified":"2020-09-02T13:42:49","modified_gmt":"2020-09-02T11:42:49","slug":"kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","title":{"rendered":"Kako koristiti jednostavan alat za pronala\u017eenje ranjivosti u programskom kodu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Graudit podr\u017eava mnoge programske jezike i omogu\u0107uje integraciju testiranja sigurnosti kodne baze direktno u proces razvoja.<\/p>\n

\"Kako
\nIzvor: Unsplash<\/a><\/noindex> (Markus Spiske)<\/p>\n

Testiranje je va\u017ean dio \u017eivotnog ciklusa razvoja softvera. Postoji mnogo vrsta testiranja, a svaka od njih rje\u0161ava svoju zada\u0107u. Danas \u017eelim razgovarati o pronala\u017eenju problema sigurnosti u kodu.<\/p>\n

O\u010digledno je da u modernim uvjetima razvoja softvera treba osigurati sigurnost procesa. Nekada je uveden poseban termin DevSecOps. Pod ovim pojmom podrazumijevaju se niz procedura usmjerenih na otkrivanje i uklanjanje ranjivosti u aplikaciji. Postoje specijalizirana open source rje\u0161enja za provjeru ranjivosti prema standardima OWASP<\/a><\/noindex>, koji opisuju razli\u010dite tipove i pona\u0161anje ranjivosti u izvornoj kodu.
\n<\/a><\/noindex><\/p>\n

Postoje razli\u010diti pristupi rje\u0161avanju problema sigurnosti, na primjer, stati\u010dko testiranje sigurnosti aplikacija (SAST), dinami\u010dko testiranje sigurnosti aplikacija (DAST), interaktivno testiranje sigurnosti aplikacija (IAST), analiza komponenti softvera (Software Composition Analysis) i tako dalje.<\/p>\n

Stati\u010dno testiranje sigurnosti aplikacija otkriva gre\u0161ke u ve\u0107 napisanom kodu. Ovaj pristup ne zahtijeva pokretanje aplikacije, stoga se naziva stati\u010dka analiza.<\/p>\n

Osvrnut \u0107u se na stati\u010dku analizu koda i iskoristit \u0107u jednostavan open source alat kako bih sve pokazao u praksi.<\/p>\n

Za\u0161to sam odabrao open source alat za stati\u010dku analizu sigurnosti koda<\/h2>\n

\nZa to postoje brojni razlozi: prvo, to je besplatno, jer koristite alat razvijen od strane zajednice istomi\u0161ljenika koji \u017eele pomo\u0107i drugim programerima. Ako imate mali tim ili startup, imate sjajnu priliku da u\u0161tedite koriste\u0107i softver s otvorenim izvorom za provjeru sigurnosti svoje kodne baze. Drugo, to vas osloba\u0111a potrebe da zaposlite poseban DevSecOps tim, \u0161to dodatno smanjuje va\u0161e tro\u0161kove.<\/p>\n

Dobri open source alati uvijek se stvaraju uzimaju\u0107i u obzir visoke zahtjeve za fleksibilno\u0161\u0107u. Stoga ih je mogu\u0107e koristiti prakti\u010dki u bilo kojem okru\u017eenju, pokrivaju\u0107i \u0161irok spektar zadataka. Programerima je daleko lak\u0161e povezati takve alate sa sustavom koji su ve\u0107 izgradili dok rade na svojim projektima.<\/p>\n

No, mogu se pojaviti situacije kada \u0107e vam biti potrebna funkcija koja nedostaje u odabranom alatu. U ovom slu\u010daju imate mogu\u0107nost forkati njegov kod i razviti svoj vlastiti alat s funkcionalno\u0161\u0107u koja vam je potrebna.<\/p>\n

Budu\u0107i da ve\u0107inu vremena razvoj softvera s otvorenim izvorom aktivno utje\u010de zajednica, odluke o promjenama donose se relativno brzo i suvislo: programeri open source projekta oslanjaju se na povratne informacije i prijedloge korisnika, na njihove izvje\u0161taje o prona\u0111enim gre\u0161kama i drugim problemima.<\/p>\n

Kori\u0161tenje Graudit-a za analizu sigurnosti koda<\/h2>\n

\nZa stati\u010dku analizu koda mogu se koristiti razli\u010diti alati otvorenog koda; ne postoji univerzalni alat za sve programske jezike. Programeri nekih od njih slijede preporuke OWASP-a i nastoje obuhvatiti \u0161to vi\u0161e jezika.<\/p>\n

Ovdje \u0107emo koristiti Graudit<\/a><\/noindex>, jednostavnu alatku za naredbeni redak koja \u0107e nam omogu\u0107iti da prona\u0111emo ranjivosti u na\u0161oj bazi koda. Podr\u017eava razli\u010dite jezike, no ipak je njihov raspon ograni\u010den. Graudit je razvijen na temelju pomo\u0107nog alata grep, koji je prvotno iza\u0161ao pod GNU licencom.<\/p>\n

Postoje sli\u010dni alati za stati\u010dku analizu koda \u2014 Rough Auditing Tool for Security (RATS), Securitycompass Web Application Analysis Tool (SWAAT), flawfinder i tako dalje. No, Graudit je vrlo fleksibilan i ima minimalne tehni\u010dke zahtjeve. Ipak, mogli biste se suo\u010diti s zadacima koje Graudit ne mo\u017ee rije\u0161iti. Tada mo\u017eete potra\u017eiti druge opcije ovdje na ovom popisu<\/a><\/noindex>.<\/p>\n

Mo\u017eemo integrirati ovaj alat u odre\u0111eni projekt, ili ga u\u010diniti dostupnim za odabranog korisnika, ili pak \u2014 koristiti ga istovremeno u svim na\u0161im projektima. U tome se tako\u0111er o\u010dituje fleksibilnost Graudit-a. Dakle, prvo klonirajmo repozitorij:<\/p>\n

$ git clone https:\/\/github.com\/wireghoul\/graudit<\/code><\/pre>\n
\nSada \u0107emo stvoriti simboli\u010dku poveznicu za Graudit kako bismo ga mogli koristiti u naredbenom formatu<\/p>\n
$ cd ~\/bin && mkdir graudit\n$ ln --symbolic ~\/graudit\/graudit ~\/bin\/graudit<\/code><\/pre>\n
\nDodajmo alias u .bashrc (ili u drugu konfiguracijsku datoteku koju koristite):<\/p>\n
#------ .bashrc ------\nalias graudit="~\/bin\/graudit"<\/code><\/pre>\n
\nPonovo se u\u010ditavamo:<\/p>\n
$ source ~\/.bashrc # ILI\n$ exec $SHELL\n<\/code><\/pre>\n
\nProvjerimo je li instalacija pro\u0161la uspje\u0161no:<\/p>\n
$ graudit -h<\/code><\/pre>\n
Ako vidite ne\u0161to sli\u010dno, onda je sve u redu.<\/p>\n
\"Kako
\n
\nTestirat \u0107u jedan od svojih postoje\u0107ih projekata. Prije pokretanja alata potrebno je proslijediti mu bazu podataka koja odgovara jeziku na kojem je moj projekt napisan. Baze podataka nalaze se u mapi ~\/gradit\/signatures:<\/p>\n
$ graudit -d ~\/gradit\/signatures\/js.db<\/code><\/pre>\n
\nDakle, testirao sam dva js-datoteke iz mog projekta, a Graudit je ispisao informacije o ranjivostima u mom kodu u konzolu:<\/p>\n
\"Kako
\n
\n\"Kako
\n
\nMo\u017eete poku\u0161ati na sli\u010dan na\u010din testirati svoje projekte. Popis baza podataka za razli\u010dite programske jezike mo\u017ee se vidjeti ovdje<\/a><\/noindex>.<\/p>\n
Prednosti i nedostaci Graudit-a<\/h2>\n
\nGraudit podr\u017eava brojne programske jezike. Stoga je prikladan za \u0161irok spektar korisnika. Mo\u017ee se dobro natjecati s bilo kojim besplatnim ili pla\u0107enim alternativama. I vrlo je va\u017eno da se projekt i dalje unapre\u0111uje, a zajednica ne samo da poma\u017ee programerima, ve\u0107 i drugim korisnicima koji poku\u0161avaju razumjeti alat.<\/p>\n
To je korisni alat, no jo\u0161 uvijek ne mo\u017ee uvijek to\u010dno odrediti u \u010demu le\u017ei problem vezan uz sumnjivi dio koda. Programeri nastavljaju raditi na pobolj\u0161anjima Graudit-a. <\/p>\n
Ali u svakom slu\u010daju korisno je obratiti pa\u017enju na potencijalne sigurnosne probleme u kodu koriste\u0107i sli\u010dne alate.<\/p>\n
Po\u010detak\u2026<\/h2>\n
\nU ovom \u010dlanku sam razmatrao samo jedan od mnogih na\u010dina za pronala\u017eenje ranjivosti \u2014 stati\u010dko testiranje sigurnosti aplikacija. U\u010diniti stati\u010dku analizu koda lako je, ali to je samo po\u010detak. Da biste saznali vi\u0161e o sigurnosti va\u0161e kodne baze, potrebno je integrirati druge vrste testiranja u razvojni ciklus softvera.<\/p>\n
<\/p>\n
U okviru reklame<\/h4>\n
\nPouzdan VPS<\/a><\/noindex> i pravi izbor tarifnog plana omogu\u0107it \u0107e vam da se manje ometate od problema \u2014 sve \u0107e raditi bez gre\u0161ke i s vrlo visokim uptime-om!<\/p>\n
\"Kako<\/a><\/noindex>
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
Graudit \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438. \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: Unsplash (Markus Spiske) \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u2014 \u0432\u0430\u0436\u043d\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0432\u0438\u0434\u043e\u0432 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u0430\u0436\u0434\u044b\u0439 \u0438\u0437 \u043d\u0438\u0445 \u0440\u0435\u0448\u0430\u0435\u0442 \u0441\u0432\u043e\u044e \u0437\u0430\u0434\u0430\u0447\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u0438\u0441\u043a\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0434\u0435. \u041e\u0447\u0435\u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-93051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kako koristiti jednostavan alat za pronala\u017eenje ranjivosti u programskom kodu | ProHoster","description":"Graudit podr\u017eava mnoge programske jezike i omogu\u0107uje integraciju testiranja sigurnosti kodne baze direktno u proces razvoja.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043a\u043e\u0434\u0435 | ProHoster","og:description":"Graudit \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-02T11:42:49+00:00","article:modified_time":"2020-09-02T11:42:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93051","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:56:23","updated":"2022-10-03 07:52:13","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/93051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=93051"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/93051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/93052"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=93051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=93051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=93051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}