{"id":93051,"date":"2020-09-02T13:42:49","date_gmt":"2020-09-02T11:42:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode"},"modified":"2020-09-02T13:42:49","modified_gmt":"2020-09-02T11:42:49","slug":"kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","title":{"rendered":"Cum s\u0103 folosi\u021bi un instrument simplu pentru a c\u0103uta vulnerabilit\u0103\u021bi \u00een codul surs\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Graudit suport\u0103 mai multe limbaje de programare \u0219i permite integrarea test\u0103rii securit\u0103\u021bii codului surs\u0103 direct \u00een procesul de dezvoltare.<\/p>\n

\"Cum
\nSursa: Unsplash<\/a><\/noindex> (Markus Spiske)<\/p>\n

Testarea este o parte esen\u021bial\u0103 a ciclului de via\u021b\u0103 al dezvolt\u0103rii software-ului. Exist\u0103 multe tipuri de testare, fiecare av\u00e2nd propria sa scop. Ast\u0103zi vreau s\u0103 discut despre identificarea problemelor de securitate \u00een cod.<\/p>\n

Este evident c\u0103 \u00een realit\u0103\u021bile moderne ale dezvolt\u0103rii software-ului, este crucial s\u0103 asigur\u0103m securitatea proceselor. La un moment dat, a fost introdus chiar un termen special, DevSecOps. Acest termen se refer\u0103 la un set de proceduri menite s\u0103 identifice \u0219i s\u0103 elimine vulnerabilit\u0103\u021bile din aplica\u021bie. Exist\u0103 solu\u021bii open source specializate pentru verificarea vulnerabilit\u0103\u021bilor conform standardelor OWASP<\/a><\/noindex>, care descriu diferitele tipuri \u0219i comportamente ale vulnerabilit\u0103\u021bilor \u00een codul surs\u0103.
\n<\/a><\/noindex><\/p>\n

Exist\u0103 diverse abord\u0103ri pentru a rezolva problemele de securitate, cum ar fi testarea static\u0103 a securit\u0103\u021bii aplica\u021biilor (SAST), testarea dinamic\u0103 a securit\u0103\u021bii aplica\u021biilor (DAST), testarea interactiv\u0103 a securit\u0103\u021bii aplica\u021biilor (IAST), analiza componentelor software (Software Composition Analysis) \u0219i altele.<\/p>\n

Testarea static\u0103 a securit\u0103\u021bii aplica\u021biilor identific\u0103 erorile \u00een codul deja scris. Aceast\u0103 abordare nu necesit\u0103 rularea aplica\u021biei, astfel \u00eenc\u00e2t este denumit\u0103 analiz\u0103 static\u0103.<\/p>\n

M\u0103 voi concentra asupra analizei statice a codului \u0219i voi folosi un simplu instrument open source pentru a demonstra totul \u00een practic\u0103.<\/p>\n

De ce am ales un instrument open source pentru analiza static\u0103 a securit\u0103\u021bii codului<\/h2>\n

\nExist\u0103 mai multe motive: \u00een primul r\u00e2nd, este gratuit, deoarece folosi\u021bi un instrument dezvoltat de o comunitate de oameni care doresc s\u0103 ajute al\u021bi dezvoltatori. Dac\u0103 ave\u021bi o echip\u0103 mic\u0103 sau un startup, ave\u021bi o oportunitate excelent\u0103 de a economisi folosind software open source pentru a verifica securitatea codului vostru. \u00cen al doilea r\u00e2nd, v\u0103 scute\u0219te de necesitatea de a angaja o echip\u0103 separat\u0103 DevSecOps, ceea ce reduce \u0219i mai mult cheltuielile.<\/p>\n

Instrumentele open source de calitate sunt \u00eentotdeauna create av\u00e2nd \u00een vedere cerin\u021be sporite de flexibilitate. Astfel, ele pot fi utilizate practic \u00een orice mediu, acoperind o gam\u0103 larg\u0103 de sarcini. Este mult mai u\u0219or pentru dezvoltatori s\u0103 integreze aceste instrumente cu sistemul pe care l-au construit deja \u00een timpul proiectelor lor.<\/p>\n

\u00cens\u0103 pot ap\u0103rea situa\u021bii \u00een care ave\u021bi nevoie de o func\u021bionalitate care nu se afl\u0103 \u00een instrumentul ales. \u00cen acest caz, ave\u021bi posibilitatea de a face fork pe codul s\u0103u \u0219i de a dezvolta pe baza lui propriul instrument cu func\u021bionalit\u0103\u021bile necesare.<\/p>\n

Deoarece \u00een majoritatea cazurilor dezvoltarea software-ului open source este influen\u021bat\u0103 activ de comunitate, decizia de a efectua modific\u0103ri este luat\u0103 destul de rapid \u0219i pertinent: dezvoltatorii proiectelor open source se bazeaz\u0103 pe feedback-ul \u0219i sugestiile utilizatorilor, pe mesajele lor referitoare la erori descoperite \u0219i alte probleme.<\/p>\n

Utilizarea Graudit pentru analiza securit\u0103\u021bii codului<\/h2>\n

\nPentru analiza static\u0103 a codului se pot utiliza diferite instrumente open source, nu exist\u0103 un instrument universal pentru toate limbajele de programare. Unii dintre dezvoltatorii acestora urmeaz\u0103 recomand\u0103rile OWASP \u0219i \u00eencearc\u0103 s\u0103 acopere c\u00e2t mai multe limbaje.<\/p>\n

Aici vom folosi Graudit<\/a><\/noindex>, un utilitar simplu pentru linia de comand\u0103, care ne va permite s\u0103 identific\u0103m vulnerabilit\u0103\u021bile din baza noastr\u0103 de cod. Acesta suport\u0103 diferite limbaje, dar totu\u0219i setul lor este limitat. Graudit este dezvoltat pe baza utilitarului de sistem grep, care a fost lansat sub licen\u021ba GNU.<\/p>\n

Exist\u0103 instrumente similare pentru analiza static\u0103 a codului \u2014 Rough Auditing Tool for Security (RATS), Securitycompass Web Application Analysis Tool (SWAAT), flawfinder \u0219i a\u0219a mai departe. \u00cens\u0103 Graudit este foarte flexibil \u0219i are cerin\u021be tehnice minime. Totu\u0219i, pot ap\u0103rea sarcini pe care Graudit nu le poate rezolva. Atunci, pute\u021bi c\u0103uta alte op\u021biuni \u00een aceast\u0103 list\u0103<\/a><\/noindex>.<\/p>\n

Putem integra acest instrument \u00eentr-un proiect specific, sau \u00eel putem face disponibil pentru un utilizator ales, sau \u2014\u00eel putem folosi simultan \u00een toate proiectele noastre. Aici se manifest\u0103 \u0219i flexibilitatea Graudit. A\u0219adar, s\u0103 clon\u0103m mai \u00eent\u00e2i repo-ul:<\/p>\n

$ git clone https:\/\/github.com\/wireghoul\/graudit<\/code><\/pre>\n
\nAcum s\u0103 cre\u0103m un link simbolic pentru Graudit, astfel \u00eenc\u00e2t s\u0103 \u00eel folosim \u00een format de comand\u0103<\/p>\n
$ cd ~\/bin && mkdir graudit\n$ ln --symbolic ~\/graudit\/graudit ~\/bin\/graudit<\/code><\/pre>\n
\nS\u0103 ad\u0103ug\u0103m un alias \u00een .bashrc (sau \u00een alt fi\u0219ier de configurare pe care \u00eel folosi\u021bi):<\/p>\n
#------ .bashrc ------\nalias graudit="~\/bin\/graudit"<\/code><\/pre>\n
\nRe\u00eenc\u0103rca\u021bi:<\/p>\n
$ source ~\/.bashrc # SAU\n$ exec $SHELL\n<\/code><\/pre>\n
\nS\u0103 verific\u0103m dac\u0103 instalarea a fost efectuat\u0103 cu succes:<\/p>\n
$ graudit -h<\/code><\/pre>\n
Dac\u0103 vede\u021bi ceva asem\u0103n\u0103tor, \u00eenseamn\u0103 c\u0103 totul este \u00een regul\u0103.<\/p>\n
\"Cum
\n
\nVoi testa unul dintre proiectele mele existente. \u00cenainte de a rula instrumentul, trebuie s\u0103 \u00eei transmit o baz\u0103 de date corespunz\u0103toare limbajului \u00een care este scris proiectul meu. Bazele de date se afl\u0103 \u00een folderul ~\/gradit\/signatures:<\/p>\n
$ graudit -d ~\/gradit\/signatures\/js.db<\/code><\/pre>\n
\nDeci, am testat dou\u0103 fi\u0219iere js din proiectul meu, iar Graudit a afi\u0219at \u00een consol\u0103 informa\u021bii despre vulnerabilit\u0103\u021bile din codul meu:<\/p>\n
\"Cum
\n
\n\"Cum
\n
\nPute\u021bi \u00eencerca s\u0103 testa\u021bi proiectele voastre \u00een acela\u0219i mod. Lista bazelor de date pentru diferite limbaje de programare poate fi consultat\u0103 aici<\/a><\/noindex>.<\/p>\n
Avantajele \u0219i dezavantajele Graudit<\/h2>\n
\nGraudit suport\u0103 o multitudine de limbaje de programare. Prin urmare, se potrive\u0219te unui num\u0103r mare de utilizatori. Acesta poate concura cu succes cu orice alternativ\u0103 gratuit\u0103 sau pl\u0103tit\u0103. \u0218i este foarte important c\u0103 proiectul continu\u0103 s\u0103 fie \u00eembun\u0103t\u0103\u021bit, iar comunitatea nu doar ajut\u0103 dezvoltatorii, ci \u0219i al\u021bi utilizatori care \u00eencearc\u0103 s\u0103 \u00een\u021beleag\u0103 instrumentul.<\/p>\n
Este un instrument convenabil, dar deocamdat\u0103 nu poate indica \u00eentotdeauna cu exactitate care este problema legat\u0103 de un segment de cod suspect. Dezvoltatorii continu\u0103 s\u0103 \u00eembun\u0103t\u0103\u021beasc\u0103 Graudit. <\/p>\n
Dar, \u00een orice caz, este util s\u0103 acorda\u021bi aten\u021bie problemelor poten\u021biale de securitate \u00een cod, folosind astfel de instrumente.<\/p>\n
\u00cencepere…<\/h2>\n
\n\u00cen acest articol am examinat doar una dintre numeroasele metode de g\u0103sire a vulnerabilit\u0103\u021bilor - testarea static\u0103 a securit\u0103\u021bii aplica\u021biilor. Analiza static\u0103 a codului este u\u0219or de realizat, dar acesta este doar \u00eenceputul. Pentru a \u00eenv\u0103\u021ba mai multe despre securitatea bazei de cod, trebuie integrate \u00een ciclul de via\u021b\u0103 al dezvolt\u0103rii software-ului \u0219i alte tipuri de teste.<\/p>\n
<\/p>\n
\u00cen numele publicit\u0103\u021bii<\/h4>\n
\nUn VPS de \u00eencredere<\/a><\/noindex> \u0219i alegerea corect\u0103 a planului tarifar v\u0103 vor permite s\u0103 v\u0103 concentra\u021bi mai pu\u021bin asupra problemelor nepl\u0103cute - totul va func\u021biona f\u0103r\u0103 \u00eentreruperi \u0219i cu un uptime foarte ridicat!<\/p>\n
\"Cum<\/a><\/noindex>
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
Graudit \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438. \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: Unsplash (Markus Spiske) \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u2014 \u0432\u0430\u0436\u043d\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0432\u0438\u0434\u043e\u0432 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u0430\u0436\u0434\u044b\u0439 \u0438\u0437 \u043d\u0438\u0445 \u0440\u0435\u0448\u0430\u0435\u0442 \u0441\u0432\u043e\u044e \u0437\u0430\u0434\u0430\u0447\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u0438\u0441\u043a\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0434\u0435. \u041e\u0447\u0435\u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-93051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum s\u0103 folose\u0219ti o utilitate simpl\u0103 pentru a c\u0103uta vulnerabilit\u0103\u021bi \u00een codul surs\u0103 | ProHoster","description":"Graudit suport\u0103 mai multe limbaje de programare \u0219i permite integrarea test\u0103rii securit\u0103\u021bii codului surs\u0103 direct \u00een procesul de dezvoltare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043a\u043e\u0434\u0435 | ProHoster","og:description":"Graudit \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-prostuyu-utilitu-dlya-poiska-uyazvimostej-v-programmnom-kode","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-02T11:42:49+00:00","article:modified_time":"2020-09-02T11:42:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93051","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:56:23","updated":"2022-10-03 07:52:13","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/93051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=93051"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/93051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/93052"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=93051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=93051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=93051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}