3.1 - Code And Route Analysis

Goal

The primary objective of this activity is to conduct an in-depth analysis of the application’s codebase and routing logic to identify potentially vulnerable endpoints and functions. This step aims to pinpoint areas within the code that may be susceptible to exploitation, serving as a focused starting point for deeper security testing.

How to Execute

1. Analyze the Application’s Codebase
   • Description: Conduct a thorough analysis of the application’s codebase to evaluate its cyclomatic and cognitive complexity. These metrics are crucial for identifying sections of the code that are complex and potentially error-prone, making them high-interest areas for manual review due to their increased likelihood of containing subtle and critical security vulnerabilities.
   • Tools/Techniques
     • Cyclomatic Complexity Measurement: Utilize tools such as SonarQube, which can assess the cyclomatic complexity, indicating the number of linearly independent paths through the code. This helps in identifying areas that may require more exhaustive testing and review.
     • Cognitive Complexity Assessment: Measure the cognitive complexity using tools integrated within IDEs or standalone applications like CodeScene or SonarQube. Cognitive complexity provides insights into the effort required to understand and maintain the code.
     • Manual Code Review: Prioritize manual code reviews for areas with high complexity scores. These reviews should be conducted by experienced developers or security analysts who can identify not just straightforward bugs but also nuanced security risks that automated tools are likely to miss.
   • Output
     • Complexity Analysis Report: A detailed report that lists the cyclomatic and cognitive complexity of different sections of the application, pinpointing areas that need focused attention.
     • Manual Review Report: Findings from the manual reviews of high-complexity code areas, including specific vulnerabilities related to complex logic, suggestions for code simplification, and other security or maintenance issues identified during the review.

1. Examine Application Routing
   • Description: Review the routing mechanisms of the application to ensure secure data transmission between endpoints and verify that all routes are properly authorized and authenticated. Additionally, by mapping all the routes used, we gain a thorough understanding of the potential attack surface, enhancing our ability to identify and address vulnerabilities effectively.
   • Tools/Techniques:
     • Analyze configuration files and routing tables to ensure routes are secure and do not expose sensitive endpoints to unauthorized users.
     • Write custom Semgrep rules focused primarely on checking authentication and authorization in routing and methods throughout the application. These rules will verify the presence and correctness of security measures, ensuring that nothing crucial is missing in these areas during the development cycles.
     • Map application routes to systematically document and analyze all active routes within the application. This mapping helps in assessing the overall attack surface by identifying potential vulnerabilities and ensuring comprehensive coverage in security testing.
   • Output: A comprehensive evaluation of the application’s routing logic, highlighting any misconfigurations or vulnerabilities that could allow unauthorized access or data leakage.

1. Identification of Business-Critical Code Sections
   • Description: Pinpoint specific segments of the codebase that manage core business operations, such as payment processing, personal data handling, or other functions that are essential for daily business activities and compliance with legal standards.
   • Tools/Techniques:
     • Collaborate with business analysts and product managers to understand which functionalities are deemed critical.
     • Utilize code tagging and documentation reviews to highlight and categorize business-critical segments.
   • Output: A categorized list of all business-critical functions within the codebase, accompanied by detailed descriptions and their importance to business operations.