Static Application Security Testing (SAST)

VerSprite conducts manual security testing of web presence in order to identify application flaws around authentication, vulnerabilities from web frameworks, injection mitigation, malicious file uploads, and other types of web-based attacks. The manual application security threat analysis will include, but are not limited to, the following areas:

Web-related misconfiguration flaw(s)
System/network level insecurity or vulnerabilities that could be exploited
Authentication by-pass flaws in web applications or APIs
Business disruption
Privilege/ role escalation
Information leakage
Poor architecture considerations for network/ data security
Administrative access violations
Other areas covered by web frameworks like the OWASP Top Ten (2017 edition)

Identify Security Flaws in the Application Using Manual Penetration Testing

Identify vulnerabilities found within the web application - bugs in the application, an injection (SQL/ script code), or the presence of viruses.

URL Manipulation - Some web applications communicate additional information between the client (browser) and the server in the URL. Changing some information in the URL may sometimes lead to unintended behavior by the server and this termed as URL Manipulation. SQL injection - This is the process of inserting SQL statements through the web application user interface into some query that is then executed by the server. XSS (Cross-Site Scripting) - When a user inserts HTML/ client-side script in the user interface of a web application, this insertion is visible to other users and it is termed as XSS. Spoofing - The creation of hoax look-alike websites or emails is called Spoofing.

Security Flaws

Web-related misconfiguration flaw(s)
System/network level insecurity or vulnerabilities that could be exploited
Authentication by-pass flaws in web applications or APIs
Business disruption
Privilege/ role escalation
Information leakage
Poor architecture considerations for network/ data security
Administrative access violations
Other areas covered by web frameworks like the OWASP Top Ten (2017 edition)

Much like automated dynamic application security testing (DAST) solutions, false positives are produced with static analysis of source code reviews, particularly when pure automation is involved.

For any given application where thousands (if not millions) of lines of code are ingested into a solution, many developers begin to receive an endless list of findings that are often riddled with the following:

False positives that consume developers time
Security findings devoid of any threat context
Static findings that are devoid of supportive dynamic results

Static Application Security Testing (SAST)

Focus on the most impactful security weaknesses in your application

Identify Security Flaws in the Application Using Manual Penetration Testing

Security Flaws