/catalog/296695a3fdd74f71b4ced1996c9b6856//Document/544746990256197.html/Document/544471531282501.html/Document/544104164757573.html/Document/542014578585669.html/Document/541568788664389.html/Document/539454798217285.html/Document/539453662449733.html/Document/539106840522821.html/Document/539106318127173.html/Document/537759498522693.html/Document/537758873952325.html/Document/536670380744773.html/Document/536669918658629.html/Document/535274533212229.html/Document/535274076639301.html/Document/534838127284293.html/Document/534837539852357.html/Document/534514390343749.html/Document/534513902743621.html/Document/534129665769541.html/Document/534128754413637.html/Document/531769332838469.html/Document/531768875597893.html/Document/530599306571845.html/Document/530598883192901.html/Document/529281313382469.html/Document/529280904593477.html/Document/528111744671813.html/Document/528111122219077.html/Document/527768380964933.html/Document/527767993040965.html/Document/526809318363205.html/Document/526808901791813.html/Document/525648271851589.html/Document/525647771697221.html/Document/524949682458693.html/Document/524949227167813.html/Document/524290312802373.html/Document/524289770504261.html/Document/523187817824325.html/Document/523187349782597.html/Document/522458063388741.html/Document/522457524322373.html/Document/522111178473541.html/Document/522110478868549.html/Document/521742111748165.html/Document/521740472320069.html/Document/520680288002117.html/Document/520679709044805.html/Document/520421404913733.html/Document/520420916084805.html/Document/519695556915269.html/Document/519695178637381.html/Document/519286084939845.html/Document/519285550596165.html/Document/517527679774789.html/Document/517527163703365.html/Document/512185975087173.html/Document/511946871631941.html/Document/511946429853765.html/Document/510490688409669.html/Document/510490145665093.html/Document/509474966245445.html/Document/509474292002885.html/Document/508381305012293.html/Document/508380165513285.html/Document/507942179053637.html/Document/507941613613125.html/Document/507336815288389.html/Document/507336323162181.html/Document/506969107042373.html/Document/506968450326597.html/Document/505888177782853.html/Document/505887157772357.html/Document/505549163270213.html/Document/505548496027717.html/Document/505143668654149.html/Document/505143105032261.html/Document/504503398395973.html/Document/504502746468421.html/Document/503017040437317.html/Document/503016609853509.html/Document/502718247415877.html/Document/502717705343045.html/Document/502361750245445.html/Document/502361307697221.html/Document/501990556381253.html/Document/501989827113029.html/Document/500880675987525.html/Document/500880224911429.html/Document/500250144956485.html/Document/500232490541125.html/Document/499908522852421.html/Document/499907986919493.html/Document/498447282262085.html/Document/498446788378693.html/Document/498103952822341.html/Document/498103476068421.html/Document/497705815789637.html/Document/497703055208517.html/Document/497352259182661.html/Document/497351210856517.html/Document/496977382301765.html/Document/496976846573637.html/Document/495934617931845.html/Document/495933266260037.html/Document/495577945600069.html/Document/495576688218181.html/Document/494873100378181.html/Document/494872714567749.html/Document/494515031642181.html/Document/494514507194437.html/Document/492829277941829.html/Document/492826934538309.html/Document/492478892306501.html/Document/492478432673861.html/Document/492048771612741.html/Document/492048321876037.html/Document/491018538238021.html/Document/491017994391621.html/Document/490617591144517.html/Document/490616589226053.html/Document/490277546360901.html/Document/490277081866309.html/Document/488480491106373.html/Document/488479777673285.html/Document/488131539537989.html/Document/488129496956997.html/Document/487787449102405.html/Document/487786620837957.html/Document/487425698246725.html/Document/487425161941061.html/Document/487077007417413.html/Document/487076470157381.html/Document/486012783796293.html/Document/486011843792965.html/Document/485654058504261.html/Document/485653628149829.html/Document/485285488848965.html/Document/485005121204293.html/Document/485004810907717.html/Document/483634668224581.html/Document/483162688110661.html/Document/482456439619653.html/Document/480691329347653.html/Document/479981549019205.html/Document/479640516874309.html/Document/478581868011589.html/Document/478211995488325.html/Document/477860005101637.html/Document/477516631253061.html/Document/476091023597637.html/Document/475748190408773.html/Document/475747825885253.html/Document/475390229778501.html/Document/475389762682949.html/Document/475021811523653.html/Document/475021482278981.html/Document/474681074966597.html/Document/474680715309125.html/Document/473641910472773.html/Document/473641599152197.html/Document/472917246013509.html/Document/472916949708869.html/Document/472553316364357.html/Document/472553009672261.html/Document/472222551654469.html/Document/472222166081605.html/Document/470772911669317.html/Document/470772523974725.html/Document/470491812298821.html/Document/470491020734533.html/Document/470144418017349.html/Document/470144062480453.html/Document/469355727437893.html/Document/469355344896069.html/Document/469002772238405.html/Document/469002372866117.html/Document/465854760509509.html/Document/465854252036165.html/Document/465481503801413.html/Document/465481068789829.html/Document/465193214992453.html/Document/465192312610885.html/Document/464860703494213.html/Document/464860235079749.html/Document/463357444149317.html/Document/463351258955845.html/Document/462989079121989.html/Document/462988335923269.html/Document/462660239003717.html/Document/462658920042565.html/Document/461304163098693.html/Document/461301616328773.html/Document/460881708830789.html/Document/460876803891269.html/Document/460520743743557.html/Document/460513554071621.html/Document/460169107955781.html/Document/460168465489989.html/Document/459825920966725.html/Document/459825340420165.html/Document/458389364535365.html/Document/458388990779461.html/Document/458052748820549.html/Document/458051490840645.html/Document/457785747443781.html/Document/457785205239877.html/Document/457346283610181.html/Document/457345117622341.html/Document/456266454548549.html/Document/456265627877445.html/Document/455911269912645.html/Document/455557920325701.html/Document/455557492965445.html/Document/455218049572933.html/Document/454857812234309.html/Document/453789017641029.html/Document/453449959817285.html/Document/453079570784325.html/Document/452403319308357.html/Document/451310486503493.html/Document/450994786713669.html/Document/450345001971781.html/Document/449962449588293.html/Document/448929358094405.html/Document/448230949081157.html/Document/447863453311045.html/Document/446102887440453.html/Document/445725270851653.html/Document/445022107115589.html/Document/443641819930693.html/Document/443271687684165.html/Document/443270796382277.html/Document/443270370861125.html/Document/441430268338245.html/Document/441419688190021.html/Document/441419056222277.html/Document/440429294637125.html/Document/438340763410501.html/Document/437986291200069.html/Document/437603819495493.html/Document/436191615103045.html/Document/435855229702213.html/Document/435147718438981.html/Document/434051877818437.html/Document/433366954807365.html/Document/432997464641605.html/Document/432628688769093.html/Document/432266670596165.html/Document/430907430723653.html/Document/428784032424005.html/Document/428385797652549.html/Document/428062862630981.html/Document/427712386293829.html/Document/426283111870533.html/Document/424188637298757.html/Document/423430430916677.html/Document/422738450387013.html/Document/421335462469701.html/Document/420956089200709.html/Document/420244068835397.html/Document/419142595375173.html/Document/418879737671749.html/Document/418156051357765.html/Document/417780141715525.html/Document/416729842651205.html/Document/416373677670469.html/Document/416014651207749.html/Document/414600654966853.html/Document/414232150913093.html/Document/413894034452549.html/Document/411749575036997.html/Document/411444007235653.html/Document/410989555187781.html/Document/410365315555397.html/Document/408937260335173.html/Document/408592682856517.html/Document/408239118336069.html/Document/402940329152581.html/Document/401521045061701.html/Document/401149456379973.html/Document/400819542675525.html/Document/400464907001925.html/Document/399363703992389.html/Document/399019061391429.html/Document/398327264952389.html/Document/397988956139589.html/Document/396547962679365.html/Document/396188926316613.html/Document/395839580831813.html/Document/395509538283589.html/Document/393696815161413.html/Document/393356444545093.html/Document/393008819511365.html/Document/391891180220485.html/Document/391256916983877.html/Document/390918744105029.html/Document/390528820486213.html/Document/389136971677765.html/Document/388763822231621.html/Document/388416565977157.html/Document/388045527777349.html/Document/386637062586437.html/Document/386290355249221.html/Document/386290343432261.html/Document/385922848862277.html/Document/384498574901317.html/Document/384178599956549.html/Document/383813990293573.html/Document/383450832826437.html/Document/383112784425029.html/Document/381983009394757.html/Document/381676021035077.html/Document/381338668412997.html/Document/380973198676037.html/Document/380625301606469.html/Document/376028059926597.html/Document/374587749163077.html/Document/374252417724485.html/Document/373905092177989.html/Document/373540837523525.html/Document/373226847809605.html/Document/311601443917893.html/Document/311285189517381.html/Document/310134890274885.html/Document/309794452426821.html/Document/309507604934725.html/Document/304898482892869.html/Document/304549706600517.html/Document/304188584996933.html/Document/303818784497733.html/Document/302700517105733.html/Document/302416475320389.html/Document/302077848256581.html/Document/301288627347525.html/Document/300279638184005.html/Document/274792263872581.html/Document/273024381308997.html/Document/272683642789957.html/Document/272351623921733.html/Document/271961406242885.html/Document/271560844214341.html/Document/270477420015685.html/Document/269881559916613.html/catalog/c51244b85e704db9a2a34ca396e9fe27//Document/375674108960837.html/Document/340619525128261.html/Document/340263572500549.html/Document/337103780888645.html/Document/336726028042309.html/Document/336395351863365.html/Document/336019384291397.html/Document/334605603291205.html/Document/334264344903749.html/Document/333908786077765.html/Document/333537608929349.html/Document/332422937043013.html/Document/323979240091717.html/Document/323624591507525.html/Document/322518056206405.html/Document/322224629981253.html/Document/321870777405509.html/Document/321154810175557.html/Document/319738524639301.html/Document/319395521761349.html/Document/319038449188933.html/Document/318684198744133.html/Document/317575537291333.html/Document/316584392339525.html/Document/297463116619845.html/Document/296410729726021.html/Document/294281412902981.html/Document/289614801383493.html/Document/289336711553093.html/Document/288989717336133.html/Document/267736666357829.html

安全测试方法介绍(上)静态源代码审查

软件开发完成之后,我们需要进行安全验证,验证我们的软件是不是符合安全要求。软件安全测试主要有以下几个方面:确定软件的安全特性实现是否与预期设计一致的过程;有关验证软件安全等级和识别潜在安全缺陷的过程;查找软件自身程序设计中存在的安全隐患,并检查;应用程序对非法侵入的防范能力。


为什么需要软件安全测试?主要是因为传统测试仅考虑软件出错时的处理,没有考虑对软件的故意安全攻击,所以需要专业的软件安全测试。


在应用投产前,应由独立的安全团队对应用的安全性进行综合评估,一般会从两个层面进行开展,一方面是功能性安全测试,另一方面是对抗性安全测试。


安全主要测试方法主要有:静态源代码审查,这个在编码阶段就可以进行,这个阶段如果出现问题,修复起来成本也比较低。程序发布之后可以进行渗透测试。


先给大家介绍一下源代码审查。作为软件测试的基本方法,静态分析可以快速、准确定位到软件缺陷的源代码。能有效的提高软件的可靠性和安全性。


静态分析是指在编译理论的基础上,对程序的结构、语义做软件安全性方面的分析。


静态源代码审查可以通过人工和工具相结合的方式对源代码的安全性进行测试,可以识别、跟踪和修复源代码中技术上和逻辑上的缺陷,比如软件安全漏洞、质量缺陷问题和业务逻辑问题等。
静态代码审查方法主要是在编码阶段进行测试,尽可能早地发现安全性问题。


静态源代码审查在某些行业是有些要求的,像金融银行业网上银行系统信息安全通用规范,会要求由第三方机构进行安全检测。

静态源代码审查

【源代码审查-人工审计】
人工审计部分内容的部分除了对工具扫描出来的问题进行审查,以下问题进行检查。
环境安全:第三方软件安全、开发环境安全、运行环境安全等。如中间件使用安全,是否使用最新版本的JDK,移动APP发布前是否使用混淆、签名、加固等保护方式等检查。
配置核查:对应用的配置方面进行全面检查,包括默认的安全配置、后台权限、运行账号、系统配置和运行环境等全面核查。
【反射型XSS攻击】
下图是我之前做过的一个截图,这是一个XSS的攻击,通过源代码审查可以把注入点定位出来,我们可以看到这是从请求中获取了一个字段,经过一个数据流返回到了用户这边。这是一个存储型的,从前段录入的一些信息,入库之后,再从库中取出来。

源代码审查

反射型XSS攻击

【XSS代码修复方式】
XSS攻击可以通过过滤器的方式规避,像Spring Boot里的过滤器。请求来的时候,先进过滤器,过滤之后,在进Servlet。

XSS代码修复方式

Spring Boot过滤器

XSS代码修复

【SQL注入攻击】
下图是一个SQL注入攻击的例子,这是Mybatis的框架,我们可以看到框线中是用$符取了一个前端的参数,很容易造成SQL注入。

SQL注入攻击

【SQL注入攻击修复方式】
Mybatis中建议用#的方式,这种方式会自动在参数两边加单引号,这样就能在一定程度上防止SQL注入。

SQL注入攻击修复方式