Testes Segurança de Caixa Branca de forma Automatizada

Uma boa ferramenta para Testes Segurança de Caixa Branca Automatizado é o Sonar, que faz a analisa de segurança Interna do Sistema, na camada de Aplicação. Realizada principalmente por meio de análise de código fonte - via verificadores de código estáticas e dinâmicas e dos métodos. O Sonar inclui os plugins por padrão PMD, PMD - Security rules plugin, FindBugs.

Veja abaixo quais são as regras.

• PMD
• Basic JSP (http://pmd.sourceforge.net/pmd-5.0.0/rules/index.html#Basic_JSP)
  
• Securitycode guidelines (http://pmd.sourceforge.net/pmd-5.0.0/rules/index.html#Security_Code_Guidelines)
• PMD - Security rules plugin (http://www.sonarsource.org/sonar-to-identify-security-vulnerabilities/)
  
• SQL injection vulnerability
• Password management vulnerability
• Error Handling and logging flaws
• Insecure direct object reference
  
• FindBugs
• Hardcoded constant database password (http://findbugs.sourceforge.net/bugDescriptions.html#DMI_CONSTANT_DB_PASSWORD)
• Entity database password (http://findbugs.sourceforge.net/bugDescriptions.html#DMI_EMPTY_DB_PASSWORD)
• Cookie formed from untrusted input (http://findbugs.sourceforge.net/bugDescriptions.html#HRS_REQUEST_PARAMETER_TO_COOKIE)
• HTTP Response spliting vulnerability (http://findbugs.sourceforge.net/bugDescriptions.html#HRS_REQUEST_PARAMETER_TO_HTTP_HEADER)
• Absolute path transversal in servlet (http://findbugs.sourceforge.net/bugDescriptions.html#PT_ABSOLUTE_PATH_TRAVERSAL)
• Relative path transversal in servlet (http://findbugs.sourceforge.net/bugDescriptions.html#PT_RELATIVE_PATH_TRAVERSAL)
• Nonconstant string passed to execute method on an SQL statement (http://findbugs.sourceforge.net/bugDescriptions.html#SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE)
  
• A prepared statement is generated from a nonconstant String (http://findbugs.sourceforge.net/bugDescriptions.html#SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING)
  
• JSP reflected cross site scripting vulnerability (http://findbugs.sourceforge.net/bugDescriptions.html#XSS_REQUEST_PARAMETER_TO_JSP_WRITER)
  
• Servlet reflected cross site scripting vulnerability in error page (http://findbugs.sourceforge.net/bugDescriptions.html#XSS_REQUEST_PARAMETER_TO_SEND_ERROR)
  
• Servlet reflected cross site scripting vulnerability (http://findbugs.sourceforge.net/bugDescriptions.html#XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER)