[Autogenerated] we're about to create a project in soma cube that will
point to our source code on our local machine first we navigate to
projects then click the tile for manual project creation here we give our
project a display name and the project key.
For example test security with Soner.
The values for the key and name can be identical on the.
How do you want to analyze your repository screen?
You have several options.
He can integrate with Jenkins or with your favorite version
control management solution like GitHub bit bucket.
Get lab or some other provider.
Sona cube can pull the code from your repository
after you provide the credentials.
In our case we'll choose the tile that breeds locally to
analyze the code directly from our local machine.
The screen that falls asks you to provide a security token,
select the generator project token radio button and enter a name for
the token For example test security with soner one.
He can keep the expiration in 30 days which is the default.
You can specify a longer duration or said the token to never
expire but I don't recommend that as best.
practice of course we can always revolve the token if necessary.
Who will keep it in 30 days and click the generate button.
Save this open for future use then hit continue
only analyze your project screen.
You just need to select the built tool you're going to use so that sonar
can customize the command for running the analysis.
We choose maven and here we go the instructions display on the screen
with a security token pre populated as part of the generated command
and with a convenient copy button on the right to grab the piece of
code and paste it in the terminal.
Save the snippet for future use.
We'll need it to run the analysis later and now let's take a
quick look at the source code as well.
In this contrived project we're aiming at flagging three
Miter attack TTPS with Sauna Cube.
Here's the first piece of code that will be flagged as os A one
injection which can be mapped to mirror attack technique.
T 1190 exploit public facing applications and mr C w e 89 improper
neutralization of special elements used in the sequel command.
As you can see in the comments above the method.
Next let's take a look at the code in our registered controller that
exemplifies the second T T p mr attack technique.
T 1189 drive by compromise.
Also known as cross site scripting,
which is one of its varieties in terms of os This problem is classified as
top 10 2017 category A seven cross site scripting here.
We clearly see how sensitive information is passed into a cookie.
Who's http only flag is left false as it is by default.
Sandra cube.
Both detectives and reported as a hotspot under the other category.
As we'll see in a moment.
Finally,
the third TTP related code can be found here in our registration service
and more specifically in the encrypt password method.
This is an example of mid air attack technique.
T 1078 valid accounts which maps to iOS top 10 2017
category A two broken authentication.
As you can see the D.
S algorithm used for encryption is pretty dated.
We should be using A.
S.
Instead.
Of course,
you will see this flag as a vulnerability by sonar cube in just a minute.
Now it's time to run an analysis against the skull base and see
who comes knocking coming up in the next clip.