2KKUU7ita

302
Part V: Hacking Applications
(www.sourcefire.com/security-technologies/network-
security/next-generation-intrusion-prevention-system).
✓ A host-based web application IPS, such as SecureIIS (www.eeye.com/
products/secureiis-web-server-security) or ServerDefender
(www.port80software.com/products/serverdefender).
These programs can detect web application and certain database attacks
in real time and cut them off before they have a chance to do any harm.
Analyzing source code
Software development is where security holes begin and should end but
rarely do. If you feel confident in your ethical hacking efforts to this point,
you can dig deeper to find security flaws in your source code — things that
might never be discovered by traditional scanners and hacking techniques
but that are problems nonetheless. Fear not! It’s actually much simpler than
it sounds. No, you won’t have to go through the code line by line to see
what’s happening. You don’t even need development experience (although it
does help).
To do this, you can use a static source code analysis tool, such as those offered
by Veracode (www.veracode.com) and Checkmarx (www.checkmarx.com).
Checkmarx’s CxSuite (more specifically CxDeveloper) is a standalone tool
that’s reasonably priced and very comprehensive in its testing of both web
applications and mobile apps.
As shown in Figure 14-13, with CxDeveloper, you simply load the Enterprise
Client, log in to the application (default credentials are admin@cx/admin),
run the Create Scan Wizard to point it to the source code and select your
scan policy, click Next, click Run, and you’re off and running.
When the scan completes, you can review the findings and recommended
solutions, as shown in Figure 14-14.