Example example of SQL Injection using Database.SQLQuery from GitHub (and idea for Cat.NET workflow)

After posting Another example why SATS technology needs custom rules (re: Detecting SQL Injection on .NET Entity framework)  I did this search on GitHub, and found an example of that dangerous Database.SqlQuery API in use:

• https://github.com/caioketo/QIERP/blob/master/QIERPDatabase/VerpContext.cs#L55 (with default sa pwd and use of Database.ExecuteSqlCommand:) 

These one allows callers to create SQL Injection (which means that whoever is consuming those APIs need to be VERY careful)

• https://github.com/revolutionaryarts/wewillgather/blob/master/src/Libraries/Gather.Data/GatherObjectContext.cs#L69 
• https://github.com/philpeace/PointyPointy/blob/master/PointyPointy.Web/Data/StoryContext.cs#L51
• https://github.com/samandmoore/GetRDoneWeb/blob/master/GetRDone/GetRDoneContext.cs#L25
• https://github.com/slask/MVCArchitectureTemplate/blob/master/Solution/DataAccess/Context/ScrabbleClubContext.cs#L106

Another example why SATS technology needs custom rules (re: Detecting SQL Injection on .NET Entity framework)

In Darren's great SQL Injection with Entity Framework 5 and Static Code Analysis post, he mentions how all SAST tools he used failed to find this security vulnerability:


The reason is simple: None of the tools he used had the Database.SqlQuery Method marked as a Sink (and btw last time I checked FxCop is not a SAST tool)

One of the things I wanted to do this week was to add a rules manager/editor to CAT.net (see my current research on this SAST tool from Microsoft here), and this could a good example (i.e. show how to write a custom CAT.Net rule to detect this security issue).

Reaching out to Microsoft regarding CAT.NET

After an intro, where is the email I just sent to the Microsoft guy who owns Cat.NET

Let's see what happens :)

---

Hi ....

It's nice to meet you, and I hope that you find interesting what we've doing with Cat.NET.

Basically we extracted the files that come from the Cat.NET v1.1 MSI installer and:

1. Used reflection to access the Cat.NET engine directly and fire scans using pre-loaded assemblies
2. Found a way to run Cat.NET outside VisualStudio (as a stand-alone application)
3. Created a Cat.NET based VisualStudio Extension for the TeamMentor product I'm developing for SI,  which hooks into the VisualStudio compilation process, fires a scan on build and shows the Cat.NET results in the Error List view (hyperlinked to the TeamMentor Guidance)
4. Found a way to use Cat.Net with Roslyn, and packaged the whole thing (Gui, referenced dlls and  required Cat.NET files) into 1 (one) executable file that is all the user needs to run Cat.NET in their box (this about the power of distributing custom scanners this way)
• btw, you can download this executable from TM - RealTime Security Scan v1.4.exe 

Note: If you only have time to look at three things from this email, the best ones are:

• The video at Real-time Vulnerability Creation Feedback inside VisualStudio (with Greens and Reds) 
• The "Custom Cat.NET GUI executable": TM - RealTime Security Scan v1.4.exe 
• The "Cat.NET + TeamMentor" Extension at VisualStudio Gallery: TeamMentor VisualStudio with CatNet 

But if you are curious and have a couple minutes to spare, I've written a number of blog posts that show these ideas/PoCs in action and my thinking so far (sorted by chronological order so you can see the evolution):

• Video: Injecting TeamMentor into Cat.Net running inside VisualStudio 
• Video: Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) 
• Using Roslyn to Load and (quickly) Compile C# Solution files (outside VisualStudio) 
• Using/Consuming Cat.Net's engine inside the O2 Platform (and outside VisualStudio) 
• New Reddit Community for Cat.Net 
• Running Cat.NET SAST Scanner outside VisualStudio 
• Real-Time C# Solution Compilation and Security Scanning (using Roslyn and Cat.NET) 
• Real-time Vulnerability Creation Feedback inside VisualStudio (with Greens and Reds) 
• CatNet in VisualStudio with TeamMentor - Final Beta version 
• What am I doing with Cat.NET? 
• What are the challenges with SAST that don't need a better engine 

I know this is a long list of links, but hopefully they show the effort so far, and the fact that Cat.NET is good enough for the problems we are currently solving. For example:

• finding the best way to show TeamMentor guidance for findings,
• improving Scanning Rules,
• adding support for Frameworks like ASP.NET MVC, 
• etc... (see my post on the SAST challenges).

Yes, I'm aware of the limitations of the current engine, but ironically me and the others CCed on this list have been able to get better results from it than from other commercial vendors (after tweaking the rules and scanning workflow).

The reality is that although it would be great if you (and other at MSFT) joined the efforts in making Cat.NET even better, that is not necessary. We already have access to Cat.NET source code (via the 'Save source code' capabilities of tools like Reflector or ILSPY) so we can do it ourselves :)

FYI, I have asked (without much success) the SDL team on this MSDN forum question to allow the release/modification of Cat.NET code and its use on azure-like service.

So, what do you think of all of this?

I have lots of ideas for Cat.NET and would love to work with you in making them a reality.

Are you interested?

What are the challenges with SAST that don't need a better engine

Earlier today I commented on twitter "I've been trying to tell the Commercial SAST vendors for ages that current problems is not the engine" and was asked 'What do you see the problem being?'.

So here is my very quick list of problems I see with SAST engines, which have nothing to do with the core engine

What am I doing with Cat.NET?

I was asked this today, so here is the answer (in Oct 2012).

I'm:

• showing what a SAST should do 
• 'making it work' 
• showing how a 'real-time' SAST scanner is possible and can be made to work (namely educating the 'buying audience' that this possible and they should demand it from their SAST vendors/suppliers)
• figuring out the workflow needed for SAST to be effective used in SDLs
• expanding the SAST usage by getting developers and software teams realize the value of SAST
• educating developers and security consultants on:
• how to use SAST technology
• what secure code looks like
• what vulnerable code looks like
• show how SAST can be integrated with other tools. For example with the O2 PoCs, I already show integration with:
• VisualStudio 2010 
• Roslyn
• MSBuild
• a stand-alone exe (i.e. running/distributing a scanner in one stand-alone exe)
• TeamMentor (ie. show how its guidance can be used by an developer in an IDE)
• developing public schemas for findings, rules, coding artefacts, etc...
• creating a community to publish, share and comment on SAST rules
• creating an environment where commercial (or OpenSource) SAST vendors/products/services, can come together and collaborate.

The last point is the most important, I have no interrest in developing a SAST engine or solve the hard scalability challenges that come with it. 

What I really want is to get us all working together so that we can really make a difference in the Web Application Security world.

Unfortunately, in Oct 2012 there is not one SAST company that is playing the game ... but hopefully once we build it they will come :)

So, ultimately, the reason I'm using Cat.NET is because I CAN :)

Cat.NET is the only free SAST engine that I can easily customise and use! 

As mention in Providing licenses to security consultants , the SAST vendors still have no idea/solution/program to deal security consultants like me. Which is not very clever, since they are losing a lot of mind-share by being over protective of their technology (and those 'super precious rules')

If you are interested in SAST and want to be involved, here is a list of areas that need energy: What are the challenges with SAST that don't need a better engine

CatNet in VisualStudio with TeamMentor - Final Beta version

Also on VisualStudio Gallery is now the final beta of the CatNet in VisualStudio with TeamMentor VS2010 Extension (this is based on the same FluentSharp API as the VisualStudio C# REPL

Please give it a test drive in VisualStudio 2010 and start thinking about the best way to use this technology/technique to communicate with developers.

This is the version that has the integration with Cat.NET SAST engine, and if all goes OK, it should look like this after a compilation:

... and like this (after selecting one of the errors):

FxCop Security rules : A nice to have feature on top of O2 platform

Check out this nice post from Michael Hidalgo on O2's blog : FxCop Security rules : A nice to have feature on top of O2 platform

And yes, I agree that we should add Fx-Cop to O2. 

So who wants to do it? This could actually be a good case study for how to add support for other tools to O2. I do this all the time, so it would be good if you guys also figured out how to do it too :)

Btw, if you want to write a blog post on the O2 Platform blog, let me know your wordpress account and I'll add you to it

Help in sorting out the Cat.NET's EnvDTE dependency

I've been under a rock for the past month coding away (more details later) and one of the modules I created was a stand-alone O2 Tool (one file) that exposes the Cat.NET engine outside VisualStudio.

You can get it from the latest version of O2 (GitHub) or from this DropBox download: Tool - Cat.Net outside VisualStudio v1.3.exe

You can see below how it is supposed to work, but I'm having an issue at the moment which would be great if somebody could help in.

Basically the problem is that there is an dependency on EnvDTE which only happens on certain installs.

I have been able to run this tool on VMs with and without VisualStudio installed, so there must be something else that installs EnvDTE on a box (like the one I was using at EC2).

The problem is that one of my users is not able to run the O2 scripts based on the O2's Cat.NET APIs, and we need to figure out what needs to be added (or removed) in order to make this work.

This is how we have to show security vulnerabilities to developers (in real time as they are created)

I posted a PoC today that represents my vision for O2 and what I have been trying to do for the past 5 years.

You can see the video at Real-time Vulnerability Creation Feedback inside VisualStudio (with Greens and Reds) where every time the user makes a change to the code there is an auto-compilation (using Roslyn's C# compiler) and a SAST scan (using Cat.NET)

What I like the most about this, is that I now get to think about 'the best workflow to present developers the security guidance they need'.

Although this PoC is quite agressive (I do a compilation and scan on every keystoke which is a bit OTT), here is another video that shows a bigger compilation+scan on save: Real-Time C# Solution Compilation and Security Scanning (using Roslyn and Cat.NET) 

What do you think?

Real-time Vulnerability Creation Feedback inside VisualStudio (with Greens and Reds)

Here is a pretty cool PoC of a Real-time Vulnerability Creation Feedback inside VisualStudio where I show how a number of security vulnerabilities (XSS, SQL Injection, Path Transversal, Unvalidated Redirects) are detected as soon as they are created.

I'm trying to find out the best visual way to present this info to the user, and Greens/Red are usually a good indication of good/bad stuff (also note how the squiggly lines show the traces (i.e. the places where there is a vulnerability)

If you want to comment on this PoC or idea, please use this reddit thread 

Related posts:

• Real-Time C# Solution Compilation and Security Scanning (using Roslyn and Cat.NET) 
• Running Cat.NET SAST Scanner outside VisualStudio 
• 1 line to compile, create and execute: O2 Script to use Roslyn to Dynamically compile and execute a method 
• New Reddit Community for Cat.Net 
• Using/Consuming Cat.Net's engine inside the O2 Platform (and outside VisualStudio) 
• Using Roslyn to Load and (quickly) Compile C# Solution files (outside VisualStudio) 
• Video: Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) 

Real-Time C# Solution Compilation and Security Scanning (using Roslyn and Cat.NET)

On the Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) example, the compilation and scanning happened on a single file, which was cool, but not that realistic.

The next step was to be able to compile and scan an VS Solution file (*.sln), like one from the 'vulnerable by design' SuperSecureBank site.

In the video below, I use Roslyn's project loading and monitoring capabilities to trigger a compilation every time there is a change made to a solution file. And if the compilation is ok, a security scan (using Cat.NET) is triggered (both steps done in a couple seconds):

Running Cat.NET SAST Scanner outside VisualStudio

One of the big limitations of Cat.NET was its need to be executed inside VisualStudio.

Yes VisualStudio is one of the places where we want to use Cat.NET's engine and GUIs, but it is also very important to be able to run it as a stand-alone tool (and to inject it into other .NET applications).

Here is a video that shows a GUI/script I created with the O2 Platfrom, which shows the execution of Cat.NET GUIs + Scanning engine outside VisualStudio, and a couple extra features added.

Removing an Event from a WinForm ListView control using reflection

The objective was to remove an event from a WinForm control that we don't have the source code for (and can't recompile and remove the event on directly on the source code).

This problem happened originally when dynamicaly consuming Cat.NET's guis (outside VisualStudio) and there were a couple controls (like a ListView) that hooked event handlers that triggered functions that had DTE dependencies (which triggered an exception since we were running Cat.NET outside visualstudio (and the DTE2 object was null).

There doesn't seem to be an easy way to do this (and google didn't find a good solution) so using O2's powerful reflection APIs I was able to find a solution which is now available as these extensionmethods:



Here is a document that shows how these extension methods were created:

New Reddit Community for Cat.Net

I just created a new Cat.Net community (discussion forum) at Reddit.

You can access it at http://www.reddit.com/r/CatNet/ and if you are interested in this topic, please subscribe to it :)

To seed this community, I added my recent Cat.Net-related posts. and here is what it looks like:

For reference, here is the current introduction text (to be rewriten once there is more activity on this Reddit community)

"Since Microsoft stopped supporting its static analysis engine there is no place to talk and discuss about this engine and what can be done with it.

There is a lot of Cat.Net related activity happening (for example at the OWASP O2 Platform project), so the objective of this Community is to capture and enhance it"

I am a recent Redit user, but the more I used it the more I like it

 ... starting to think of creating a Reddi't community for the O2 Platform... :)

Using/Consuming Cat.Net's engine inside the O2 Platform (and outside VisualStudio)

A key component of the Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) PoC is the 'Real Time' part :)

The only way to achieve that type scanning speeds was to find a way to directly consume (i.e. access) Cat.Net scanning engine directly (i.e. in-process), instead of the command line (this will also be critical when we try to scan large projects, which will need to sliced, partially scanned and have its results glued/merged).

The document below shows how I did that and the evolution of the scripts.

Note that by these techniques, we have access to the entire Cat.Net scanning engine and can easily control its rules and execution workflow :)

In addition to the sheer fast-prototyping/development speed that we get with O2's REPL Scripting environment, one the key advantages of doing this type of development on top of the O2 Platform is the number of Static-Analysis-focused tools/APIs that already exists. For example note how I was able to easy consume/transform the Cat.Net findings into O2Findings (which can then be consumed/manipulated by the multiple O2Finding's viewers and tools)

asd

Video: Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST)

Here is a pretty cool PoC of creating an environment for developers that helps them to know when they create a security vulnerability (in real time).

Video: Injecting TeamMentor into Cat.Net running inside VisualStudio

Here is a pretty cool PoC where I used the O2 VisualStudio 2010 APIs to inject TeamMentor into Cat.NET.

To replicate this you will need:

• O2 AddIn installed (see how to install O2 in VisualStudio)
• CatNet Add-in installed (download Cat.Net installer from here)
• Local instance of TeamMentor with OWASP library (download it from here, or clone it from here)

Here is a video that shows the install process in action, and the extra functionality added to Cat.Net