Webcast on TeamMentor integration with Checkmarx

If you want to see how TeamMentor integrates with Checkmarx (namely the special asmx proxy we created), me and Maty (from Checkmarx) are doing a webcast later today (1pm EST) which you can register at  http://web.securityinnovation.com/webinar-december/

The title is Faster & Better Remediation with Security Innovation’s TeamMentor and Checkmarx’s CxSuite and here is the session description:

Using TeamMentor Checkmarx proxy to scan a vulnerable PHP application inside Eclipse

Michael Hidalgo has posted a really nice article which shows:

• an PHP app, 
• inside Eclipse,
• scanned by Checkmark's SAST,
• with security guidance provided by TeamMentor

Check it out at : http://blog.michaelhidalgo.info/2013/09/using-teammentor-checkmarx-proxy-to.html

Notes on TeamMentor integration with CheckMarx (and pdf with info)

On the topic of integrating TeamMentor with Checkmarx, embeded below is nice document (created by Roman and Michael) that explains how it works and where the TM (TeamMentor) guidance shows up.

This is a major milestone for TM and it shows that the best place to consume TM is in the developer's IDE.

Couple notes on this implementation:

• The TM content shown is editable (with the idea that it should be customised to the target application, so that the developers can 'Copy and Page from TeamMentor')
• That said, without any customisation, the guidance shown is already 'language' sensitive, which means that for an ASP.NET scan we will show an ASP.NET TM article, for a Java scan we will show an Java TM article, etc... (the default Checkmarx Guidance uses CWE IDs which are generic and not language specific)
• The way this works is that we created a special TM Checkmarx Proxy which rewrites some of the data returned from the main Checkmarx server:
• we use the Checkmarx's QueryID to map to TM guidance, instead of CWE ID
• this actually means that we could easily add a LOT more changes to the data shown to the user (I see the current version of this TM Checkmarx Proxy as a warm up on what we can do with the powerful CheckMarx engine) 
• For more info see:
• multiple posts on this topic on my blog
• these recent posts on Michael's blog: 
• Consuming TeamMentor Checkmarx proxy from the Checkmarx Visual Studio Add-in 
• Configuring and consuming TeamMentor proxy from Checkmarx Web and Windows client and
• Consuming TeamMentor Checkmarx proxy from the Checkmarx Visual Studio Add-in )

(grab a coffee first) Using AST to programatically create a Proxy class for a WSDL webservice (in this case HacmeBank and Checkmarx ASMX)

For this past week I worked on a way to intercept and change data returned from an C# ASMX web service (exposed via a WSDL)

After trying multiple options (including PostSharp), I found a way to:

Programatically use AST C# generation (from ICSharpCode.NRefactory and O2 Platform's FluentSharp.REPL APIs) to:

• create a 'proxy' C# of  an ASMX with the same exposed web methods as the original one
• by default the new proxy ASMX WebService will call the original WebService's method (think class A implements class B, with all methods in class A calling the base method from class B)
• make it easy to extend the new ASMX WebService  C# code and change the data sent/received from/to the original WebService's methods.

While I was working on the solution, I created a number of (long) blog posts that explains in detail all the steps I took to create the 'proxy' C# of  an ASMX.

Here are they, ordered by creation date (so if you want to see the final result, look at the last one)

Using WebServices Proxy Wrapper to replace Checkmarx’s CWE Guidance with TeamMentor’s Articles

After Creating a WebServices Proxy Wrapper for Checkmarx’s CxWebService its time to replace the existing guidance with TeamMentor’s articles.

We start with a folder containing the CxWebService.asmx

Creating a WebServices Proxy Wrapper for Checkmarx’s CxWebService

Now that we have the an API to create proxies (see Creating an API to create the WebServices Proxy Wrapper classes/asmx files) its time to create the proxy I really need, which is the Checkmarx webservice responsible for (amongst other things) returning security guidance (see Adding O2's CSharp REPL to the Checkmarx main WebService for more details)

Currently I have the latest version of Checkmarx installed on my dev box, which uses the UltraDev web server:

Adding O2's CSharp REPL to the Checkmarx main WebService

I’m working on the integration of TeamMentor with Checkmarx and needed to have some control on how the data the WebServices returns.

The previous version of this integration made direct changes to the Checkmarx content database, but this time around that will not work, since for example CheckMarx maps it’s guidance to CWE_ID and we want to map the guidance to the Checkmarx’ Query_ID (TeamMentor has technology/application specific guidance, so we can show an SQL Injection article for Java and a different article for .NET (both have the same CWE_ID, but have different Query_ID)

Initially I was going to use PostSharp to add the TM specific code ‘on top’ of Checkmarx dlls, but since in effect this would mean the modification of CheckMarx dlls (to insert PostSharp aspects), I went for an hook on Http Pipeline instead :)

Would I recommend Checkmarx as a SAST engine?

I was asked this question twice in the last couple days, and my answer is YES!

Although CheckMarx is still not as open and easy to engage as I would like them to be, they are actually one of the best ones out there.

And there is one asset that CheckMarx SAST engine has that is REALLY GOOOOOOODDDDDDD!!!!

Their rules are written in C# and if you (like me) like to write custom rules, they have a nice REPL interface that can be used by power users (with access to a lot of the metadata and code-transformations created during the analysis phase)

I'm currently integrating TeamMentor with Checkmarx (for a joint customer) and I really like it. You can see our latest PoC at http://checkmarx.teammentor.net, which includes a view that shows a mapping between:

• a security finding, 
• it's CWE description
• the TeamMentor landing page (for that finding)
• the C# CheckMarx rule that triggered that finding

CheckMarx Queries in TeamMentor with some Landing Pages

Here is a pretty cool PoC (still in draft mode) of the integration of TeamMentor (TM) with Checkmarx content

You can see it at http://checkmarx.teammentor.net/Library/CheckMarx_Queries (which should only open the CheckMarx_Queries library in your browser)

Here the main features/capabilities:

• there is a TM Library that holds the CheckMarx's Query's data (created from the data retrieved from this WebMethod)
• there is a TM Folder per language type  - also mapped to the TM Article's Technology field
• there is a TM View per query type - also mapped to the TM Article's Phase field
• the Type field indicates if there is a TeamMentor Landing Page for a particular Query
• the Category field contains the CWE Id (good to see the cases when the same CWE is applied to multiple queries)
• The Article html content is made of:
• IFrame with TM Landing Page content (if there is a TM Landing Page) 
• IFrame with CWE content (if CWE ID > 0) 
• Query rule's Metadata
• Query rule's source (in Checkmarx meta C# language)

Get Html transformations of CWE Html from Checkmarx WebService

Next on the CheckMarx+TeamMentor path, I was curious to see if Checkmarx had rules for all the CWE entries on their database (which are about 865), so now that I have a nice way to get a dump of all their rules  I was able to run a quick quick C# LINQ query to calculate the unique CWE ids and then download the current HTML (gist is here):

Util - CheckMarx Rule and Guidance Viewer (with C# SAST Rules and CWE data)

The more I look at Checkmarx the more I like it, for example here is a simple Rules and Guidance viewer that was created by just visualising the 2Mbs of data retrieved from the GetQueryCollection WebMethod

The code is here (Gist) and the standalone exe is at Util - CheckMarx Rule and Guidance Viewer v1.0.exe

Taking a look at Checkmarx VistaDB database

Following from the VistaDB viewer I developed a while back I just updated it to work on x64.

It was mainly a case of fixing the references to VistaDB.Net20.dll and Checkmarx's CxDB.vdb3 file, like for example:

Updating Checkmarx license

I just updated the server-side Checkmarx  license on SI's test server.

Before the update, it looked like this (note the 10000 LOC limitation):

Consuming CheckMarx WebServices

Checkmarx exposes three WebServices (one as ASMX and two as WCF) which are used by their clients tools, for example the VisualStudio Add-in (that can be downloaded from here)

CxWebInterface

Which is the main external interface to their engine and can be accessed at public URL like for example http://checkmarx.teammentor.net/CxWebInterface/ (the Checkmarx server used on their web trials is at https://www.cxprivatecloud.com/CxWebInterface/ )

Making TeamMentor run on UltiDev server

Since Checkmarx runs on UltiDev's web server, it makes sense to also host TeamMentor on it (vs IIS which might not be installed on the target server).

The installation process was quite easy:

1. downloaded the eval copy of TeamMentor (which is the full engine with the OWASP Library) 
2. added a website in UltiDev's gui
3. configured the site to be an ASP.NET and pointed it to the TM_Website folder
4. didn't use any virtual dir, since Checkmarx wasn't using it and TeamMentor likes it that way :)
5. that was it

O2 Script - Create TM Library from CheckMarx CWE data

Bellow is a pretty cool O2 script that created an TeamMentor Library from the raw Xml files I extracted from the CheckMarx database:

This is what the created Library looks like:

Checkmarx database export, VistaDB in O2, Opening up Checkmark's rules, and more....

I just posted on the O2 Blog and TM Documentation the scripts I wrote during the PoC of integrating TeamMentor with Checkmarx:

• VistaDB API and GUI (as used by Checkmarx SAST engine) - O2 Blog
• Exporting Checkmarx SAST Database into XML files - O2 Blog
• Case Study – Creating a CWE Library from CheckMarx data - TM Documentation

Earlier today I had a call with Checkmarx to follow up the idea I talked with Maty (Checkmarx CTO) about the release of Checkmarx 'C# based rules' under an Open Source/CC license on GitHub.

I have to say that the Checkmarx camp seems really motivated to do this, and if they do it, it could be a big game changer (I offer to put those rules in GitHub since I already have the Query.xml file :), so lets see what happens next ).

Btw, if you are a Checkmarx customer (or are evaluating it - which if you are looking at SAST you should), drop them a line saying that it is a good idea :)

PoC of integrating TeamMentor with Checkmarx

Last week I did a pretty cool PoC where I integrated TeamMentor's Knowledge base with Checkmarx's SAST engine.

I used O2 to export the CWE data from the Checkmarx VistaDB into Xml, and from XML into TeamMentor.

This is what the end result looked like (a pretty cool preview of what we will do next together)