Skip to content

Home

Jump to bottom
Guy Acosta edited this page Dec 10, 2019 · 36 revisions

Welcome to the Application Inspector Wiki!

Public Beta Is Now Available

The project is in Beta with a general release planned for 12/14/19. It was presented at SecTor 2019 and has undergone improvements to UI, features and rules to achieve the highest accuracy and to increase breadth for detection.

Overview

Application Inspector's primary value is to identify source code features in a systematic and scalable way to help validate purported component objectives for greater illumination of what is really in the code. This has several benefits including increased ability to select components with only the expected features/behavior but to detect changes that are introduced across versions of a given project.

Knowing what is in your software is the first step to making choices about what actions are appropriate before allowing it to be deployed in your own or to customer environments. The tool has identifying patterns for general features about how it is constructed like frameworks used, file I/O, OS API's as well as the ability to detect key security and privacy features of a component.

Why It's Different

Modern applications rely heavily on software written outside of your company which comes with risks. Application Inspector can help you identify interesting characteristics of an application by examining source code for you saving significant time from performing this manually.

While other tools play an important role in automating detection of vulnerabilities, Application Inspector helps to answer the question what is in it? Application Inspector is judgement free, focusing instead on helping inform security and other scenarios by surfacing details that might otherwise go unnoticed.

Unseen Threats

A well constructed and hidden backdoor can go undetected by a tool that is only looking for poor security programming practices because it doesn’t look at context at a feature level.

Core Features

  • Characterizing key features of source code
  • Detecting sudden feature changes between component versions
  • Mapping detected features to security requirements (enabling-only)
  • True/false testing if specific features are present or not

Example Features Detection

Control Flow

  • Dynamic Code Execution
  • Process Management

Cryptography

  • Encryption
  • Hashing
  • Secrets
  • Randomization

OS Operations

  • File System
  • Environment Variables
  • Network Operations
  • User Accounts

Data

  • JSON/XML
  • Object Serialization
  • Secrets / Access Keys
  • Sensitive Data
  • SQL / ORM

Frameworks

  • Development
  • Testing
  • Dependencies

Service Providers

  • Cloud Services

To see a complete set of unique 'tags' supported for feature identification, use the exporttags command or simply review the default ruleset under the /rules folder.

Typical users

  • DevOps Engineers - View source code characteristics at a feature level to determine if a component contains only what is expected. Use to compare and find alternates to identify sudden and unexpected feature changes of significance.
  • IT Security Auditors - Evaluate risk presented when third-party software is included in solution source.

How to Run Application Inspector

Overview

The application is a client .NET Core based tool so it will run on Windows, Linux or macOS and does not require elevated privileges and there is no local database or network communications or telemetry. To run it , simply use the standard dotnet command line to invoke i.e. dotnet ApplicationInspector.dll if you are on a Linux or macOS system or if you are on Windows AppInspector.exe. See the readme or more on command options or the built-in help.

The basic steps for running are:

  1. Download a component in compressed or uncompressed formats
  2. Run Application Inspector pointing at the component source code, specifying the command, report format and other options.

Customizing Application Inspector

There are two primary ways to customize the content of the report results:

  • Custom Rules (feature pattern to scan for e.g. regex, language)
  • Custom Report (filter what features to display in the report output)

Custom Rules

You may add/edit/remove default rules or patterns as needed. We've worked hard to identify a large default starting set for the first release. You can also add your own rules in a separate path to the default set and retain the default set or exclude them using command line options. See help for more and this wiki for how to on rules schema

Custom Report

Application Inspector builds the HTML profile report section and json output dynamically around indicated preferred tags found in the preferences\tagreportgroups.json file. Simply update the patterns and icons indicated to adjust the report content to filter the results.

Clone this wiki locally