← Back
Offensive security assessments

Source Vulnerable and Fix example

We validate this area during scoped assessments, documenting impact and remediation guidance.

Why it matters

- Vulnerable Code: Direct concatenation of user input into SQL query. - Fix: Use parameterized queries to separate data from commands. - Fixed Code

How we test it

Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.

Testing approach

  • Vulnerable Code: Direct use of user-controlled input in HTTP requests.
  • Fix: Validate and restrict user-supplied URLs to prevent SSRF.
  • Vulnerable Code: Rendering user input without proper escaping.
  • Fix: Use escaping functions to prevent injection of malicious scripts.
  • Vulnerable Code: Lack of CSRF token protection in forms.
  • Fix: Include CSRF tokens in forms and AJAX requests.
  • Vulnerable Code: Directly opens a file without proper validation.
  • Fix: Check if the file exists before reading its content.

What we look for

  • Vulnerable Code: Direct use of user-controlled input in HTTP requests.
  • Fix: Validate and restrict user-supplied URLs to prevent SSRF.
  • Vulnerable Code: Rendering user input without proper escaping.
  • Fix: Use escaping functions to prevent injection of malicious scripts.
  • Vulnerable Code: Lack of CSRF token protection in forms.
  • Fix: Include CSRF tokens in forms and AJAX requests.
  • Vulnerable Code: Directly opens a file without proper validation.
  • Fix: Check if the file exists before reading its content.

Related topics

TopicSummary
InsecurFunWe validate this area during scoped assessments, documenting impact and remediation guidance.
Java Code Analysis Basics for PentestersWe validate this area during scoped assessments, documenting impact and remediation guidance.
Kotlin Backend Components and Security TestingWe validate this area during scoped assessments, documenting impact and remediation guidance.
Python Secure Code Review Notes for PentestersPractical Python secure code review and vulnerability hunting notes for pentesters, AppSec engineers, and security researchers.
TroubleShootThe error you're seeing is caused by the SonarQube Scanner trying to analyze Java files in your project without having access to compiled Java classes (.class files). Here’s how to resolve this issue.