If the tool is unable to “guess” where some pages or files are located, or is blocked by complex authentication or session management, then it would not be able to effectively attack and assess the security of those hidden resources. The developer can then end up with a false sense of security.
A Three-Way Match
Consider the example of a cross-site scripting vulnerability whereby an attacker is able to embed malicious code into an application and trick a user into executing the code on their own machine. During security testing, a source code analysis product might be able to identify the potential of a cross-site scripting vulnerability by finding un-validated inputs or poor session handling–if the particular language and compiler is supported. This information is useful to a developer when pinpointing potential problems. But efforts can be misdirected or wasted when developers spend time fixing a potential vulnerability that in reality is not even exploitable in the application.
A hybrid analysis tool, which will know about the cross-site scripting possibility from an analysis of the source code, will target this potential vulnerability during the dynamic analysis phase of security testing. The tool can accurately determine whether the page is exploitable by attempting to hack it. Furthermore, dynamic analysis can also identify vulnerabilities in a third-party component or database code that source code analysis would not uncover, since it doesn´t have access to the third-party component’s source code.
Developers are beginning to take the important step toward performing security testing before their applications leave their environments. Analysis tools, such as source code analysis or dynamic analysis, are alone only a partial solution. Developers should look toward hybrid analysis tools to help them secure code more easily and confidently.