Pinpointing security vulnerabilities in computer software applications
A build process management system can acquire data pertaining to a software build process that is currently being executed by an automated software build system. The software build process can include executable process steps, metadata, and/or environmental parameter values. An executable process step can utilize a build artifact, representing an electronic document that supports the software build process. The acquired data can then be synthesized into an immutable baseline build process and associated baseline artifact library. The baseline artifact library can store copies of the build artifacts. The immutable baseline build process can include baseline objects that represent data values and dependencies indicated in the software build process. In response to a user-specified command, an operation can be performed upon the baseline build process and associated baseline artifact library.
1. A method comprising:
setting a debugging breakpoint within a computer software application proximate to an instruction that is correlated with an attack;
performing the attack on the computer software application during execution of the computer software application in a debugging mode;
halting the execution of the computer software application in the debugging mode when the attack triggers the debugging breakpoint; and
displaying the instruction on a computer display within the context of an interactive debugging session.
2. The method according to claim 1 and further comprising correlating the instruction with the attack.
3. The method according to claim 2 and further comprising statically analyzing the computer software application, prior to correlating the instruction with the attack, to identify the instruction as potentially representing a security vulnerability.
4. The method according to claim 2 and further comprising performing the attack during execution of the computer software application prior to correlating the instruction with the attack.
5. The method according to claim 4 and further comprising performing the attack wherein the attack is designed to test for a security vulnerability.
6. The method according to claim 4 and further comprising:
instrumenting the computer software application;
monitoring the computer software application during its execution in the debugging mode; and
detecting where the attack occurs within the computer software application, thereby identifying the instruction.
7. The method according to claim 1 wherein the step of displaying further comprises:
displaying a description of the attack;
displaying the instruction in the context of a listing of a plurality of instructions of the computer software application; and
making at least one execution environment value of the computer software application available for inspection.
8. The method of claim 1 , wherein the debugging breakpoint is set using a scan manager, wherein the attack performed on the software application uses a black-box tester, wherein the halting of the execution and the displaying of the instruction use a debugger, wherein the scan manager, the black-box tester, and the debugger each comprise computer program instructions stored in at least one storage medium, wherein the computer program instructions are executed by at least one processor.
9. The method of claim 1 , wherein the attack is designed to test for a security vulnerability, said method further comprising:
correlating the attack with an instruction from within the computer software application;
making at least one execution environment value of the computer software application available for inspection.
10. A method comprising:
performing an attack on a computer software application during execution of the computer software application, wherein the attack is designed to test for a security vulnerability;
correlating the attack with an instruction within the computer software application;
setting a debugging breakpoint within the computer software application proximate to the instruction;
performing the attack on the computer software application during execution of the computer software application in a debugging mode;
halting the execution of the computer software application in the debugging mode when the attack triggers the debugging breakpoint;
displaying the instruction and a description of the attack on a computer display within the context of an interactive debugging session; and
making at least one execution environment value of the computer software application available for inspection.
11. The method according to claim 10 and further comprising statically analyzing the computer software application, prior to correlating the instruction with the attack, to identify the instruction as potentially representing a security vulnerability.
12. The method according to claim 10 and further comprising:
instrumenting the computer software application;
monitoring the computer software application during its execution in the debugging mode; and
detecting where the attack occurs within the computer software application, thereby identifying the instruction.
13. The method of claim 10 , wherein the attack is performed prior to correlating the instruction with the attack, said method further comprising:
statistically analyzing the computer software application prior to correlating the instruction with the attack;
responsive to the statistically analyzing and based upon results from the statistical analyzing, identifying the instruction as potentially representing a security vulnerability;
instrumenting the computer software application;
monitoring the computer software application during its execution in the debugging mode; and
detecting where the attack occurs with the software application, thereby identifying the instruction.