• Public

Dynamic Analysis Group

Skip Feed

  1. Shuning, Veracode Community Manager (Veracode)

    Edited April 7, 2021 at 2:15 PM

    ⚠️ Announcement: this group will be archived at the end of the week.

     

    We wanted to give you a heads-up that we’re archiving this user group at the end of this week, to help centralize discussions in the Dynamic Analysis topical forum where you can continue to ask questions, exchange ideas, learn and share best practices, and get updates from the Veracode team.

     

    🔔To share feedback and stay on top of new discussions about Dynamic Analysis, follow #Veracode Dynamic Analysis​ and enable email notifications.

    Expand Post
    • 466 views

  2. Arun, Veracode Product Manager (Veracode, Inc.) asked a question.

    Edited by Shuning, Veracode Community Manager February 26, 2021 at 3:25 PM
    Introducing Scan Engine Variables for Dynamic Analysis

    How much time have you spent maintain login/crawl scripts when updating a variable like a password? Well, those days are behind you as we introduce our new Dynamic Analysis Scan Engine variable feature. Through the use of a simple API call, you can update variables in your scripts easily without the need to re-edit your scripts. More details can be found in the help centre.

     

    @Product Announcements​ 

    • 338 views
    ig596 likes this.

  3. Product Announcements — Shuning, Veracode Community Manager (Veracode) asked a question.

    Edited January 29, 2021 at 6:51 PM
    🚩Weekly Product Update (01.29.21): API Notifications, new SCA API, and Dynamic Findings

    Here's a summary of the release over the last two weeks. Let us know in the comment section below if you have any question!

     

    #Veracode Dynamic Analysis​ 

    Changes to Reporting of CWE-829 - no longer map findings concerning missing or misconfigured CSP headers to CWE-829 when responses have no body. 

     

    #Veracode Software Composition Analysis​ 

    New API Endpoint for Listing Issues by Project - The Veracode SCA Agent REST API includes a new endpoint for querying issues by the project ID. This endpoint enables you to view issues specific to a project in an agent-based scan workspace. If the project is a container, the API also lists all issues linked to projects inside the container. 

     

    #Veracode Platform​ 

    Improved Email Notifications for Expiring API Credentials - Veracode sends an email notification when your Veracode API credentials are about to expire. The email now displays your API username for quickly identifying the account for which you need to generate new credentials. 

     

    @Dynamic Analysis Group (Archived)​ @Software Composition Analysis Group (Archived)​ 

    Expand Post
    • 300 views
    VCode likes this.

  6. PBetley175101 (Community Member) asked a question.

    February 14, 2020 at 9:51 PM
    Link Multiple URLs to an application

    I have an app I want to have run as a dynamic scan. I set it up with 2 URLs, one for admins and one for users: https://example.com and https://example.com/admin. Each has its own unique login credentials.

     

    If I have a dynamic scan set up like this, how can I have both URLs point to the same application? It's the same codebase, just two different sets of credentials as the reason for the distinct URLs

    • 1 answer
    • 604 views

    • Anthony Fielding (Veracode)

      Hi @PBetley175101 (Community Member)​,

      Authentication details specific for each URL can be configured by following the documentation here: https://help.veracode.com/reader/OZJ0LCrqCUqbxFvNFcJnWQ/MiYThLqe2M0~mr9GqEHFLA.

       

      The platform will analyse the application twice, each time from the perspective of the authenticated user, as well as from an unauthenticated perspective. The platform has no notion of the underlying codebase as it is not operating at a source or binary level when performing a dynamic analysis.

       

      It should be noted that caution should be exercised when testing administrative accounts especially in production environments. Due to the nature of the scanner, it may pollute data due to input fuzzing or it may perform unwanted actions such as disabling user accounts etc.

       

      I hope that answers your question, but if not please do get in touch. Alternatively if you have any ideas for feature requests you may wish to visit https://community.veracode.com/s/ideas.

       

      Thanks,

      Anthony Fielding

      Expand Post

  7. PBetley175101 (Community Member) asked a question.

    February 7, 2020 at 6:55 PM
    Having issue with Login Script

    Login script was built using Selenium IDE. It's pretty simple, fill in two fields, click submit button. On next page click a second submit button, verifying identity. Verify text on third page.

     

    The login script appears to work fine when I run it in the Selenium IDE, but fails when trying to use it for a Dynamic Scan, and fails on the "assertText" step of the third page.

     

    Any reason why it is only failing in the Veracode Dynamic Prescan?

    Expand Post
    • 1 answer
    • 604 views

End of Feed
8 Chatter Feed Items