Dear PenTest Readers,
In this month’s edition we look into Secure Development Lifecycle, as the understanding of this process is one of the key aspects for effective pentesting. Knowing the best practices for secure code reviewing definitely helps to check if everything has been performed in the right way, and therefore - look for potential vulnerabilities!
The issue opens with a very interesting case for SDLC. Jamel Metmati, who works for European Space Agency, presents the specificity of software development for computers in the context of Space exploration.
Filipi Pires, our regular contributor and course instructor, provided an article on a new open-source project for Secure Development - Horusec. This is a must read for every SDLC practitioner!
Aliraza Master contributes with a comprehensive explanation of how proper coding standards are the cornerstone of a security of every company.
Besides the main topic, we would like to draw your attention to the great tutorial on Buffer Overflow exploitation, written by Anthony Radzykewycz in two parts. A fantastic treat for all of you who are into exploits!
If you are looking for more and diverse cybersecurity tutorials and articles, you’ll read about DLL hijacking - a bug that has been ignored for years, and nice introductory walkthroughs on OSINT and Dark Web.
Last but not least, you’ll find an interview with one of our regular contributors, Bruce Williams, who shares his experiences and thoughts on infosecurity industry from the perspective of a seasoned veteran.
Without further ado,
Let’s dive into the reading!
PenTest Magazine's Editorial Team
Table of Contents
Space Software Development: The Lifecycle To New Space
by Jamel Metmati
This article presents the specificity of Space software development for computers in the context of Space with the rad hard components for module, far approach for robots, and with standard computers in a low cost mission.
Secure Development Using an Open Source Tool [FULL ARTICLE AVAILABLE IN THE FREE PREVIEW VERSION]
by Filipi Pires
Following OWASP’s TOP 10 reference, Horusec comes to apply the Security By Design logic, running a scan of your code easily and delivering relevant information, such as vulnerable lines of code, points the file, the level of severity and then informs the best way to fix, helping to ensure multi-layered security to protect your organization from security breaches and attacks, Horusec is here to help you in the best way and with the utmost ease!
Importance of Secure Coding Standards for Any Organization
by Aliraza Master
Security standards must be realistic and enforceable. As coding standards and conventions are created, it's an excellent time to establish testing and validation. For example, what tools do you have at your disposal to assist validation that code follows the established policies? Would you like to believe manual code review? Will it be possible to automate tests to assist you upon validation? Incorporating the considerations above can lead to catching problems more effectively earlier in the development when they are less expensive to find and fix.
An Introduction to Creating Buffer Overflow Exploits: Brainpan. Part 1.
by Anthony Radzykewycz
This tutorial will walk through the process of creating a basic buffer overflow exploit. Despite this being a basic introduction to exploit development, the information in this guide will hopefully help you with the level of expectation to complete the OSCP buffer overflow exercise.
An Introduction to Creating Buffer Overflow Exploits: Brainpan. Part 2.
by Anthony Radzykewycz
We continue our tutorial after preparing the groundwork. Now it’s time to generate and test our shellcode and gain entry to the target host, having the privilege escalation process all set up! The full exploit code is presented at the end of the writeup.
DLL Hijacking: A Bug That Has Been Ignored For Years
by Rikunj Sindhwad
This article is about a bug that is ignored most of the time due to lack of knowledge or efforts to find and exploit, a bug that is easy to learn but sometimes requires great thinking or knowledge to digest concepts, a bug that can lead to multiple vulnerabilities, like LPE (local privilege escalation) or RCE (Remote Command Execution). This bug is known as binary planting or DLL Hijacking.
Automating Your Source Code Review Process
by Sanjeev Krishan
It is essential that we write quality code from day one to deliver high-quality products. We need to educate and encourage developers about quality by continuously monitoring/promoting throughout the development life cycle with various security methods. We can make a reliable source code review process with automation using the script and integration tools. This makes the source code review effortless and vulnerability free. All we need to know is how to use the available tools/methods, and how best we can leverage, integrate and orchestrate, them to create an end-to-end system in place which we can call the "Automated Review System."
“Having Red Teams with their speciality in knowing the playbooks of the various groups is the key.”
an interview with Bruce Williams
I suspect that there will be an AI Morris worm which is developed and escapes. I think that there will be more use of people with less technical cybersecurity skills (social engineering, law etc) to form Red Teams. History has shown us every time we think we have a solution (DDoS blocked by Clouldflare technology then massive attack).
Accessing the Dark Web Securely, Anonymously, and Privately
by Dinesh Sharma
This article gives you a comprehensive guidance of taking your first steps into the obscure realm of Dark Web, presenting the most useful tools and keeping the good practice in terms of security and privacy.
No More Questions About Open Source Intelligence (OSINT)
by Lakshit Verma
This article is a great introduction to everyone who wants to find out what OSINT is and take the first steps in this fascinating cybersecurity area!