Re: security scanning software for source code?

[Erik Tayler <erik () 14X NET>]

I know of one at http://www.freshmeat.net/projects/its4/ . Never tried
it, but I will soon give it a shot. Looks somewhat mediocre, but hey.

Erik Tayler
http://www.14x.net
http://www.digitaloffense.net

"Sanchez, Scott" wrote:
> Hello all,
> Does anyone have any suggestions on products that will review application
> code (visual basic/c++, java applets and servlets, cgi's, etc.) for security
> weaknesses?
> I would love an engine that I can just drop my java servlets (or weblogic
> code, xml, perl, css, etc.) into and it would look for things like input
> fields that have missing or inadequate validation, passwords stored in the
> app, etc.  (I know, i'm asking for a lot).
> Does anybody have thoughts or suggestions? We have decided that it is
> impractical for us to write our own scanner at this point.
> Thanks.
> -Scott