RE: Web Application Source Vulnerability Scanners

["David Cameron" <dcameron () itis-now com>]

> For instance I'm currently looking for an ASP(vbs) security 
> code analizer,
> just like rats or the.other.one.that.I.cant.remenber.name . I 
> haven't find
> anything not free or comercial tool, that analizes visual 
> basic scripts and
> alerts me about security issues on the code.

If SQL injection is an issue, do a word search for SQL keywords (insert, update and select would be favorites but 
create might also be useful) through all the ASP pages. I am assuming that to avoid SQL injection you are using 
prepared statements (eg ADO command object). Also try searching for dynamic SQL in procs. Look for anything that looks 
like "'<some sql keyword>" (eg 'SELECT). For SQL Server check the syscomments table.

regards
David Cameron
nOw.b2b
dcameron () itis-now com